SecurityFocus Newsletter #222
John Boletta <[email protected]> Mon, 10 Nov 2003 14:31:35 -0700 (MST)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #222
------------------------------
This Issue is Sponsored by: SpiDynamics
FREE White Paper: Layer 7/Web Apps- "Future of Security Vulnerabilities"
This paper covers:
- How the web browser is the most dangerous hacking tool
- The definition of Layer 7 or web application vulnerabilities
- The importance of proactive security measures
- The key factors for successful web vulnerability assessment
Download this *FREE* white paper from SPI Dynamics for a complete guide to
protection!
http://www.securityfocus.com/sponsor/SPIDynamics_sf-news_031110
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Oracle Row Level Security: Part 1
2. Wireless Intrusion Detection Systems
3. Security's Brewing Mess
II. BUGTRAQ SUMMARY
1. Sun Java Installation File Corruption Vulnerability
2. BEA WebLogic InteractiveQuery.jsp Cross-Site Scripting Vulne...
3. Citrix Metaframe XP Cross-site Scripting Vulnerability
4. Plug and Play Web Server Remote Denial of Service Vulnerabil...
5. Seyeon FlexWATCH Network Video Server Unauthorized Administr...
6. Ashley Brown iWeb Server Encoded Backslash Directory Travers...
7. Tritanium Scripts Tritanium Bulletin Board Unauthorized Acce...
8. MacOS X Local Root Privilege Elevation Vulnerability
9. Mldonkey Web Interface Error Message Cross-site Scripting Vu...
10. BRS WebWeaver httpd `User-Agent` Remote Denial of Service Vu...
11. HTTP Commander Directory Traversal Vulnerability
12. HTTP Commander Path Disclosure Vulnerability
13. DATEV Nutzungskontrolle Unauthorized Access Vulnerability
14. Multiple Ethereal Protocol Dissector Vulnerabilities
15. Cups Internet Printing Protocol Job Loop Denial Of Service V...
16. Bugzilla Multiple Vulnerabilities
17. Nullsoft SHOUTcast icy-name/icy-url Memory Corruption Vulner...
18. Synthetic Reality SymPoll Cross-Site Scripting Vulnerability
19. Web Wiz Forum Unauthorized Private Forum Access Vulnerabilit...
20. MPM Guestbook Cross-Site Scripting Vulnerability
21. ThWboard Cross-Site Scripting Vulnerability
22. PHPKit Include.PHP Cross-Site Scripting Vulnerability
23. ThWboard SQL Injection Vulnerability
24. Unichat Unhandled Character Set Denial of Service Vulnerabil...
25. PHPRecipeBook Unspecified Cross-Site Scripting/HTML Injectio...
26. OpenBSD isakmpd Multiple IKE Payload Handling Security Weakn...
27. IA WebMail Server Long GET Request Buffer Overrun Vulnerabil...
28. Oracle9iAS Portal Component SQL Injection Vulnerability
29. VieNuke VieBoard SQL Injection Vulnerability
30. NIPrint LPD-LPR Print Server Remote Buffer Overrun Vulnerabi...
31. Network Instruments NIPrint LDP-LPR Privilege Escalation Vul...
32. OpenSSL ASN.1 Large Recursion Remote Denial Of Service Vulne...
33. Perception LiteServe Server Log Buffer Overflow Vulnerabilit...
34. OpenAutoClassifieds Listing Parameter Cross-Site Scripting V...
35. CDE LibDTHelp DTHelpUserSearchPath Local Buffer Overflow Vul...
36. John Beatty Easy PHP Photo Album dir Parameter HTML Injectio...
37. OpenBSD Local Malformed Binary Execution Denial of Service V...
38. Apple MacOS X Terminal Unspecified Unauthorized Access Vulne...
39. Microsoft Internet Explorer Double Slash Cache Zone Bypass V...
40. Multiple Vendor S/MIME ASN.1 Parsing Denial of Service Vulne...
41. Clearswift MAILsweeper for SMTP Zip Archive Filtering Bypass...
42. X-CD-Roast Local Insecure File Creation Symlink Vulnerabilit...
43. Microsoft Internet Explorer Self Executing HTML Arbitrary Co...
44. HP-UX NLSPATH Environment Variable Privilege Escalation Vuln...
45. HP-UX Software Distributor Local Buffer Overrun Vulnerabilit...
46. Linux Kernel Trojan Horse Vulnerability
47. Ganglia gmond Malformed Packet Remote Denial of Service Vuln...
III. SECURITYFOCUS NEWS ARTICLES
1. Ashcroft takes on foreign government hackers
2. Thwarted Linux backdoor hints at smarter hacks
3. Unlucky phisher pleads guilty
4. At Microsoft, security flaws emerge as business shortcomings
5. Canadian Net fraud suspect arrested
6. Snag in next-gen Wi-Fi security unearthed
IV. SECURITYFOCUS TOP 6 TOOLS
1. Pathalizer v0.6
2. darkstat v2.6
3. N-View v2.9
4. testmail v3.1.7
5. mod_parmguard v1.2
6. PwM Password Manager v 0.3.1
V. SECURITYJOBS LIST SUMMARY
1. [TENABLE] Sales Engineers (Thread)
2. [TENABLE] Managed Services Support Engineers (Thread)
3. [TENABLE] Product Support Engineers (Thread)
4. [TENABLE] Senior Windows/UNIX Product Development En... (Thread)
5. [TENABLE] Sales Account Managers (Thread)
6. Senior Information Assurance Security Engr. Sought f... (Thread)
7. Secure Systems Architect - Tennessee (Thread)
8. Intrusion Prevention Account Executive- DOD - VA/MD/... (Thread)
9. VP Sales Federal Division-Information Management and... (Thread)
10. SAN Security Systems Engineer- VA/DC/MD (Thread)
11. Senior Architect, Windows Security Solutions - NY - ... (Thread)
12. Ebay Job Opening - Information Security Engineer (45... (Thread)
13. Information Security Engineers/Consultants (Thread)
