SecurityFocus Newsletter #221

SecurityFocus Newsletter #221
------------------------------

This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_sf-news_031103
and use priority code SF4.
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Introduction to Nessus
     2. Reeducation Campaign
     3. Pretty Good at Gettin' By
II. BUGTRAQ SUMMARY
     1. Sun Solstice X.25 Denial of Service Vulnerability
     2. Sun Solstice X.25 snmpx25d Buffer Overflow Vulnerability
     3. Apache Cocoon Directory Traversal Vulnerability
     4. Microsoft Windows HTML Help API Privilege Escalation Vulnera...
     5. Microsoft Internet Explorer Local Resource Reference Vulnera...
     6. Opera Web Browser IFRAME Zone Restriction Bypass Vulnerabili...
     7. CDE dtprintinfo Unspecified Remote Unauthorized Access Vulne...
     8. Atrium Software Mercur Mailserver POP3 AUTH Remote Buffer Ov...
     9. Multiple Advanced Poll PHP Vulnerabilities
     10. Rit Research Labs The Bat! User Directories Insecure Default...
     11. Sun Microsystems Java Virtual Machine Security Manager Denia...
     12. Yahoo! Messenger File Transfer Buffer Overrun Vulnerability
     13. Chi Kien Uong Guestbook HTML Injection Vulnerability
     14. Chi Kien Uong Guestbook Cross-Site Scripting Vulnerability
     15. SH-HTTPD Character Filtering Remote Information Disclosure V...
     16. RedHat Apache Directory Index Default Configuration Error
     17. Musicqueue SIGSEGV Signal Handler Insecure File Creation Vul...
     18. Macromedia Flash Player Flash Cookie Predictable File Locati...
     19. IWConfig Local ARGV Command Line Buffer Overflow Vulnerabili...
     20. Les Visiteurs Multiple Remote File Include Vulnerabilities
     21. Musicqueue Multiple Buffer Overrun Vulnerabilities
     22. Symantec Norton Internet Security Error Message Cross-Site S...
     23. thttpd defang Remote Buffer Overflow Vulnerability
     24. Novell PMAP.NLM Buffer Overrun Vulnerability
     25. Fastream NetFile Error Message Cross-Site Scripting Vulnerab...
     26. InfronTech WebTide Directory/File Disclosure Vulnerability
     27. Bytehoard Files.INC.PHP Root Directory Disclosure Vulnerabil...
     28. Apache Web Server Multiple Module Local Buffer Overflow Vuln...
     29. Apple Mac OS X Panther Screen Effects Locking Latency Vulner...
     30. MacOS X Long Argv Value Kernel Buffer Overrun Vulnerability
     31. Apple Mac OS X Core File Symbolic Link Vulnerability
     32. kpopup Privileged Command Execution Vulnerability
     33. Apple Mac OS X Insecure File Permissions Vulnerabilities
     34. Apple Mac OS X Multiple Vulnerabilities
     35. kpopup Local Arguments Format String Vulnerability
     36. Apache Mod_Security Module Heap Corruption Vulnerability
     37. Centrinity FirstClass HTTP Server Directory Disclosure Vulne...
     38. SGI IRIX NFS Exportfs Wildcard Entry Unauthorized Access Vul...
     39. Apple Mac OS X 10.3 Unspecified Apple Quicktime Java Vulnera...
     40. Oracle Files Restricted Content Access Vulnerability
     41. TelCondex SimpleWebserver HTTP Referer Remote Buffer Overflo...
     42. Apache Web Server mod_cgid Module CGI Data Redirection Vulne...
     43. Multiple Vendor HTTP Server IPv6 Socket IPv4 Mapped Address ...
     44. Nokia IPSO Unspecified Denial of Service Vulnerability
     45. Sun Solaris NFS Server Unspecified Remote Denial Of Service ...
     46. E107 Chatbox.php Denial of Service Vulnerability
     47. BEA Tuxedo and WebLogic Enterprise Input Validation Vulnerab...
     48. Booby Error Message Cross-Site Scripting Vulnerability
     49. Ledscripts LedForums Multiple Fileds HTML Injection Vulnerab...
     50. Cisco IOS OSPF Potential Routing Table Corruption Vulnerabil...
     51. Serious Sam Engine Remote Denial of Service Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
     1. Unlucky phisher pleads guilty
     2. No effect seen in hack disclosure law
     3. Justice e-censorship gaffe sparks controversy
     4. Brazilian script kiddie arrested in Japan
     5. The Web is littered with Web sites long abandoned
     6. Cliff Stanford denies hacking Redbus
IV. SECURITYFOCUS TOP 6 TOOLS
     1. Lutel Firewall v0.72
     2. BitDefender for Sendmail libmilter v1.5.5-BETA
     3. KAVClient v0.2.1
     4. sensorTrends v0.6
     5. Apache DoS Evasive Maneuvers Module v1.9
     6. mod_securid v2.0
V. SECURITYJOBS LIST SUMMARY
     1. Technical Support Engineer Silicon Valley CA (Thread)
     2. List slow down. (Thread)
     3. ** Job Opening ** Seeking a seasoned Enterprise Secu... (Thread)
     4. Project Manager (Thread)
     5. 10 Nationwide Openings for Security Sales Engineers (Thread)
     6. Technology Services Professional (Thread)
     7. Unisys Simon Experience (Thread)
     8. two data security analyst needed in Herndon, VA/ add... (Thread)
     9. IT Audit (ERP)- Detroit and Chicago (Thread)
     10. Over 12 Federal Openings (SSL VPN, Patch, IPS, Polic... (Thread)
     11. IT Audit in Kansas City, MO (Thread)
     12. Sales Engineer (Thread)
     13. SOC Manager (Thread)
     14. Resume (Thread)
     15. Contract Network Security Specialist, New York City (Thread)
     16. Security Project Mgr with CISSP and 10 yrs Exp (Thread)
     17. Need Two Data Security Analyst in Herndon, VA (Thread)
     18. Looking for a Pre-Sales Engineer Position- West/ Sou... (Thread)
     19. eEye Technical Support Engineer - Geneva, Switzerlan... (Thread)
     20. Experienced security pro looking for a CISO/CSO spot (Thread)
     21. Sr. IT Security Positions-Iraq-MUST HAVE CURRENT US ... (Thread)
     22. Security Sales Engineer, based in UK, sales area wil... (Thread)
     23. Sr. Software QA Engineer opening- Cupertino, CA (Thread)
     24. POSITION: Site Security Specialist – Linthicum... (Thread)
     25. SAP HR Security, Connecticut | 3-month Contract (Thread)
     26. Security Engineer - Houston, TX (Thread)
     27. IT Audit - Sr. Associate position available- Ohio Va... (Thread)
     28. seeking Tivoli Security Specialist (Thread)
     29. Product Manager - Security (Thread)
     30. Product Specialist Opportunity at Core Security Tech... (Thread)
     31. Vulnerability and Threat Management position, Los An... (Thread)
     32. Senior Sales Engineers: East / Central / West (Thread)
     33. Director Network Security-NYC (Thread)
     34. Sales Engineer (Washington, DC and NYC) (Thread)
     35. Software Engineer position - Princeton, NJ (Thread)
     36. Area Sales Directors:  East / Central / West (Thread)
     37. Training Manager (Ann Arbor MI or Boston, MA) (Thread)
     38. THANK YOU!  and important 411 if you are applying to... (Thread)
     39. Senior Sales Engineers DOD (Thread)
     40. Seeking Senior Sales, Business Development, Position (Thread)
     41. "SecurityGuys", a securityjobs-like brazilian distri... (Thread)
     42. Anyone know of more Canadian focused lists? (Thread)
VI. INCIDENTS LIST SUMMARY
     1. Large increase in port 27347 (Thread)
     2. strange ftp site (Thread)
     3. New Trojan (Thread)
     4. [inbox] RE: Bogus DNS traffic (Thread)
     5. Persistant Connection to tcp/1423 (Thread)
     6. Random 2packet-probes on port 445 (Thread)
     7. Administrivia: Are you seeing portscans from source ... (Thread)
     8. Probable Trojan (Thread)
     9. Probable Trojan. (Thread)
     10. nachi ping (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
     1. SunOS/Solaris malloc (Thread)
     2. arp packet payload (Thread)
     3. Release of the Default Account Database v4.00 (Thread)
     4. CanSecWest/core04 Call For Papers (Thread)
     5. win32 stack bof & shellcode size (Thread)
     6. Fwd: Cisco AS5350 IOS 12.3(1a) OSPF bug? (Thread)
     7. Cisco AS5350 IOS 12.3(1a) OSPF bug? (Thread)
     8. Black Hat Briefings Announcement (Thread)
     9. Internet Explorer and Opera local zone restriction b... (Thread)
     10. win32 heap overflow exploitation (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
     1. ICF Firewall - How can I do it? (Thread)
     2. IIS 6 features (Thread)
     3. AW: Coexistance of Windows 2000 and Windows 2003 (Thread)
     4. Win Server 2k3 Hardening (Thread)
     5. MD5 sums for Nachi and Blaster variants? (Thread)
     6. Terminal Services Auditing? (Thread)
     7. Coexistance of Windows 2000 and Windows 2003 (Thread)
     8. Event Log messages for failed logon attempts (Thread)
     9. SecurityFocus Microsoft Newsletter #160 (Thread)
     10. Auditing enabled but Logon Failures not showing up (Thread)
IX. SUN FOCUS LIST SUMMARY
     1. rpc broadcasts (Thread)
X. LINUX FOCUS LIST SUMMARY
     1. Sendmail & Disk Quota on RedHat (Thread)
     2. NFS replacements for Linux (Thread)
     3. AntiVirus for Red Hat 9? (Thread)
XI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Introduction to Nessus
By Harry Anderson