14. Information Security Sales -DoD VA/DC/MD (Thread)
15. Junior Secuirty Consultant Jobs UK/US (Thread)
16. Product Marketing Director/Manager, Sunnyvale, CA (Thread)
17. Full-Time Staff Position at GA State University, ATL... (Thread)
18. DITSCAP Expert Needed in Charleston, SC. (Thread)
19. Security Support Applications Developer needed 3rd s... (Thread)
20. Network Infrastructure Security Administrators neede... (Thread)
21. Senior Software Sales Executive Need - Security (Thread)
22. Technical Manager-Information Security (Thread)
23. Security Engineers, DC Metro Area (Thread)
24. Seeking position as a Sr. Pre/Post Sales Systems Eng... (Thread)
25. SW Vulnerability Engineer Silicon Valley (Thread)
26. Director or VP of Enterprise Sales Opportunity (Thread)
27. Product Manager-Santa Clara, CA. -Hardware Product. (Thread)
28. Sr. System Engineer, TS is needed (Thread)
29. Seeking "Gurus to the Gurus", consultants to the Sec... (Thread)
30. Lead IT Auditor (Washington-DC metro) (Thread)
31. FEDERAL SOFTWARE SALES REP - SECURITY SOFTWARE (Thread)
32. Network Security Analyst- Sunnyvale, CA-Silicon Vall... (Thread)
33. Student from University of Southern California (Thread)
34. Security Analysts, Consultants, Managers needed (Thread)
35. Attack and Penetration Engineer $80k-95K Maryland (Thread)
36. Oracle/PKI/LDAP authentication SW Developer w/TS SCI... (Thread)
37. Incident Response Team Lead, Silver Spring, MD $... (Thread)
38. Lead Security Integration Engineer Martinsburg, WVA... (Thread)
39. Network Security Analyst-Sunnyvale, CA (Thread)
40. Product Marketing Director/Manager (Thread)
41. Washington state, CISSP Forensics seeking position (Thread)
42. Pre/Post Sales Sr. Infrastructure Engineer (Metro DC... (Thread)
43. Director, Business Development & Channels (Metro DC) (Thread)
44. Tivoli Access Manager position in CHICAGO!! (Thread)
45. Tivoli/LDAP consultant required. (Thread)
46. Immediate Need for System Admin w/Virus Protection E... (Thread)
47. Classified Security Consultant (Thread)
48. Systems Engineer - Silicon Valley - Startup (Thread)
49. Software Engineer - FreeBSD/Security - Silicon Valle... (Thread)
50. Director of Vertical Market Development - NJ (Thread)
51. Italy-based consultant looking for global opportunit... (Thread)
52. VP Application Security/NJ (Thread)
53. Sr. IT Security Positions-Iraq-MUST HAVE CURRENT US ... (Thread)
VI. INCIDENTS LIST SUMMARY
1. client's TCP port 256 hammered by several hosts (Thread)
2. Large increase in TCP/554 (rtsp) scans (Thread)
3. looking for help (Thread)
4. new ADMscript worm ? (Thread)
5. resolv.conf - overwrite (Thread)
6. Scans on 1240/tcp? (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. thttpd-2.24 (Thread)
2. Bug in libXcursor , is it exploitable? (Thread)
3. lame ms-ftp large file creation bug (Thread)
4. WTMP file (Thread)
5. Re[3]: ms03-043 questions (Thread)
6. Re[2]: ms03-043 questions (Thread)
7. ms03-043 questions (Thread)
8. arp packet payload (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. IIS 6 features (Thread)
2. IIS 6 features- loooong response (Thread)
3. Event Log messages for failed logon attempts (Thread)
4. Notable "Windows Postulates" from Linux Gurus (Thread)
5. ICF Firewall - How can I do it? (Thread)
6. SecurityFocus Microsoft Newsletter #161 (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Disabling rpcbind/portmapper (Thread)
2. How to identify whether a given UID is a member of a... (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Relay control in qmail (Thread)
2. [despammed] Re: Relay control in qmail (Thread)
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Oracle Row Level Security: Part 1
By Pete Finnigan
This paper explores the row level security feature added to Oracle 8i and
above, and provides examples. One of the main uses of row level security
is to allow all of a company's data to be stored in one database for
different departments, or for a hosting company to store data for
different companies in one database. Part One.
http://www.securityfocus.com/infocus/1743
2. Wireless Intrusion Detection Systems
By Jamil Farshchi
This paper will describe the need for wireless intrusion detection,
provide an explanation of wireless intrusion detection systems, and
identify the benefits and drawbacks of a wireless intrusion detection
solution.
http://www.securityfocus.com/infocus/1742
3. Security's Brewing Mess
By Hal Flynn
What do low-level programming languages have in common with a scalding hot
cup of coffee? Nothing that a little Java won't cure.
http://www.securityfocus.com/columnists/196
II. BUGTRAQ SUMMARY
-------------------
1. Sun Java Installation File Corruption Vulnerability
BugTraq ID: 8937
Remote: No
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8937
Summary:
Sun Java implementations are reported to create temporary files in an
insecure manner when the software is installed. A local attacker could
exploit this issue to corrupt files owned by the user installing the
software, most likely resulting in a denial of service.