This article describes the installation, configuration and features of the
latest version of Nessus, a powerful and free client-server based security
scanner.

http://www.securityfocus.com/infocus/1741

2. Reeducation Campaign
By Tim Mullen

Microsoft's best chance for regaining the revenue lost to security
concerns isn't in eliminating bugs, it's in teaching customers how to use
buggy software.

http://www.securityfocus.com/columnists/195

3. Pretty Good at Gettin' By
By George Smith

Whether it's a student slipping contraband past airport metal detectors,
or a researcher modeling an unstoppable computer virus -- demonstrations
just don't do justice to the real state of security.

http://www.securityfocus.com/columnists/194


II. BUGTRAQ SUMMARY
-------------------
1. Sun Solstice X.25 Denial of Service Vulnerability
BugTraq ID: 8881
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8881
Summary:
Sun Solstice is an implementation of the ITU-T's X.25 recommendation.  It
allows you to make connections to a Packet Switched Data Network (PSDN)
and communicate with remote devices running X.25.

A vulnerability has been reported to exist in the software that may allow
a remote attacker to cause a denial of service condition in the software.
The problem is reported to exist in the snmpx25d daemon.  It has been
reported that snmpx25d does not properly handle certain SNMP requests.  A
malformed SNMP request may cause the software to consume an excessive
amount of CPU cycles leading to a crash or hang.

Successful exploitation of this issue may allow an attacker to cause the
software to act in an unstable manner leading to a crash or hang.

This issue is related to previously released BIDs 4088 and 4089.

Sun Solstice X.25 version 9.2 and prior have been reported to be prone to
this issue, however other versions may be vulnerable as well.

2. Sun Solstice X.25 snmpx25d Buffer Overflow Vulnerability
BugTraq ID: 8882
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8882
Summary:
Sun Solstice is an implementation of the ITU-T's X.25 recommendation.  It
allows you to make connections to a Packet Switched Data Network (PSDN)
and communicate with remote devices running X.25.

A vulnerability has been reported to exist in the software that may allow
a remote attacker to to gain unauthorized access by executing arbitrary
code on a vulnerable system.

The problem is reported to exist in the snmpx25d daemon due to
insufficient boundary checking.  An attacker may leverage the issue by
exploiting an unbounded memory copy operation to overwrite the saved
return address/base pointer, causing the affected procedure to return to
an address of their choice.  The precise nature of this vulnerability is
not known at the moment due to a lack of details, however exploitation of
this issue may allow an attacker to execute arbitrary code on a vulnerable
system.

This issue is related to previously released BIDs 4088 and 4089.

Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the daemon in order to gain unauthorized
access to a vulnerable system.

Sun Solstice X.25 version 9.2 and prior have been reported to be prone to
this issue, however other versions may be vulnerable as well.

3. Apache Cocoon Directory Traversal Vulnerability
BugTraq ID: 8883
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8883
Summary:
Apache Cocoon is a XML Web development framework by Apache.

A vulnerability has been reported to exist in the software that may allow
a remote attacker to traverse outside the server root directory in order
to access sensitive server readable files.  The problem is reported to
exist in the sample "view-source" script.

The issue presents itself due to insufficient sanitization of
user-supplied input to the "filename" parameter and may allow an attacker
to access unauthorized information by issuing '../../../' character
sequences.

This vulnerability may be successfully exploited to gain sensitive
information about a vulnerable host that could be used to launch further
attacks against the system.

Apache Cocoon version 2.1 and 2.2 before 22 Oct 2003  have been reported
to be affected by this issue, however other versions may be affected as
well.

4. Microsoft Windows HTML Help API Privilege Escalation Vulnera...
BugTraq ID: 8884
Remote: No
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8884
Summary:
The Microsoft HTML Help API is the standard mechanism used by developers
of Windows software for providing and presenting "help" documents to
users.  It has been reported that the use of the Help API by applications
which run with elevated privileges may lead to an exploitable condition.

According to the report, the condition is present because of the way
Microsoft Internet Explorer is used as part of the help functionality.  It
is alleged that when the MSIE process is created, the privileges of the
application, if different from the user, are not lowered.  As a result, it
is reportedly possible for attackers to use the MSIE component to navigate
to the filesystem  and execute commands with the privileges of the
application from which the "help" interface was spawned.

Successful exploitation of this vulnerability is dependent on two
important factors:

The attacker must have local desktop access on the target host.  This may
be at the console or remotely (e.g. over terminal services).

There must be an application which will invoke the HTML Help API with
elevated privileges.  System-level utilities such as personal firewall and
anti-virus software may be ideal targets for this attack.

5. Microsoft Internet Explorer Local Resource Reference Vulnera...
BugTraq ID: 8886
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8886
Summary:
Microsoft Internet Explorer is prone to an issue that may allow for
unauthorized access to local resources.  Internet Explorer version 6 SP1
imposed restrictions to limit remote sites from accessing local resources
via file:// or res:// URIs (or other variants).  It is reported that these
restrictions may be bypassed by adding an additional slash when specifying
a resource via one of these protocols.   The following example was
provided:

file:///c:/somefile.html

This could aid in exploitation of other vulnerabilities, such as issues
that permit an attacker to create files on a client system in a
predictable location.  Such content could then be referenced by an
attacker using these protocols.

The initial vulnerability analysis stated that the issue allowed for Zone
Restriction Bypass via malformed IFRAMES.  Additional technical
information has been provided that contradicts the initial analysis.  BID
8900 was created to describe the separate issue in Macromedia Flash.

If this issue were exploited in combination with other issues, it would
still be possible to cause arbitrary code to be executed on a client
system.  The pre-requisites of exploitation are that an attacker must have
a way to store malicious content on a client system in a predictable
location and then must exploit this issue to reference that content,
causing it to be executed in the context of the Local Zone.  Other attacks
may also be possible and attack vectors may exist in other applications
that depend on Internet Explorer.

Liu Die Yu has released conflicting information that states that this
issue occurs because the user is redirected into a local resource and then
the local resource is being refreshed.  It is reported that other
variations such as "file://" or "[DriveLetter]:\[...]" also work with this
exploit.  This is currently under investigation.

6. Opera Web Browser IFRAME Zone Restriction Bypass Vulnerabili...
BugTraq ID: 8887
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8887
Summary:
Opera is a web browser available for a number of platforms, including
Microsoft Windows, Linux and Unix variants and Apple MacOS.

A flaw in the Opera web browsers security model has been discovered that
could allow an attacker to access a users file system within the Local
Zone. The problem occurs when handling malformed HTML iframes which point
to local system locations. Exploitation of this vulnerability could result
in the exposure of sensitive data or could potentially lead to the
corruption of system critical files. Symantec has confirmed that the proof
of concept provided by the researcher effectively gains opens access to
the local file system, however it has not been confirmed whether the local
files may be modified.

It should be noted that due to the nature of this vulnerability it may
theoretically be possible to leverage the condition to execute arbitrary
code. However, Symantec is currently unaware if a method exists under
which Opera can be influenced to carry out this type of operation.

This vulnerability is believed to affect the latest release of Opera as
well as prior releases.

**UPDATE: The vendor has contacted Symantec and has stated that this is
not a vulnerability.  Symantec has not been able to reproduce the claims
made by the individual who reported this issue.  This record is being
retired, though it may be re-activated if further findings confirm
existence of the vulnerability.

7. CDE dtprintinfo Unspecified Remote Unauthorized Access Vulne...
BugTraq ID: 8888
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8888
Summary:
dtprintinfo is a component of the Common Desktop Environment (CDE). CDE is
distributed with several UNIX platforms.

HP has reported that dtprintinfo may be prone to an unspecified
local/remote unauthorized access vulnerability. The precise details
regarding this issue are currently unavailable, however if more
information is released this BID will be updated accordingly.

Though it is currently known to affect only HP-UX, other UNIX platforms
are very likely also affected.

8. Atrium Software Mercur Mailserver POP3 AUTH Remote Buffer Ov...
BugTraq ID: 8889
Remote: Yes
Date Published: Oct 25 2003
Relevant URL: http://www.securityfocus.com/bid/8889
Summary:
MERCUR Mailserver is a commercially available mail software solution
distributed and maintained by Atrium Software International. It is
available for the Microsoft Windows platform.

A problem has been reported in MERCUR Mailserver when handling the POP3
AUTH command. This problem may make it possible for an attacker crash the
service on a vulnerable system.

The problem is in the handling of long arguments to the AUTH command. When
a string of excessive length is supplied to the AUTH command via the PLAIN
option, the process becomes unstable. This is due to a boundary condition
error in the base64 decoding routine.

It is possible for an attacker to exploit this issue to execute arbitrary
instructions. Any instructions executed on a vulnerable host would be
executed with the privileges of the POP3 server process, which in a
typical implementation may execute with SYSTEM privileges.

9. Multiple Advanced Poll PHP Vulnerabilities
BugTraq ID: 8890
Remote: Yes
Date Published: Oct 25 2003
Relevant URL: http://www.securityfocus.com/bid/8890
Summary:
Advanced Poll is a freely available, open source PHP web application.  It
is available for the Unix, Linux, and Microsoft platforms.

Several problems exist in Advanced Poll when handling input from remote
users.  Because of this, an attacker may be able to gain sensitive
information, include php files, or execute PHP code.

The following issues exist:

The comments.php file does not properly filter input in some fields.  If
magic_quotes_gpc=OFF has been set in PHP, an attacker could submit PHP
code in some fields to the script, which would execute the code on the
local host with the privileges of the web server process.

The following files allow the remote inclusion of arbitrary PHP files.
booth.php
poll_ssi.php
popup.php
index.php

(the above files are vulnerable with register_globals off or on)

admin_tpl_new.php
admin_tpl_misc_new.php
admin_templates_misc.php
admin_templates.php
admin_stats.php
admin_settings.php
admin_preview.php
admin_password.php
admin_logout.php
admin_license.php
admin_help.php
admin_embed.php
admin_edit.php
admin_comment.php

(the above files are vulnerable only with register_globals off)

An attacker could use this issue to reference PHP files on remote servers,
which would result in the execution of commands locally.

The file contained in misc/info.php allows a remote attacker to gain
information from the phpinfo() function.


10. Rit Research Labs The Bat! User Directories Insecure Default...
BugTraq ID: 8891
Remote: No
Date Published: Oct 25 2003
Relevant URL: http://www.securityfocus.com/bid/8891
Summary:
The Bat! is a commercially-available mail user agent, distributed and
maintained by Rit Research Labs.  It is available for the Microsoft
Windows platform.

A problem has been identified in the The Bat! e-mail client.  Because of
this, an attacker may be able to gain unauthorized access to potentially
sensitive information.

The problem is in the creation and maintenance of user directories.  When
a user is added and an account set up, the user's account is stored in the
following directory:

\Program Files\The Bat!\MAIL\USERACCT

USERACCT represents the username of a newly added user.  The Bat! does not
enforce proper access controls on these directories, making it possible
for an unauthorized user to read potentially sensitive information, such
as the user's e-mail archives.

11. Sun Microsystems Java Virtual Machine Security Manager Denia...
BugTraq ID: 8892
Remote: Yes
Date Published: Oct 26 2003
Relevant URL: http://www.securityfocus.com/bid/8892
Summary:
The Java Virtual Machine is a component of the Sun Microsystems Java
distributions.  It is available for Unix, Linux, and Microsoft Windows
platforms.

A problem has been reported in the Sun Microsystems Java Virtual Machine
that occurs when implementing the Security Manager.  Exploitation of this
condition can result in the crashing of the virtual machine itself.  The
specifics of the problem are not currently known.

Specific circumstances are not known in which exploitation of this issue
could occur.  The issue is, however, indicative of a problem in the
internals of the Java Virtual Machine.  It is conjectured that this is a
security issue, though this has not yet been confirmed.  This Bugtraq ID
will be further updated when further analysis and detail is available.

12. Yahoo! Messenger File Transfer Buffer Overrun Vulnerability
BugTraq ID: 8894
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8894
Summary:
Yahoo! Messenger is prone to a remotely exploitable buffer overrun
vulnerability.  This vulnerability is due to insufficient bounds checking
during user-initiated file transfer requests.

An attacker may trigger this condition by initiating a malformed
'sendfile' request, which the victim user must then accept.  The request
must be in excess of 73 bytes and contain a Yahoo ID, in addition to
enough %, & or ? characters to trigger the condition.  This will
reportedly result in an access violation error, which is likely due to
memory corruption.

An attacker may theoretically exploit this condition to execute arbitrary
code on a client system.  This condition can be exploited via a malicious
'sendfile' link.

13. Chi Kien Uong Guestbook HTML Injection Vulnerability
BugTraq ID: 8895
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8895
Summary:
Chi Kien Uong Guestbook is a guest book written in PHP.

Chi Kien Uong Guestbook has been reported prone to a HTML injection
vulnerability. The issue has been reported to present itself due to
insufficient sanitization of user-supplied data when a user posts a
message.  An attacker may submit a malicious post to inject arbitrary HTML
into dynamically generated content. This issue is due to a lack of
sufficient sanitization performed on the affected form fields.

An attacker may exploit this vulnerability to execute arbitrary HTML and
script code in the browser of an unsuspecting user who views the malicious
post. Code execution will occur in the context of the vulnerable site.
This issue may be exploited to steal cookie based credentials. Other
attacks are also possible.

It should be noted that although this vulnerability has been reported to
affect Chi Kien Uong Guestbook version 1.51, previous versions might also
be affected.

14. Chi Kien Uong Guestbook Cross-Site Scripting Vulnerability
BugTraq ID: 8896
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8896
Summary:
Chi Kien Uong Guestbook is a guest book written in PHP.

A cross-site scripting vulnerability has been reported to exist in the
software.

The problem is reported to exist when a user posts an e-mail or URL to the
affected site. The issue presents itself due to improper handling of
user-supplied data, specifically double quotes in certain parameters,
which will permit remote attackers to embed HTML and script code in links.
HTML and script code could then be rendered in the browser of the user
visiting the link. This attack would occur in the security context of the
vulnerable site.

Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information.

Chi Kien Uong Guestbook version 1.51 has been reported to be prone to this
vulnerability, however other versions may be affected as well.

15. SH-HTTPD Character Filtering Remote Information Disclosure V...
BugTraq ID: 8897
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8897
Summary:
sh-httpd is a freely available, open source web server written in shell.
It is available for the Unix and Linux platforms.

A problem has been identified in the handling of some characters by
sh-httpd.  Because of this, an attacker may be able to gain unauthorized
access to information.

The problem is in the handling of the asterisk character.  When a request
is made to the service for a directory listing using the asterisk
character (*), it is possible to see the contents of the entire directory
requested.  An attacker could use this issue to gather information about
host design, services enabled, and other potentially restricted
information.

16. RedHat Apache Directory Index Default Configuration Error
BugTraq ID: 8898
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8898
Summary:
A vulnerability has been reported to be present in the RedHat Apache
configuration that may allow remote attacker to view directory listings by
sending a specific HTTP GET request.

It has been reported that this issue exist even when autoindex for the
root directory has been disabled and a default welcome page is supposed to
be displayed.  A request for '//' reportedly evades a rule designed to
prevent Apache from displaying directory listings with a request for '/'.

Successful exploitation of this issue result in disclosure of sensitive
information which may be useful in further attacks against the system.

This problem has been reported to exist in Apache 2.0.40 shipped with
RedHat Linux 9.0.  It is possible that other versions are affected as
well.

17. Musicqueue SIGSEGV Signal Handler Insecure File Creation Vul...
BugTraq ID: 8899
Remote: No
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8899
Summary:
Musicqueue is a CGI-based jukebox utility designed to invoke external
programs to carry out a variety of tasks. Musicqueue is available for the
Linux operating system. This program includes a make suid installation
option, which will install the utility with suid and sgid privileges of
the installing user.

When the Musicqueue utility is invoked, the crash() function is registered
as the handling procedure for any generated SIGSEGV signals. The functions
sole functionality is calling the gcgiSaveEnvVariables() library function,
which takes a single argument that is the name of a temporary file. The
CGI environment variable data of the program that encountered the
segmentation violation is then stored within this file.

It has been discovered that the crash() signal handler incorrectly passes
the aforementioned library function a predictable filename for the storage
of environment information, specifically "/tmp/musicqueue.crash". As a
result, when handling a SIGSEGV signals, Musicqueue may be prone to
symbolic link attacks.

Due to the potentially attacker-controllable data contained within
environment variables, it is believed to be trivial for an attacker to
elevated privileges to those of the owner or group of the executable. On
some installations, this may effectively result in root compromise.