The source of these issues is the Java unpack program and the
postinstaller. The unpack program is reported to create /tmp/unpack.log.
The postinstaller creates /tmp/.mailcap1 and /tmp/.mime.types1. It is
possible to exploit the vulnerability by placing a malicious symbolic link
in the temporary directory that is named after these files. The symbolic
link must point to a file that is owned by the user who will be installing
Java (which is typically the root user).
It is not known if these issues could be exploited to write custom data to
files, which could result in privilege escalation, though it is deemed
unlikely that this is possible.
This issue was reported in Sun JRE and SDK 1.4.2 for Linux platforms.
Other versions and platforms may also be affected.
2. BEA WebLogic InteractiveQuery.jsp Cross-Site Scripting Vulne...
BugTraq ID: 8938
Remote: Yes
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8938
Summary:
BEA WebLogic InteractiveQuery.jsp is an example CGI application supplied
with WebLogic. It is used to demonstrate use of arguments to query a
database.
A cross-site scripting vulnerability has been reported in the software.
The problem is reported to exist due to improper handling of user-supplied
data in an initialization argument called 'person'. It has been reported
that if an invalid value is passed to this argument, the software returns
the value back to the user in a results page without proper sanitization.
HTML and script code will be rendered in a user's browser, therefore
making it possible for an attacker to a construct a malicious link
containing HTML or script code that may be rendered in a user's browser
upon visiting that link. This attack would occur in the security context
of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.
BEA WebLogic 8.1 and prior are reported to be prone to this issue, however
other versions may be affected as well.
3. Citrix Metaframe XP Cross-site Scripting Vulnerability
BugTraq ID: 8939
Remote: Yes
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8939
Summary:
Metaframe is a remote desktop software package distributed by Citrix. This
issue affects Metaframe on the Microsoft Windows platform. The application
can be configured to require authentication credentials before granting
desktop access to a user.
A vulnerability has been discovered in Citrix Metaframe XP, specifically
during the authentication phase. When invalid authentication credentials
are supplied to the application, an error message is returned to the user.
The contents of this message are included within the URI. As a result, it
would be possible to include malicious script code within the page
contents location of the URI, specifically within the NFuse_Message URI
parameter.
This vulnerability occurs due to the Metaframe application failing to
carry out sufficient sanitization of URI parameters. An attacker could
potentially exploit this condition to execute arbitrary script code within
the context of a victims browser. Ultimately, this could lead to the theft
of cookie-based authentication credentials or other attacks.
4. Plug and Play Web Server Remote Denial of Service Vulnerabil...
BugTraq ID: 8941
Remote: Yes
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8941
Summary:
Plug and Play Web Server is a Microsoft Windows based application package
that provides users with the ability to create and maintain dynamic
websites. The software also supports SSL.
A vulnerability has been reported in the software that may allow a remote
attacker to cause a denial of service condition in the server. The issue
presents itself when an attacker sends a malformed HTTP GET request to the
server for: "GET /asdf.? HTTP/1.0". The problem leads to a halt of the
proxy service followed by this error message: "Runtime Error 12001 -
Parameter 1 of the method used is invalid or not appropriate".
Successful exploitation of this issue may allow an attacker to cause the
software to act in an unstable manner leading to a crash or hang.
Plug and Play version 1.0002c has been reported to be prone to this issue,
however other versions may be vulnerable as well.
5. Seyeon FlexWATCH Network Video Server Unauthorized Administr...
BugTraq ID: 8942
Remote: Yes
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8942
Summary:
FlexWATCH Network Video Server is used to deliver real time video over a
network. The server also allows users to use a web browser as a client.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to gain administrative access to the system. The
problem is reported to occur if an attacker attempts to access the
administrative interface using a specially crafter URL containing two
slash '/' characters. This problem is due to improper validation of
user-supplied input.
Successful exploitation of this issue may allow a remote attacker to gain
administrator level privileges to the server. This may lead to user
accounts and system configuration modifications.
FlexWATCH Network Video Server Model 132 has been reported to be prone to
this issue, however other versions may be affected as well.
6. Ashley Brown iWeb Server Encoded Backslash Directory Travers...
BugTraq ID: 8943
Remote: Yes
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8943
Summary:
iWeb Server is a small HTTP server that is designed for internal use as
part of a test environment. It has been announced that iWeb Server is
vulnerable to a condition that may result in the disclosure of potentially
sensitive information.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to access information outside the server root directory.
The problem exists due to insufficient sanitization of user-supplied data,
specifically parsing for hex encoded backslash characters. The issue may
allow a remote attacker to traverse outside the server root directory by
using '..%5C' character sequences.
Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive information that may be used to launch further
attacks against a vulnerable system.
7. Tritanium Scripts Tritanium Bulletin Board Unauthorized Acce...
BugTraq ID: 8944
Remote: Yes
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8944
Summary:
Tritanium Bulletin Board is a bulletin board application written in PHP.