This vulnerability is said to affect Musicqueue 1.2.0, however earlier
versions may also be affected.

18. Macromedia Flash Player Flash Cookie Predictable File Locati...
BugTraq ID: 8900
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8900
Summary:
Macromedia Flash Player is reported to store Flash cookies (.sol files) in
a predictable location on client systems.  Specifically, Flash cookies
will be stored in the following location on the local filesystem:

%APPDATA%\Macromedia\Flash Player\YOURDOMAINNAME.TLD\YOURDOMAINNAME.sol

where %APPDATA% typically expands to C:/My
Documents/[username]/Application Data/.

Other attacks are possible given the ability to store content on a system
in a predictable location, such as referencing the content via a file://
URI (or some other variation).  This vulnerability is compounded by the
fact that an attacker could include HTML and script code in the cookie,
which may be interpreted by Internet Explorer or possibly other browsers.
In the example of Internet Explorer, such content would be interpreted in
the context of the Local Zone.

The issue could be exploited via a malicious web page that includes code
that sets a Flash cookie and then attempts to use some other means to
reference the cookie.  Successful exploitation would still require the
attacker to guess the local username of the victim.

This issue is reported to affect versions of the player for Microsoft
Windows operating systems.  Other versions may also be affected.
Macromedia Director MX is similarly affected.

This issue was originally covered by BID 8886 but has been determined to
be a distinct issue in Macromedia Flash.  BID 8886 was also updated with
additional technical details describing a new issue in Internet Explorer.
The original report for these issues was a proof-of-concept provided by
Mindwarper which exploited both of the issues simultaneously.

Andreas Sandblad has also demonstrated that it is possible to circumvent
the requirement of guessing the local username of the victim by exploiting
BID 7826.

19. IWConfig Local ARGV Command Line Buffer Overflow Vulnerabili...
BugTraq ID: 8901
Remote: No
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8901
Summary:
iwconfig is a freely available, open source wireless connection management
tool for Linux.

A problem has been identified in the iwconfig program when handling
strings on the commandline.  Because of this, a local attacker may be able
to gain elevated privileges.

The problem is in bounds checking.  It is possible to produce an
exploitable stack overflow by passing an argument of 96 or more bytes of
data as an argument to the program.  This problem is likely an overflow in
a function to which the data from ARGV is passed.

It should be noted that the iwconfig program is typically installed as a
setuid executable by default.

20. Les Visiteurs Multiple Remote File Include Vulnerabilities
BugTraq ID: 8902
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8902
Summary:
Les Visiteurs is a freely available, open source web site statistics
script.  It is written in PHP, and available for the Unix, Linux, and
Microsoft platforms.

A problem has been reported in the handling of some types of input by Les
Visiteurs.  Because of this, an attacker may be able to execute arbitrary
commands on the system.

The problem is in the handling of include files.  The config.inc.php and
new-visitor.inc.php scripts do not sufficiently validate include variables
at multiple locations within the script.  An attacker could supply a
remote location containing a malicious file and execute commands on the
host with the privileges of the web server.

21. Musicqueue Multiple Buffer Overrun Vulnerabilities
BugTraq ID: 8903
Remote: No
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8903
Summary:
Musicqueue is a CGI-based jukebox utility designed to invoke external
programs to carry out a variety of tasks. Musicqueue is available for the
Linux operating system. This program includes a make suid installation
option, which will install the utility with suid and sgid privileges of
the installing user.

Multiple buffer overrun vulnerabilities have been discovered in
Musicqueue. Both issues stem from the lack of bounds checking when passing
user-supplied input to the sprintf() libc function. As a result, it may be
possible for an attacker to exploit arbitrary code with the privileges the
affected application, possibly installed suid or sgid.

The problems specifically occur within the openLang() and langExists()
functions, passed the user-controllable 'language' parameter. It has been
reported that the openLang() issue may not be exploitable to due the
malicious data being limited to a range of ascii characters from 'a' to
'z'. However, it may be possible to carry out a partial pointer overwrite
in such a way that execution flow can be controlled. The langExists()
overrun is said to be trivially exploitable.

It should be noted that due to the nature of both of these issues,
triggering the bugs will potentially cause a SIGSEGV signal to be
generated. As a result, these vulnerabilities may be used in conjunction
with the vulnerability described in BID 8899, to effectively allowing for
privilege elevation.

22. Symantec Norton Internet Security Error Message Cross-Site S...
BugTraq ID: 8904
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8904
Summary:
Symantec Norton Internet Security is a suite of commercial security
utilities including Norton Personal Firewall and Norton Antivirus.

A vulnerability has been reported to present in the software that may
allow a remote attacker to execute HTML or script code in a user's
browser.

It has been reported that when Norton Internet Security blocks a website,
an error message containing the requested URL is returned to the user.
The problem exists due to insufficient sanitization of this URL, therefore
making it possible for an attacker to a construct a malicious link
containing HTML or script code that may be rendered in a user's browser
upon visiting that site. The script code would run in the context of the
blocked site.

Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.

Norton Internet Security 2003 v6.0.4.34 has been reported to be prone to
this issue, however other versions may be affected as well.

23. thttpd defang Remote Buffer Overflow Vulnerability
BugTraq ID: 8906
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8906
Summary:
thttpd is a HTTP web server application.

A vulnerability has been reported to exist in thttpd that may allow a
remote attacker to gain unauthorized access by executing arbitrary code on
a vulnerable system. The condition is present due to insufficient boundary
checking.

The problem is reported to exist due to the defang() function in
libhttpd.c.  The issue presents itself due to insufficient bounds
checking. A remote attacker may ultimately exploit this issue remotely and
execute arbitrary code in the context of the user who is running the
vulnerable software. Successful exploitation may allow a attacker to gain
unauthorized access to the vulnerable host.

Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the web server in order to gain
unauthorized access to a vulnerable system.

thttpd versions 2.21 to 2.23b1 have been reported to be prone to this
issue, however other versions may be affected as well.

24. Novell PMAP.NLM Buffer Overrun Vulnerability
BugTraq ID: 8907
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8907
Summary:
Novell has reported that the PMAP.NLM component of NetWare/ZenWorks is
prone to a buffer overrun vulnerability, which is reported to result in a
server abend.  This condition could potentially be exploited to cause a
denial of service or execute arbitrary code in the context of the
software.

Novell has not included many details about of this issue, though it is
conjectured to be remotely exploitable due to the nature of the PMAP.NLM
service.  This BID will be updated if more details are made available.

25. Fastream NetFile Error Message Cross-Site Scripting Vulnerab...
BugTraq ID: 8908
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8908
Summary:
Fastream NetFile is a FTP and web server for Microsoft Windows Platforms.

A vulnerability has been reported to present in the software that may
allow a remote attacker to execute HTML or script code in a user's
browser.

It has been reported that the problem arises when a non-exisiting URL is
requested.  The software returns a "404 Not Found" error message to the
user containing the URL. The problem exists due to insufficient
sanitization of this URL, therefore making it possible for an attacker to
a construct a malicious link containing HTML or script code that may be
rendered in a user's browser. The script code would run in the context of
the site.

Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.

NetFile FTP/Webserver Version 6.0.3.588 has been reported to be prone to
this issue, however other versions may be affected as well.

26. InfronTech WebTide Directory/File Disclosure Vulnerability
BugTraq ID: 8909
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8909
Summary:
Infrontech WebTide is a J2EE Web Application Server.

Infrontech WebTide is prone to a vulnerability that may permit remote
attackers to gain access to sensitive information.  In particular, by
submitting a request specifying a URL-encoded '?' character followed by a
.jsp extension (%3f.jsp), it is possible to list directory contents.  The
software reportedly serves a directory listing instead of the index file
for the directory.  It has also been reported that file contents, such as
script source code, may also be disclosed in this manner.

Given the ability to browse directory and file contents, an attacker may
potentially gain access to sensitive information that may prove useful in
further attacks against system resources.

27. Bytehoard Files.INC.PHP Root Directory Disclosure Vulnerabil...
BugTraq ID: 8910
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8910
Summary:
Bytehoard is a file storage/transfer application that is implemented in
PHP.

Bytehoard is prone to a directory disclosure attack. Remote attackers may
submit a request to the files.inc.php script, which could potentially
permit remote attackers to gain unauthorized access to the web root.  This
problem also permits an attacker to traverse directories in and outside of
the web root directory, potentially resulting in information disclosure.

Exploitation will yield read access with the privileges of the web server
process.

28. Apache Web Server Multiple Module Local Buffer Overflow Vuln...
BugTraq ID: 8911
Remote: No
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8911
Summary:
A vulnerability has been reported to exist in Apache that may allow a
local attacker to gain unauthorized access by executing arbitrary code on
a vulnerable system. The condition is present due to insufficient boundary
checking.

The problem is reported to exist in mod_alias and mod_rewrite modules of
the software. It has been reported that the problems presents itself if a
regular expression is configured with more the 9 captures using
parenthesis.  It is reported that the vulnerability is in an Apache
wrapper function for the regex interface.

A local attacker may ultimately exploit this issue locally and execute
arbitrary code in the context of the user who is running the vulnerable
software. Successful exploitation may allow a attacker to gain
unauthorized access to the vulnerable host.  It has also been reported
that to exploit this issue an attacker would need to locally create a
specially crafted configuration file (.htaccess or httpd.conf).

Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the web server in order to gain
unauthorized access to a vulnerable system.

29. Apple Mac OS X Panther Screen Effects Locking Latency Vulner...
BugTraq ID: 8912
Remote: No
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8912
Summary:
Apple Mac OS X ships with a screen locking/screensaver application called
Screen Effects.  When Screen Effects is activated, the console is locked
and the user must re-authenticate to unlock the console.

It is reported that the Apple Mac OS X Panther version of the Screen
Effects screensaver may process some keyboard events prior to prompting a
user for authentication.  The source of the issue is that there is some
latency when Screen Effects locks the console.  The report states that a
number of actions may be possible before the console is locked, including
navigating through folders and launching applications.  Though
unconfirmed, it may be possible to take advantage of this issue to
de-activate Screen Effects itself.  While the impact and exploitability of
this vulnerability may limited, it does present a security threat because
it is theoretically possible that malicious actions could occur during
this window of opportunity.

30. MacOS X Long Argv Value Kernel Buffer Overrun Vulnerability
BugTraq ID: 8913
Remote: No
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8913
Summary:
MacOS X is a unix-based operating system developed by Apple computers. The
MacOS X kernel is derived from the FreeBSD kernel.

When a command-line application is invoked, parameters and arguments are
each stored within an argument vector commonly referred to as argv[]. It
has been reported that when excessive data is stored within argv[]
entries, a buffer overrun may be triggered within the MacOS X kernel.

The precise technical details regarding this vulnerability are currently
unknown, however it is believed that the issue occurs due to insufficient
bounds checking when handling the data. It has been confirmed that this
condition can be exploited to trigger a local denial of service,
effectively causing the kernel to crash.

It may also be possible to exploit this condition to expose small portions
of kernel memory. This data may only be in the form of memory addresses,
however it may also contain data stored within kernel memory. Access to
this information may aid in launching further attacks or may expose
authentication credentials or other data that could aid in privilege
elevation or unauthorized access.

It should be noted that, due to the nature of this vulnerability, an
attacker may be capable of overwriting sensitive kernel memory in a
fashion designed to control it's execution or modify sensitive process
variables. If proven to be possible, this could lead to local privilege
elevation to that of the root user.

Although this vulnerability occurs within the local context of the system,
it could be possible for an attacker to trigger the bug remotely, if an
application were in place that invoked a separate application using
user-supplied data as an argument.

This issue is said to occur in MacOS X 10.2.8 and earlier.

31. Apple Mac OS X Core File Symbolic Link Vulnerability
BugTraq ID: 8914
Remote: No
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8914
Summary:
Mac OS X is a UNIX operating system distributed and maintained by Apple.

A problem has been identified in Mac OS X during the creation of core
files.  Because of this, a local attacker may be able to overwrite
arbitrary root owned files.

The problem is in the location in which core files are created.  By
default, core file creation is not enabled on Mac OS X systems.  However,
when enabled, root-owned processes that end abnormally and dump core will
create files in the /cores directory.  The /cores directory has
world-writable permissions set.

Since the files are created with predictable file names (core.PID where
PID represents the id of the terminated process), it is possible for any
user to create symbolic links in the place of the files.  Once the process
dumps core, the file at the end of the symbolic link will be overwritten,
provided the ending process has sufficient privileges.

It should be noted that this issue can be exploited for root-owned
processes.  Additionally, this could also be used to gain access to dumps
of process memory that may contain sensitive information.

32. kpopup Privileged Command Execution Vulnerability
BugTraq ID: 8915
Remote: No
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8915
Summary:
kpopup is a KDE utility designed to allow hosts to transmit and receive
"WinPopup" messages.

It has been alleged that it is possible for local attackers to gain root
privileges through kpopup, which is installed setuid root by default.
According to the report, kpopup uses the system(3) C-library function
insecurely to run other utilities on the system.  In at least one
instance, system(3) is called to invoke the binary killall(1) in a manner
relying on the PATH environment variable.  As the environment can be set
by the unprivileged user when kpopup is executed, an arbitrary executable
with the filename killall(1) can be executed.

On typical UNIX and UNIX-like systems, the system(3) library call invokes
fork(2) and the child executes "/bin/sh" with the function parameter as
it's argument.  Many modern shells anticipate insecure use of this
function by setuid/setgid processes and drop effective privileges if they
do not match the real userid/gid of the process.  This typically prevents
exploitation of these issues.  This particular vulnerability may be
different.  It may be the case that kpopup first sets its real uid and gid
to 0 before calling system, making this vulnerability exploitable.  This
has not been confirmed by Symantec.

33. Apple Mac OS X Insecure File Permissions Vulnerabilities
BugTraq ID: 8916
Remote: No
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8916
Summary:
There are multiple instances in Apple Mac OS X where files are installed
or created with insecure permissions or inappropriate permissions.  This
could permit local attackers to modify sensitive files or potentially even
replace binaries, which could then be executed by another user.

The initial vulnerability port classifies these insecure permissions under
two primary issues.  The first issue is that when directories/files are
moved from a DMG image, they are given world read/write/execute
permissions.  There presents a serious security risk as many software
packages are installed from DMG images, which could then be modified or
trojaned by an attacker.  The other set of issues is default permissions
for various Apple and third-party applications that exist in folders such
as /Applications, /Library/Application Support and /Library/StartupItems.

The first issue has been addressed in Apple Mac OS X 10.3.  The second set
of issues is a broader problem that needs to be addressed by individual
vendors.  Users and administrators are advised to review the default
permissions of all installed software to mitigate the second set of
issues.

These issues are also described in BID 8917, which is a cumulative BID
that covers the various security updates that were provided with the
release of Mac OS X 10.3 (Panther).

34. Apple Mac OS X Multiple Vulnerabilities
BugTraq ID: 8917
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8917
Summary:
Apple Mac OS X 10.3 (Panther) has been released to address multiple new
and previously known vulnerabilities. These issues may cumulatively allow
an attacker to cause denial of service, arbitrary code execution,
privilege escalation and unauthorized access.

The following specific vulnerabilities were reported to be addressed:

A design error (CAN-2003-0876) is reported to exist in the software that
may allow an attacker to access sensitive information.  This issue occurs
because the software fails to keep folder permissions when copying a
folder from a mounted volume such as a disk image. This issue is described
in more detail by BID 8916.

A problem (CAN-2003-0877) has been identified in Mac OS X during the
creation of core files that may allow an attacker to access or overwrite
sensitive files.  This issue is discussed with further detail in BID 8914.

A vulnerability (CAN-2003-0878) is reported to exist when Personal File
Sharing is enabled that may allow an attacker to gain elevated privileges.
This issue occurs because the slpd daemon may create a file owned by root
in the tmp directory.  This could overwrite an existing file resulting in
elevated privileges.

A denial of service and possible buffer overflow issue (CAN-2003-0895) has
been reported in the software.  This issue may allow an attacker to crash
the operating system by supplying a long command line argument.  Further
details are provided in BID 8913.

An issue (CVE-2002-0701) has been reported to affect the software when
ktrace is enabled through KTRACE kernel option.  This issue may allow a
local attacker to gain access to sensitive information.  It has been
reported by the vendor that currently no specific utility is vulnerable to
this problem.

A denial of service issue (CVE-2002-0830) affecting nfs has been reported.
This issue may allow a remote attacker cause the system to hang by sending
specific RPC messages.

Two possible vulnerabilities in zlib (CAN-2003-0107) BID 6913 and gm4
(CAN-2001-1411) utilities are also reported, however these do not affect
the system at the moment. This could be the source of future
vulnerabilities though.

An OpenSSH issue (CAN-2003-0386) has been identified as well.  This issue
allows a remote attacker to access an OpenSSH server's login mechanism
from an unauthorized host.  Further details are available in BID 7831.

A problem (CAN-2001-1412) is reported that may allow an attacker to gain
access to authentication information such as encrypted passwords.

A design error (CAN-2003-0883) is reported to exist in the software that
may allow an attacker to gain access to secure Preference Panes without
proper privileges.

An information disclosure issue (CAN-2003-0882) has been reported due to
TCP timestamp.  It has been reported that the timestamp is always
initialized with a constant number that may allow an attacker to calculate
how long a system has been running for.