A vulnerability has been reported in the software that may allow a remote
attacker to gain unauthorized access to threads. The problem may occur
due to improper handling of user-supplied input. A remote attacker may be
able to access sensitive data by modifying the URL and supplying a value
for thread_id, forum_id, and sid paremeters. It has been reported that
the thread id is not a randomly generated number therefore an attacker may
easily gain access to all threads without authorization.
Successful exploitation of this issue may allow an attacker to gain access
to sensitive information that could be used to launch further attacks
against a system.
Tritanium Bulletin Board version 1.2.3 has been reported to be prone to
this issue, however other versions may be affected as well.
8. MacOS X Local Root Privilege Elevation Vulnerability
BugTraq ID: 8945
Remote: No
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8945
Summary:
It has been reported that on specific hardware configurations on MacOS X
systems prior to release 10.3, it may be possible for a malicious physical
user to gain a root shell. The system must be implementing the use of a
USB keyboard.
The issue occurs immediately after boot-up, and it is said that a user
holding down CTRL-C for an unspecified period of time (possibly 2 to 3
minutes), may cause the init process to crash. If this occurs, allegedly
the user will be dropped into a root shell without requiring to supply
authentication credentials.
Supposedly, the vendor has stated that this condition was a developer
feature however this has not been confirmed by Symantec.
This vulnerability is said to affected all MacOS X versions prior to 10.3.
9. Mldonkey Web Interface Error Message Cross-site Scripting Vu...
BugTraq ID: 8946
Remote: Yes
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8946
Summary:
Mldonkey is a client program for the E-Donkey network. It is configurable
to implement the use of a web-based interface that can listen on an
arbitrary port. It has been reported that the Mldonkey interface is prone
to cross-site scripting attacks when generated error pages for an invalid
request.
This vulnerability occurs due to the Mldonkey application failing to carry
out sufficient sanitization of URI parameters. An attacker could
potentially exploit this condition to execute arbitrary script code within
the context of the web interface. Ultimately, this could lead to a variety
attacks.
10. BRS WebWeaver httpd `User-Agent` Remote Denial of Service Vu...
BugTraq ID: 8947
Remote: Yes
Date Published: Nov 01 2003
Relevant URL: http://www.securityfocus.com/bid/8947
Summary:
BRS WebWeaver is a small personal web server available for the Microsoft
Windows operating systems.
A denial of service vulnerability has been discovered BRS WebWeaver. The
problem occurs when a request is made containing a large string value for
the `User-Agent` parameter. This issue may cause the software to behave
in an unstable manner leading to a crash.
Successful exploitation of this issue may allow an attacker to cause the
software to crash or hang.
BRS WebWeaver versions 1.06 and prior have been reported to be prone to
this issue.
11. HTTP Commander Directory Traversal Vulnerability
BugTraq ID: 8948
Remote: Yes
Date Published: Nov 01 2003
Relevant URL: http://www.securityfocus.com/bid/8948
Summary:
HTTP Commander is a web based file management system used for Microsoft
ISS web server. HTTP Commander is written in ASP.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to access information outside the server root directory.
The problem exists due to insufficient sanitization of user-supplied data.
The issue may allow a remote attacker to traverse outside the server root
directory by using '../' character sequences.
Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive information that may be used to launch further
attacks against a vulnerable system.
HTTP Commander version 4.0 is reported to be prone to this issue, however
other versions may be affected as well.
12. HTTP Commander Path Disclosure Vulnerability
BugTraq ID: 8949
Remote: Yes
Date Published: Nov 01 2003
Relevant URL: http://www.securityfocus.com/bid/8949
Summary:
It has been reported that a path disclosure issue exists in the software
leading to the disclosure of the file installation path. The software may
report the installation path in an error page in response to a invalid
user request. The issue is reported to exist in the 'file' parameter. An
attacker may gain access to the installation path information by supplying
the "." argument to the vulnerable file parameter.
Successful exploitation of this attack may allow an attacker to gain
sensitive information about the file system that may aid in launching more
direct attacks against the system.
HTTP Commander version 4.0 is reported to be prone to this issue, however
other versions may be affected as well.
13. DATEV Nutzungskontrolle Unauthorized Access Vulnerability
BugTraq ID: 8950
Remote: No
Date Published: Nov 01 2003
Relevant URL: http://www.securityfocus.com/bid/8950
Summary:
DATEV Nutzungskontrolle (NUKO) is a software used to enforce access
control for various applications and systems.
A vulnerability has been reported in the software that may allow a local
attacker to access restricted data. The issue presents itself as a local
user is able modify certain keys in the Windows registry resulting in
bypassing the security model of the software. An attacker may then gain
unauthorized access to sensitive data. This issue would not present
itself if the registry keys were set to read only.
Successful exploitation of this issue may allow an attacker to gain access
to sensitive data that could be used to launch further attacks against the
system.
Nutzungskontrolle V.2.1 and V.2.2 has been reported to be prone to this
issue, however other versions may be affected as well.
14. Multiple Ethereal Protocol Dissector Vulnerabilities
BugTraq ID: 8951
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8951
Summary:
Multiple Ethereal protocol dissectors are prone to remotely exploitable
vulnerabilities. These issues have been addressed with the release of
Ethereal 0.9.16.
The following specific issues were reported:
A malformed GTP MSISDN string could cause a buffer overrun to occur.
Malformed ISAKMP or MEGACO packets could cause Ethereal or Tethereal to
crash, resulting in a denial of service.
The SOCKS dissector is reported to be prone to a heap overrun.