An issue (CAN-2003-0881) has been reported to exist in the Mac OS X Mail
application.  This issue presents itself when an account is configured to
use  MD5 Challenge Response.  If an attempt to login fails the program
switches to plain text passwords.

CAN-2003-0880 applies to an issue where keyboard access to Dock functions
may still be possible from behind Screen Effects when Full Keyboard Access
is enabled via the Keyboard pane in System Preferences.  This issue is
reportedly different from the issue discussed in BID 8912.  BID 8912 is
not addressed with this build of Mac OS X 10.3.

These issues are currently undergoing further analysis.  Where
appropriate, individual BIDs will be created to represent new issues and
existing BIDs will be updated for previously known issues.

35. kpopup Local Arguments Format String Vulnerability
BugTraq ID: 8918
Remote: No
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8918
Summary:
kpopup is a KDE utility designed to allow hosts to transmit and receive
"WinPopup" messages.  It is available for Unix and Linux platforms.

It has been alleged that it is possible for local attackers to take
advantage of format string vulnerabilities in kpopup, which is installed
setuid root by default. According to the report, kpopup does not correctly
handle format strings when passed to the program as arguments.

Preliminary reports indicate that this issue can be used to cause the
program to crash with a segmentation violation error.  This is usually
indicative of memory management issues that typically can be exploited to
execute attacker-supplied instructions.

36. Apache Mod_Security Module Heap Corruption Vulnerability
BugTraq ID: 8919
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8919
Summary:
The Apache 2 mod_security module is designed to act as an web-based
intrusion detection system. It is also designed to prevent certain types
of attacks by handling and parsing data.

A vulnerability has been discovered in the mod_security module when
handling specific data transmitted by the Apache server. The problem
occurs within sec_filter_out() function located in the mod_security.c
source file.

When this function is used to handle data transmitted from a server-side
script, it incorrectly assumes that the data is broken into 4 or 8
kilobyte chunks before being transmitted. As a result, when expanding the
size of the data's storage buffer it explicitly reallocates the size to be
2 times as large. However, because the data is not the expected chunk
sizes, the size of the data copied into the data could in fact be larger
then expected. When finally copied into the buffer, sensitive heap
variables such as malloc chunk pointers may be overwritten.

An attacker could ultimately exploit this condition to execute arbitrary
code with the privileges of the Apache server. It should be emphasized
however, that an attacker would be required to carry this attack out
locally or on a server that allows the uploading of malicious scripts
(which may be possible via exploitation of other vulnerabilities). The
vulnerability cannot be triggered by sending a request with excessive data
to the affected module.

This issue is said to affect release 1.7 and 1.7.1 of mod_security.

37. Centrinity FirstClass HTTP Server Directory Disclosure Vulne...
BugTraq ID: 8920
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8920
Summary:
FirstClass is a commercially available suite of network service utilities
available from Centrinity. It is available primarily for the Microsoft
Windows platform. Versions exist for Apple platforms as well.

A vulnerability has been reported to exist in the FirstClass HTTP server
that may allow a remote attacker to gain sensitive information through the
server root and user web directories.

The problem presents itself when "/Search" is appended to the URL of the
server which directs the user to a file search form.  The attacker may
then be able to access information about the directories by selecting all
options in the form and leaving the filename field blank.

**Conflicting reports have been submitted concerning this issue.  It has
been reported that universal access to server root and user web
directories is granted by default in order to accommodate ease of use.  No
sensitive information is placed in these directories by default.  If
needed, users may protect private portions of the web site by employing
FirstClass' ACL protected
containers called conferences.  It has also been reported that the search
utility may be easily disabled by accessing "Unauthenticated Users"
privilege group located in the "Groups" folder.

Successful exploitation of this issue result in disclosure of sensitive
information which may be useful in further attacks against the system.

This problem has been reported to exist in FirstClass 7.1. It is possible
that other versions are affected as well.

38. SGI IRIX NFS Exportfs Wildcard Entry Unauthorized Access Vul...
BugTraq ID: 8921
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8921
Summary:
SGI has announced that a vulnerability has been discovered in Irix 6.5.21
systems. The problem occurs when an /etc/exports configuration file has
been configured with the root, rw, or access options containing a wildcard
character and no explicit hostname netgroup.

When this condition is met, it is said that the NFS server may fail to
carry out access validation checks on users, potentially allowing for
unauthorized access. This could allow a malicious user to expose or modify
sensitive information and possibly perform other attacks.

39. Apple Mac OS X 10.3 Unspecified Apple Quicktime Java Vulnera...
BugTraq ID: 8922
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8922
Summary:
Apple has released security updates to address an unspecified
vulnerability in the Quicktime Java implementation included in Mac OS X
10.3 (Panther).  The vendor has reported that this issue could allow
unauthorized access to systems, which may imply that the issue is remote
in nature.  Earlier versions of Mac OS X are not affected by this issue.

Few technical details about this vulnerability are known at this time.
This BID will be updated if more details about the nature of the
vulnerability are made available.

40. Oracle Files Restricted Content Access Vulnerability
BugTraq ID: 8923
Remote: Yes
Date Published: Oct 29 2003
Relevant URL: http://www.securityfocus.com/bid/8923
Summary:
Oracle Files is a file/content security mechanism provided with Oracle
Collaboration Suite 1 for use with Oracle Database and Application
Servers.

A vulnerability has been reported in Oracle Files that may permit
authenticated users to gain unauthorized access to restricted content.
The cause of this issue is that Oracle WebCache has permissive default
cacheability rules that are not overridden by Oracle Files, which may
expose various files to unauthorized access.  Various file types, such as
js, html, pdf, jpg/jpeg and bmp/png are affected by this issue.

This issue exists in Oracle Files versions prior to 9.0.3.3.6.

41. TelCondex SimpleWebserver HTTP Referer Remote Buffer Overflo...
BugTraq ID: 8925
Remote: Yes
Date Published: Oct 29 2003
Relevant URL: http://www.securityfocus.com/bid/8925
Summary:
TelCondex SimpleWebServer is a Web server designed for use with the
Microsoft Windows operating systems.

A vulnerability has been reported to exist in the software that may allow
a remote attacker to gain unauthorized access by executing arbitrary code
on a vulnerable system. The condition is present due to insufficient
boundary checking.

The problem is reported to exist due to the HTTP referer header. It has
been reported that an attacker may be able to crash the server by sending
700 bytes of data through the HTTP referer header and overwrite the return
address on the stack with 704 bytes.  The issue presents itself due to
insufficient bounds checking of HTTP referer variable. A remote attacker
may ultimately exploit this issue remotely and execute arbitrary code in
the context of the user who is running the vulnerable software. This issue
could be exploited to allow an attacker to gain unauthorized access to the
vulnerable system.

Successful exploitation of this issue may allow an attacker to cause a
denial of service condition or execute arbitrary code in the context of
the web server in order to gain unauthorized access to a vulnerable
system.

SimpleWebServer version 2.12.30210 Build 3285 has been reported to be
prone to this issue, however other versions may be affected as well.

42. Apache Web Server mod_cgid Module CGI Data Redirection Vulne...
BugTraq ID: 8926
Remote: Yes
Date Published: Oct 29 2003
Relevant URL: http://www.securityfocus.com/bid/8926
Summary:
Apache has reported a potential vulnerability in the mod_cgid module when
the threaded MPM (Multi-Processing Module) is used. The problem is said to
be due to mishandling of CGI redirect paths. Reportedly, the module will
incorrectly redirect the CGI output data to a seperate, unrelated thread.
Apache has stated that the specific problem is related to mishandling of
the AF_UNIX socket that is used to pass communications between the cgid
daemon and a CGI script. It seems likely that this issue could occur
inadvertently and it is not currently known if a remote attacker could
deliberately trigger the condition.

Depending on the context of the CGI data in question, this could
potentially result in sensitive information, such as banking or login
information, being exposed to a user of a seperate thread. This could also
potentially result in another user incorrectly being granted authorization
to a sensitive page.

The precise technical details regarding this condition are currently
unknown. This bid will be updated as further information is made
available. It should also be noted that although unconfirmed, this
condition may in some ways be similar to the condition described in bid
8725.

43. Multiple Vendor HTTP Server IPv6 Socket IPv4 Mapped Address ...
BugTraq ID: 8927
Remote: Yes
Date Published: Oct 29 2003
Relevant URL: http://www.securityfocus.com/bid/8927
Summary:
IPv6 is a protocol designed to replace IPv4. IPv6 allows for the
encapsulation of IPv4 addresses, in order to facilitate transition between
the two standards, and allow the usage of IPv4 legacy applications under
IPv6 networking.

Additionally, many systems are expected to support both IPv4 and IPv6
traffic, in order to allow a transition period between the two standards.