These issues may be exploited by causing Ethereal to process a malformed
packet, either while Ethereal is monitoring live network traffic or via a
packet trace. Successful exploitation could lead to code execution or
denial of service attacks against Ethereal.
15. Cups Internet Printing Protocol Job Loop Denial Of Service V...
BugTraq ID: 8952
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8952
Summary:
CUPS is a freely available, open source UNIX printing utility. It is
freely available for the Unix and Linux platforms.
A problem has been identified in the handling of requests via CUPS
Internet Printing Protocol (IPP). Because of this, it is possible for an
attacker to deny service to legitimate users.
The specifics of the problem are not currently available. It is known
that an attacker must have the ability to connect to the vulnerable
service on the IPP port, and that submitting a specially-crafted request
can result in a busy loop of the software. This issue may be related to
Bugtraq ID 7637, and will be further updated when additional details
become available.
16. Bugzilla Multiple Vulnerabilities
BugTraq ID: 8953
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8953
Summary:
Bugzilla is a freely available, open source bug tracking software package.
It is available for Linux, Unix, and Microsoft Windows operating systems.
Multiple vulnerabilities has been reported to exist in the software. The
issues include SQL injection, unauthorized privileges, and information
disclosure.
A SQL injection issue has been reported to be present in the nightly
statistics cron job called collectstats.pl. A user with 'editproducts'
privileges which are usually granted to administrators may be to carry out
SQL injection attacks. This issue affects Bugzilla versions 2.16.3 and
earlier.
Another SQL injection vulnerability has been reported that may allow a
user with 'editkeywords' privileges which are usually granted to
administrators. An attacker may be able to inject arbitrary SQL code in
the underlying database through the URL used to edit an existing keyword.
This issue affects Bugzilla versions 2.16.3 and earlier and 2.17.1 through
2.17.4.
A vulnerability has been reported that may allow users to retain
privileges that were previously granted. This issue may occur when
products are being deleted. If the 'usebuggroups' parameter was selected,
users may still be able to add others to the group that is being deleted.
If another group is created that reuses the group id from the group being
deleted, they may automatically inherit privileges granted to the group.
This vulnerability only allows users that had those privileges before to
retain them. This issue affects Bugzilla versions 2.16.3 and earlier.
An information disclosure issue has been reported that may allow an
attacker to view restricted bugs stored in the database. It has been
reported that if an attacker knows the e-mail address of a user who has
voted on a secure or restricted bug they may be able to view the summary
of the bug without having sufficient permissions. This issue affects
Bugzilla versions 2.16.3 and earlier and 2.17.1 through 2.17.4.
Another information disclosure issue has been reported that may allow an
attacker to disclose component descriptions for a product without proper
authorization. This issue affects Bugzilla versions 2.17.3 and 2.17.4.
17. Nullsoft SHOUTcast icy-name/icy-url Memory Corruption Vulner...
BugTraq ID: 8954
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8954
Summary:
Nullsoft SHOUTCast Server is used to broadcast Shoutcast music. It is
available for Unix and Linux operating systems, as well as Microsoft
Windows.
Nullsoft SHOUTcast Server is prone to a memory corruption vulnerability
that may lead to denial of service attacks or code execution.
Insufficient bounds checking of the icy-name and icy-url server commands
may allow a remote authenticated user to corrupt memory. It has been
reported that the attacker must issue overly long arguments for both these
commands during a connection to the server. Doing so will cause adjacent
regions of memory to be corrupted, which will mostly likely result in a
denial of service but could potentially be exploited to execute arbitrary
code.
This issue was reported in SHOUTcast 1.9.2 on Windows platforms. Other
versions and platforms may also be affected.
18. Synthetic Reality SymPoll Cross-Site Scripting Vulnerability
BugTraq ID: 8956
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8956
Summary:
Sympoll is web-based voting booth software. It is implemented in PHP and
will run on most Unix and Linux variants as well as Microsoft Windows
operating systems.
A cross-site scripting vulnerability has been reported in the software.
The problem is reported to exist due to improper handling of user-supplied
data through the 'vo' parameter. HTML and script code will be rendered in
a user's browser, therefore making it possible for an attacker to a
construct a malicious link containing HTML or script code that may be
rendered in a user's browser upon visiting that link. This attack would
occur in the security context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.
Sympoll version 1.5 is reported to be prone to this issue, however other
versions may be affected as well.
19. Web Wiz Forum Unauthorized Private Forum Access Vulnerabilit...
BugTraq ID: 8957
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8957
Summary:
A vulnerability has been reported for Web Wiz Forum. The problem is said
to occur due to the application failing to compare specific request
parameters in specially formatted requests. Specifically, by setting the
'mode' parameter to 'quote', Web Wiz Forum will not carry out sufficient
comparison checks of the Post number (PID) and Forum number (FID).
An attacker could exploit this condition by supplying a PID relating to a
private forum and an FID to a forum that they access to. A Topic number
(TID) must also be supplied that is associated with the Post number, such
as the thread that the post will be written to or accessed from.
When the application handles the above request, due to the selected mode,
sufficient checks will not be carried out on the supplied parameters and
the application may erroneously allow the user to post or read messages on
the forum.
In a worst case scenario, successful exploitation of this issue could lead
to the exposure of sensitive information.
20. MPM Guestbook Cross-Site Scripting Vulnerability
BugTraq ID: 8958
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8958
Summary:
MPM Guestbook is a freely available web application. It is implemented in
PHP and available for Unix/Linux variants as well as Microsoft Windows
platforms.
MPM Guestbook is reported to be prone to a cross-site scripting
vulnerability. This is due to insufficient sanitization of HTML from URI
parameters, which will be displayed in web pages that are dynamically
generated by the software. In particular, the 'lng' URI parameter is not
filtered.
An attacker could exploit this issue by enticing a victim user to follow a
malicious link that includes HTML and script code as a value for the
vulnerable URI parameter. The attacker-supplied code could be rendered in
the victim's browser in the context of the site hosting the software.
This could theoretically allow for theft of cookie-based authentication
credentials. The attacker may also influence how the guestbook is
rendered to the user following the link, allowing for a variety of other
attacks.
21. ThWboard Cross-Site Scripting Vulnerability
BugTraq ID: 8959
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8959
Summary:
ThWboard is a bulletin board software written in PHP and MySQL.
A cross-site scripting vulnerability has been reported in the software.
The problem is reported to exist due to improper handling of user-supplied
data. HTML and script code will be rendered in a user's browser,
therefore making it possible for an attacker to a construct a malicious
link containing HTML or script code that may be rendered in a user's
browser upon visiting that link. This attack would occur in the security
context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.
ThWboard versions 2.8 and 2.81 may be prone to this issue, however other
versions may be affected as well.
This BID will be updated as more information becomes available.
22. PHPKit Include.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 8960
Remote: Yes
Date Published: Nov 02 2003
Relevant URL: http://www.securityfocus.com/bid/8960
Summary:
PHPKIT is content management software. It is implemented in PHP and
available for Unix/Linux variants as well as Microsoft Windows.
PHPKIT is reported to be prone to a cross-site scripting vulnerability.
This is due to insufficient sanitization of HTML from URI parameters,
which will be displayed in web pages that are dynamically generated by the
software. The issue exists in the 'include.php' script and is specific to
the 'contact_email' URI parameter.
An attacker could exploit this issue by enticing a victim user to follow a
malicious link that includes HTML and script code as a value for the
vulnerable URI parameter. The attacker-supplied code could be rendered in
the victim's browser in the context of the site hosting the software.
This could theoretically allow for theft of cookie-based authentication
credentials. The attacker may also influence how the site is rendered to
the user following the link, allowing for a variety of other attacks.
23. ThWboard SQL Injection Vulnerability
BugTraq ID: 8961
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8961
Summary:
ThWboard is a bulletin board software written in PHP and MySQL.
A vulnerability has been reported to exist in the software that may a
remote user to inject malicious SQL syntax into database queries. This
issue is caused by insufficient sanitization of user-supplied data. A
remote attacker may exploit this issue to influence SQL query logic to
disclose sensitive information that could be used to gain unauthorized
access.
A malicious user may influence database queries in order to view or modify
sensitive information potentially compromising the software or the
database.
ThWboard versions 2.8 and 2.81 may be prone to this issue, however other
versions may be affected as well.
24. Unichat Unhandled Character Set Denial of Service Vulnerabil...
BugTraq ID: 8962
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8962
Summary:
Unichat is a graphical chatting application available for the Windows
operating system. The Unichat application makes use of the 'u2res000.rit'
file, which contains a list of handled characters.
It has been discovered that Unichat clients that encounter an unhandled
character will unexpectedly crash. Allegedly the characters must be
outside of the alphanumeric range and the character must not be specified
within the 'u2res000.rit' file.
An attacker could exploit this condition by modifying their client's
'u2res000.rit' file to contain characters outside of the specified range.
Then, by connecting to a server and transmitting the characters to the
chat, all clients that do not handle the characters will crash.
25. PHPRecipeBook Unspecified Cross-Site Scripting/HTML Injectio...
BugTraq ID: 8963
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8963
Summary:
PHPRecipeBook is a web application for managing recipes. It is
implemented in PHP and available for Unix/Linux and Microsoft Windows.
PHPRecipeBook 2.18 has been released to address an unspecified cross-site
scripting vulnerability. This issue is likely due to insufficient
sanitization of HTML from URI parameters, which will be displayed in web
pages that are dynamically generated by the software.
An attacker could exploit this issue by enticing a user to follow a
malicious link. This could theoretically allow for theft of cookie-based
authentication credentials or other attacks.
An attacker could possibly exploit this issue by enticing a victim user to
follow a malicious link that includes HTML and script code as a value for
the vulnerable URI parameter. The attacker-supplied code could be
rendered in the victim's browser in the context of the site hosting the
software. This could theoretically allow for theft of cookie-based
authentication credentials. The attacker may also influence how the site
is rendered to the user following the link, allowing for a variety of
other attacks.
It should also be noted that the vendor has reported that HTML and script
code will now be sanitized (as of version 2.18) before being included in
recipes as a measure to mitigate against potential HTML injection attacks.
This could allow users to inject hostile HTML into a PHPRecipeBook site if
successfully exploited.
26. OpenBSD isakmpd Multiple IKE Payload Handling Security Weakn...
BugTraq ID: 8964
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8964
Summary:
isakmpd is the IKE key management dameon provided with OpenBSD. isakmpd is
used when negotiating security associations in authenticated or encrypted
network traffic and is normally used to facilitate VPN.