A problem may exist in some web servers that may result in vulnerabilities
in web applications.  When a mapped IPv4 address is passed to a system
through an IPv6 interface, it may be possible confuse or even take
advantage of functions in web applications.  A scenario could occur when
such an address is passed to the $REMOTE_ADDR server environment variable,
for example.  If the $REMOTE_ADDR variable were then used for
authentication or access control in this situation, unexpected behavior
could result, potentially introducing a security vulnerability.

This problem could permit an attacker to bypass access restrictions, or
potentially obscure the origins of a request.

44. Nokia IPSO Unspecified Denial of Service Vulnerability
BugTraq ID: 8928
Remote: Yes
Date Published: Oct 29 2003
Relevant URL: http://www.securityfocus.com/bid/8928
Summary:
IP Security Operating System (IPSO) is the security hardware-based OS
maintained and developed by Nokia.

An unspecified denial of service vulnerability has been discovered in the
Nokia IPSO operating system. The problem is said to occur when the system
has been configured with IP Clustering. Further details regarding this
issue are currently unknown, however as more information is made available
this bid will be updated accordingly.

This vulnerability is said to affect all 3.X IPSO releases prior to IPSO
3.7 Build 29.

45. Sun Solaris NFS Server Unspecified Remote Denial Of Service ...
BugTraq ID: 8929
Remote: Yes
Date Published: Oct 29 2003
Relevant URL: http://www.securityfocus.com/bid/8929
Summary:
Solaris is the freely available, open source UNIX operating system
distributed by Sun Microsystems.

A problem has been identified in the handling of some types of NFS
requests by Sun Solaris.  Because of this, it may be possible for a remote
user to deny service to legitimate users of a vulnerable system.

The problem is in the handling of specific types of UFS file system
requests.  By sending an invalid request to a system sharing UFS file
systems via NFS, it is possible to force the host into a UFS panic,
resulting in a system kernel panic.

In depth technical details are not currently available concerning this
issue.  This Bugtraq ID will be updated when further information becomes
available.

46. E107 Chatbox.php Denial of Service Vulnerability
BugTraq ID: 8930
Remote: Yes
Date Published: Oct 29 2003
Relevant URL: http://www.securityfocus.com/bid/8930
Summary:
E107 is a content management system written in PHP and MySQL.

E107 has been reported to be prone to a denial of service vulnerability.
The issue has been reported to present itself due to handling of
user-supplied data in the form of HTML or script code to the 'Name:' field
of Chatbox.php script.  This issue may cause the software to behave in an
unstable manner leading to a crash.

Successful exploitation of this issue may allow an attacker to cause the
software to crash or hang.

It should be noted that although this vulnerability has been reported to
affect E107 versions 0.545 and 0.603, other versions might also be
affected.

47. BEA Tuxedo and WebLogic Enterprise Input Validation Vulnerab...
BugTraq ID: 8931
Remote: No
Date Published: Oct 30 2003
Relevant URL: http://www.securityfocus.com/bid/8931
Summary:
BEA WebLogic Integration is a suite of software, including a J2EE
application server and an API, that provides functionality to integrate
systems within an enterprise.

A vulnerability has reported to exist in BEA Tuxedo and WebLogic
Enterprise due to Tuxedo administration console.  The script is reported
to accept various initialization arguments such as INIFILE that are not
properly sanitized and validated for user supplied input.  This issue may
allow an attacker to carry out attacks such as denial of service, file
disclosure, and cross-site scripting.

It has been reported that by providing various path values for INIFILE
while using the administration console, an attacker may be able to
determine the existence of a file.  This attack could be used to locate
sensitive file out side the web server directory including different file
systems and network drives.  This information could be used to launch
further attacks.

An attacker may be able to cause a denial of service condition the
administration console by providing a device name such as CON, AUX, COM1,
and COM2 instead of a valid file name as one of the arguments for INIFILE.
This may cause the service to crash or hang.  This issue may also have an
affect on the availability of console services.

A cross-site scripting vulnerability has also been reported to exist in
the software due to insufficient sanitization of user-supplied input to
INIFILE.  This problem presents itself when an invalid file name is
supplied as an argument for INIFILE.  This argument is returned to the
user without proper sanitization.  An attacker could exploit this issue by
supplying a specially crafted file name containing HTML or script code to
be executed in a user' browser upon visiting a malicious link created by
the attacker.  This vulnerability could be exploited to steal cookie-based
credentials.  Other attacks are possible as well.

48. Booby Error Message Cross-Site Scripting Vulnerability
BugTraq ID: 8932
Remote: Yes
Date Published: Oct 30 2003
Relevant URL: http://www.securityfocus.com/bid/8932
Summary:
Booby is a web-based desktop application used to manage notes, contacts,
bookmarks etc.

A vulnerability has been reported to present in the software that may
allow a remote attacker to execute HTML or script code in a user's
browser.

It has been reported that the problem arises when the software returns
error messages to the user that may contain unsanitized data. The problem
exists due to insufficient sanitization of user-supplied data, therefore
making it possible for an attacker to a construct a malicious link
containing HTML or script code that may be rendered in a user's browser.
The script code would run in the context of the site.

Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.

Booby versions 0.2.3 and prior are reported to be prone to this issue.

49. Ledscripts LedForums Multiple Fileds HTML Injection Vulnerab...
BugTraq ID: 8934
Remote: Yes
Date Published: Oct 30 2003
Relevant URL: http://www.securityfocus.com/bid/8934
Summary:
LedForums is a forum software written in PHP and MySQL.

A vulnerability has been reported in the software that may allow a remote
attacker to execute HTML and script code in a user's browser. The issue is
reported to be present in the 'top_message' and 'topic' fields. The
problem exists due to insufficient sanitization of user-supplied input. It
may be possible for an attacker to include malicious HTML code in one of
the vulnerable fields. The injected code could then be interpreted by the
browser of a user visiting the vulnerable site. This attack would occur in
the security context of the affected site.

Successful exploitation of this issue may allow a remote attacker to steal
cookie-based authentication credentials. Other attacks are possible as
well.

LedForums Beta 1 has been reported to be vulnerable to this issue.

50. Cisco IOS OSPF Potential Routing Table Corruption Vulnerabil...
BugTraq ID: 8935
Remote: Yes
Date Published: Oct 30 2003
Relevant URL: http://www.securityfocus.com/bid/8935
Summary:
A bug has been discovered in specifically configured Cisco IOS routers
when handling the OSPF (Open Shortest Path First) protocol. It has not yet
been confirmed if this issue is an explicit security vulnerability,
however it has been conjectured by a reliable source that the problem
could potentially lead to the corruption of routing tables.

The bug is said to exist on Cisco IOS release 12.3(1a), when running on an
AS5350 device. This issue may reportedly occur when the following
configuration is used:

router ospf 1
 log-adjacency-changes
 redistribute connected subnets route-map ospf
 redistribute static subnets route-map ospf
 network 192.168.100.0 0.0.1.255 area 1

As a result, the device may incorrectly multicast OSPF Hello packets to
all peers, regardless of the host's address. This could potentially allow
for a malicious system to issue a response containing false information,
designed to corrupt routing table entries. This condition has not yet been
confirmed.

If this bug does prove to be a vulnerability, an attacker could exploit
this condition to re-route traffic through controlled systems or could
potentially pose as a trusted host. This could lead to a number of attacks
including man-in-the-middle attacks, connection hijacking, modifying data
streams, exposing sensitive information, etc.

This issue is reportedly not present in Cisco IOS 12.2(3).

*** October 31, 2003 - Cisco has issued a response regarding this issue
and has stated that the behaviour of the device is as expected. OSPF will
be enabled on any interface that has an IP address bound to it, and as
such Hello packets will typically be transmitted over these interfaces.
This BID has been flagged as Conflicting Reports, and will be updated as
further details have been released.

51. Serious Sam Engine Remote Denial of Service Vulnerability
BugTraq ID: 8936
Remote: Yes
Date Published: Oct 30 2003
Relevant URL: http://www.securityfocus.com/bid/8936
Summary:
Serious Sam is a game engine developed by Croteam.  Games based on Serious
Sam include Serious Sam: the first encounter, Serious Sam: the second
encounter, Deer Hunter 2003 and Carnivores: Cityscape.

A vulnerability has been reported to exist in the software that may allow
a remote attacker to caused a denial of service condition in the server.
The issue is reported to present itself when a client sends malformed data
to the server via a certain parameter.  This request may cause the
software to consume an excessive amount of CPU cycles leading to a crash
or hang.

Successful exploitation of this issue may allow an attacker to cause the
software to act in an unstable manner leading to a crash or hang.

It has been reported that Serious Sam engines and games that run on the
TCP protocol are vulnerable to this issue however other games and versions
could be affected as well.