OpenBSD's isakmpd daemon is said to be prone to multiple weaknesses when
handling various IKE payloads. Specifically, four weaknesses have been
discovered in various implementations of the daemon. The problems include:
1) Fails to enforce encrypted Quick Mode messages despite RFC 2409
specification. This could lead to the unintentional exposure of sensitive
session initialization data.
2) isakmpd fails to encrypt Quick Mode payloads, when acting as the
responder, if the initiator has not implemented encryption on the payload.
The issue occurs due to a check by the message_recv() function, located
within the message.c source file. Specifically, an if statement within the
function determines the status by checking the ISAKMP_FLAGS_ENC flag of
the received packet, only if the flag is set will the responder enforce
payload encryption. This could also potentially lead to the exposure of
sensitive session initialization data.
3) Hash payloads are only enforced on Quick Mode exchanges, despite the
RFC 2409 and RFC 2407 specifications stating that Phase 2 messages
containing delete payloads and 'notify' status messages should also
contain hash payloads. This could result in isakmpd not having a mechanism
for verifying the sanity of specific payloads received. It has also been
reported that hash payloads received from an unexpected source are not
verified.
4) Phase 2 delete messages are not verified to ensure that the origin of
the request is the owner of the requested SA to be deleted. The check
occurs within the ipsec_handle_leftover_payload() function, located in the
ipsec.c source file. This does not violate RFC specification, however it
is an insecure security policy that could be exploited by an unauthorized
user to delete an arbitrary SA.
It should be noted that due to the isakmpd daemon being widely
distributed, other operating systems may also be affected by this issue.
As further analysis of these weaknesses are carried out, it is likely that
each issue will be given a separate BID. At this time, this BID will be
updated and subsequently retired.
27. IA WebMail Server Long GET Request Buffer Overrun Vulnerabil...
BugTraq ID: 8965
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8965
Summary:
IA WebMail Server is a web server available for the Microsoft Windows
operating system.
It has been reported that IA WebMail is prone to a buffer overrun
vulnerability. The problem occurs due to insufficient bounds checking when
handling GET requests. Specifically, making a GET request including
approximately 1044 bytes of data will effectively overrun the bounds of
the internal memory buffer used for its storage.
As a result, an attacker may be capable of corrupting sensitive data such
as a return address, and effectively control the execution flow of the
program. This would ultimately allow for the execution of arbitrary code.
This vulnerability is said to affect all versions of IA WebMail Server up
to 3.1.
28. Oracle9iAS Portal Component SQL Injection Vulnerability
BugTraq ID: 8966
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8966
Summary:
A vulnerability has been reported to exist in the software that may allow
a remote user to inject malicious SQL syntax into database queries through
a URL. This issue is caused by insufficient sanitization of user-supplied
data.
The problem is reported to exist in the Portal component which is
installed by default in the application server. A remote attacker may
exploit this issue to influence SQL query logic to disclose sensitive
information from the database.
Successful exploitation may allow a malicious user to influence database
queries in order to view or modify sensitive information, and potentially
compromising the software or the database. It is reported that
unauthenticated users may access PL/SQL packages and procedures from the
web. This would occur within the context of the invoker or definer. If a
procedure were to be executed by a definer with SYS or SYSTEM access
rights, this would allow the attacker to gain access to all data within
the database. The Portal DB Forms, Hierarchy, XML Components and List of
Values packages may allow this level of access. It should also be noted
that these packages are required by the software and cannot be disabled or
deleted.
29. VieNuke VieBoard SQL Injection Vulnerability
BugTraq ID: 8967
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8967
Summary:
VieNuke VieBoard is a bulletin board software written in ASP and SQL.
A vulnerability has been reported to exist in the software that may a
remote user to inject malicious SQL syntax into database queries,
specifically through the 'id' parameter. This issue is caused by
insufficient sanitization of user-supplied data. A remote attacker may
exploit this issue to influence SQL query logic to disclose sensitive
information that could be used to gain unauthorized access.
A malicious user may influence database queries in order to view or modify
sensitive information potentially compromising the software or the
database.
30. NIPrint LPD-LPR Print Server Remote Buffer Overrun Vulnerabi...
BugTraq ID: 8968
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8968
Summary:
NIPrint LPD-LPR Print Server is a product for the Microsoft Windows
operating system designed to allow bi-directional LPD/LPR services using
Winsock. The application is developed and maintained by Network
Instruments.
It has been reported that NIPrint LPD-LPR Print Server is prone to a
remotely exploitable buffer overrun condition. The problem occurs due to
insufficient bounds checking when handling data received over the printer
port (515). Specifically, transmitting approximately 60 bytes of data to
the service is said to overrun the allocated storage buffer. As a result,
a remote attacker may be capable of corrupting process memory in such a
way that arbitrary code may be executed.
This vulnerability is said to affect all versions of NIPrint LPD-LPR Print
Server.
31. Network Instruments NIPrint LDP-LPR Privilege Escalation Vul...
BugTraq ID: 8969
Remote: No
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8969
Summary:
NIPrint LPD-LPR Print Server is a product for the Microsoft Windows
operating system designed to allow bi-directional LPD/LPR services using
Winsock. The application is developed and maintained by Network
Instruments. It has been reported that a flaw in NIPrint can be exploited
by malicious local users to gain administrative privileges on affected
servers.
NIPrint runs as a service, with SYSTEM privileges, by default. It is
accessible to all users locally through an icon in the taskbar. According
to the report, the "help" system used by NIPrint can invoke Explorer as
SYSTEM. An attacker can, in turn, use Explorer to run commands with
administrative privileges.