III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Unlucky phisher pleads guilty
By: Kevin Poulsen

Woman who unwittingly spammed the FBI in her scheme to harvest credit card
numbers pleads guilty to federal conspiracy charges.

http://www.securityfocus.com/news/7329

2. No effect seen in hack disclosure law
By: Kevin Poulsen

Experts say e-commerce sites still aren't rushing to come clean with
consumers about security breaches, law or no law.

http://www.securityfocus.com/news/7311

3. Justice e-censorship gaffe sparks controversy
By: Kevin Poulsen

The Department of Justice used Microsoft Word's highlight tool to black
out the sensitive portions of a key report on internal workplace
diversity, before releasing it to the public as a PDF file. Guess what
happened next.

http://www.securityfocus.com/news/7272

4. Brazilian script kiddie arrested in Japan
By: John Leyden, The Register

http://www.securityfocus.com/news/7353

5. The Web is littered with Web sites long abandoned
By: Anick Jesdanun, The Associated Press

http://www.securityfocus.com/news/7350

6. Cliff Stanford denies hacking Redbus
By: John Leyden, The Register

http://www.securityfocus.com/news/7341


IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Lutel Firewall v0.72
By: Tomek Lutelmowski
Relevant URL: http://energoprojekt.pl/~lutel/firewall/
Platforms: N/A
Summary:

Lutel Firewall Script is a Linux iptables shell script written in bash for
use as a firewall and NAT/masquerade router for home networks or multiple
subnet applications. It shares access to an Internet connection from
multiple workstations. Its main features are support for interface
aliases, per subnet traffic definitions, UID and GID of packet owner
restrictions, length of packet restrictions, SYN / flood protection,
disabling routing between subnets, masquerading setups per subnet,
transparent proxy support, port redirection, anti-spoof protection, TOS
optimization, predefinied netfilter marking for 3rd party traffic shapers
(such as tc), DHCP support, FTP active and passive mode support, and
ZorbipTraffic.

2. BitDefender for Sendmail libmilter v1.5.5-BETA
By: Mircea MITU
Relevant URL: http://www.bitdefender.com/bd/site/products.php?p_id=35
Platforms: Linux
Summary:

BitDefender for Sendmail libmilter is a powerful antivirus solution for
Linux mail servers. It provides proactive protection for message traffic
at the email server level, eliminating the risk to the entire network that
could be caused by a negligent user. Both sent and received messages are
scanned in real time, avoiding the possible infections and preventing
anyone from sending an infected message. It claims a 100% detection rate
for all viruses in the wild through its powerful scanning engines, which
are certified by the most prestigious testing labs.

3. KAVClient v0.2.1
By: Leonid Zeitlin
Relevant URL: http://kavclient.sourceforge.net/
Platforms: Linux
Summary:

KAVClient is a C language interface to the Kaspersky Anti-Virus daemon. It
allows users to check files and memory for viruses.

4. sensorTrends v0.6
By: John Weidley
Relevant URL: http://www.packetshack.org/index.php?page=sensorTrends
Platforms: Linux
Summary:

sensorTrends is a Web-based application that displays a high-level view of
the ports that are being scanned over the course of time. The display is
similar to the look and feel of incidents.org and Dshield.com. There are
also quick links to correlate your data with incidents.org and
Dshield.com. Supported log formats are Cisco router Access Control Lists
(ACLs) syslog output, Cisco PIX firewall syslog output, Snort's
portscan.log files, and NetScreen syslog output.

5. Apache DoS Evasive Maneuvers Module v1.9
By: Network Dweebs Corporation
Relevant URL: http://www.nuclearelephant.com/projects/dosevasive/
Platforms: N/A
Summary:

The Apache DoS Evasive Maneuvers Module is a module for Apache 1.3 that
provides functionality for detecting and fighting off DoS attacks and
brute force attacks. It does this by adding addresses to a 10-second '403
List' and rejecting rapidly repeated requests for the same URL from the
same addresses, using an internal hash table, on a per-child basis. This
module can be configured to talk to ipchains, ipfilter, or any other tool
designed to push the attack out to the network layer, and provides email
notification in the event of an attack.

6. mod_securid v2.0
By: Erwan Legrand
Relevant URL: http://www.deny-all.com/mod_securid/v2/
Platforms: Linux, POSIX, Solaris, SunOS
Summary:

The mod_securid Apache module implements RSA SecurID authentication for
the Apache Web server. It allows administrators to restrict access to Web
sites (or parts of Web sites) to users authenticated using a SecurID token
and an ACE server.


V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Technical Support Engineer Silicon Valley CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343126

2. List slow down. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343080

3. ** Job Opening ** Seeking a seasoned Enterprise Secu... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343075

4. Project Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343074

5. 10 Nationwide Openings for Security Sales Engineers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343073

6. Technology Services Professional (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343072

7. Unisys Simon Experience (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343071

8. two data security analyst needed in Herndon, VA/ add... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343070

9. IT Audit (ERP)- Detroit and Chicago (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343069

10. Over 12 Federal Openings (SSL VPN, Patch, IPS, Polic... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343068

11. IT Audit in Kansas City, MO (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343067

12. Sales Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343066

13. SOC Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343065

14. Resume (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/343064

15. Contract Network Security Specialist, New York City (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342972

16. Security Project Mgr with CISSP and 10 yrs Exp (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342971

17. Need Two Data Security Analyst in Herndon, VA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342970

18. Looking for a Pre-Sales Engineer Position- West/ Sou... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342969

19. eEye Technical Support Engineer - Geneva, Switzerlan... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342950

20. Experienced security pro looking for a CISO/CSO spot (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342949

21. Sr. IT Security Positions-Iraq-MUST HAVE CURRENT US ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342948

22. Security Sales Engineer, based in UK, sales area wil... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342946

23. Sr. Software QA Engineer opening- Cupertino, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342830

24. POSITION: Site Security Specialist – Linthicum... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342819

25. SAP HR Security, Connecticut | 3-month Contract (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342815

26. Security Engineer - Houston, TX (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342810

27. IT Audit - Sr. Associate position available- Ohio Va... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342733

28. seeking Tivoli Security Specialist (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342724

29. Product Manager - Security (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342723

30. Product Specialist Opportunity at Core Security Tech... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342647

31. Vulnerability and Threat Management position, Los An... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342645

32. Senior Sales Engineers: East / Central / West (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342609

33. Director Network Security-NYC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342607

34. Sales Engineer (Washington, DC and NYC) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342603

35. Software Engineer position - Princeton, NJ (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342599

36. Area Sales Directors:  East / Central / West (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342597

37. Training Manager (Ann Arbor MI or Boston, MA) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342596

38. THANK YOU!  and important 411 if you are applying to... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342595

39. Senior Sales Engineers DOD (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342593

40. Seeking Senior Sales, Business Development, Position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342512

41. "SecurityGuys", a securityjobs-like brazilian distri... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342500

42. Anyone know of more Canadian focused lists? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/342499


VI. INCIDENTS LIST SUMMARY
--------------------------
1. Large increase in port 27347 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/343056

2. strange ftp site (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/343027

3. New Trojan (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/343023

4. [inbox] RE: Bogus DNS traffic (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/342962

5. Persistant Connection to tcp/1423 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/342959

6. Random 2packet-probes on port 445 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/342887

7. Administrivia: Are you seeing portscans from source ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/342881

8. Probable Trojan (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/342879

9. Probable Trojan. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/342833

10. nachi ping (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/342430


VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. SunOS/Solaris malloc (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/343125

2. arp packet payload (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/343124

3. Release of the Default Account Database v4.00 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/343122

4. CanSecWest/core04 Call For Papers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/343084

5. win32 stack bof & shellcode size (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/343045

6. Fwd: Cisco AS5350 IOS 12.3(1a) OSPF bug? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/343041

7. Cisco AS5350 IOS 12.3(1a) OSPF bug? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/342903

8. Black Hat Briefings Announcement (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/342802

9. Internet Explorer and Opera local zone restriction b... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/342753

10. win32 heap overflow exploitation (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/342569


VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. ICF Firewall - How can I do it? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342977

2. IIS 6 features (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342939

3. AW: Coexistance of Windows 2000 and Windows 2003 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342748

4. Win Server 2k3 Hardening (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342746

5. MD5 sums for Nachi and Blaster variants? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342743

6. Terminal Services Auditing? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342742

7. Coexistance of Windows 2000 and Windows 2003 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342741

8. Event Log messages for failed logon attempts (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342581

9. SecurityFocus Microsoft Newsletter #160 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342558

10. Auditing enabled but Logon Failures not showing up (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342509


IX. SUN FOCUS LIST SUMMARY
--------------------------
1. rpc broadcasts (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/342521


X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Sendmail & Disk Quota on RedHat (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/342823

2. NFS replacements for Linux (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/342758

3. AntiVirus for Red Hat 9? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/342660


XI. SPONSOR INFORMATION
-----------------------
This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_sf-news_031103
and use priority code SF4.
------------------------------------------------------------------------