This vulnerability may be an instance of the general issue described in
BID 8884.
32. OpenSSL ASN.1 Large Recursion Remote Denial Of Service Vulne...
BugTraq ID: 8970
Remote: Yes
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8970
Summary:
OpenSSL is a freely available, open source implementation of Secure Socket
Layer tools. It is available for the Unix, Linux, and Microsoft
platforms.
A problem has been identified in OpenSSL when handling specific types of
ASN.1 requests. This may result in remote attackers creating a denial of
service condition.
The problem is in the handling of specific types of requests when handling
ASN.1 data that causes large recursion. Though specifics of how this
occurs are not available, it has been reported that this can result in a
crash of OpenSSL. This could potentially lead to an attacker crashing a
service that uses an implementation of the vulnerable software.
This issue is also known to affect numerous Cisco products. It is
possible that other vendors will also be acknowledging this issue and
providing fixes.
33. Perception LiteServe Server Log Buffer Overflow Vulnerabilit...
BugTraq ID: 8971
Remote: Yes
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8971
Summary:
Perception LiteServe provides web, email, and ftp server functionality. It
is available for the Microsoft Windows operating system.
A vulnerability has been reported to exist in the software due to
insufficient boundary checking. This problem may allow a remote attacker
to execute arbitrary code on a vulnerable host in order to gain
unauthorized access. The vulnerability occurs when the web server
attempts to process malformed GET requests specifically when processing
overly long GET requests consisting of character sequences between 1000
and 3000 in length. A buffer overflow will occur when the a user
encounters the GET request in a server log and clicks on it using the
LiteServe Interface.
An attacker may leverage the issue by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing the
affected procedure to return to an address of their choice. Successful
exploitation of this issue may allow an attacker to execute arbitrary code
in order to gain unauthorized access to a vulnerable system.
LiteServe versions 2.2 and prior have been reported to be prone to this
issue.
34. OpenAutoClassifieds Listing Parameter Cross-Site Scripting V...
BugTraq ID: 8972
Remote: Yes
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8972
Summary:
OpenAutoClassifieds is an open source classifieds manager written in PHP.
A cross-site scripting vulnerability has been reported in the software.
The problem is reported to exist due to improper handling of user-supplied
data through the 'listings' parameter. HTML and script code will be
rendered in a user's browser, therefore making it possible for an attacker
to a construct a malicious link containing HTML or script code that may be
rendered in a user's browser upon visiting that link. This attack would
occur in the security context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Since the attacker can influence
how to site will be rendered to a victim user, other attacks are also
possible such as manipulating site content.
OpenAutoClassifieds version 1.0 is reported to be prone to this issue,
however other versions may be affected as well.
35. CDE LibDTHelp DTHelpUserSearchPath Local Buffer Overflow Vul...
BugTraq ID: 8973
Remote: No
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8973
Summary:
Common Desktop Environment (CDE) is a commercially-available desktop
environment for the Unix and Linux operating systems.
A problem has been identified in CDE libDtHelp. Because of this, it may
be possible for a local attacker to gain elevated privileges.
The problem is in the handling of data in the DTHELPUSERSEARCHPATH
environment variable. Due to insufficient bounds checking, it is possible
to corrupt system memory, potentially overwriting sensitive values. As a
result, it may be possible for a local attacker to execute arbitrary code.
Applications linked against libDtHelp are typically installed with setuid
root privileges. An attacker taking advantage of this issue could
therefore potentially gain administrative access on a vulnerable system.
This issue may be related to Bugtraq ID 7730, although this has not been
confirmed by Symantec.
36. John Beatty Easy PHP Photo Album dir Parameter HTML Injectio...
BugTraq ID: 8977
Remote: Yes
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8977
Summary:
A vulnerability has been reported in the software that may allow a remote
attacker to execute HTML and script code in a user's browser. The issue is
reported to be present in the 'dir' parameter. The problem exists due to
insufficient sanitization of user-supplied input. It may be possible for
an attacker to include malicious HTML code in one of the vulnerable
fields. The injected code could then be interpreted by the browser of a
user visiting the vulnerable site. This attack would occur in the security
context of the affected site.
Successful exploitation of this issue may allow a remote attacker to steal
cookie-based authentication credentials. Other attacks are possible as
well.
Easy PHP Photo Album version 1.0 has been reported to be vulnerable to
this issue, however prior versions may be affected as well.
37. OpenBSD Local Malformed Binary Execution Denial of Service V...
BugTraq ID: 8978
Remote: No
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8978
Summary:
iBCS2 (Intel Binary Compatibility Specification 2) is a binary
compatibility format designed commonly used by SCO and ISC binaries. ELF
is the executable and linkable format which is the default binary format
used on Unix and Linux operating systems.
The OpenBSD has recently fixed a vulnerability in the OpenBSD kernel when
handling iBCS2 binaries. The problem occurs within the ibcs2_exec.c source
file and is due to insufficient sanity checks before allocating memory via
malloc(), using the xe_segsize binary parameter.
The precise technical details regarding this issue are currently unknown,
however it is believed that a segment table size (xe_segsize) value
greater than the maximum allowable number of segments (16) could
potentially cause malloc() to fail and under some circumstances return 0.
Because sufficient checks of the return value of malloc() are not carried
out, an unexpected value may be used in future calculations, effectively
triggering a kernel panic.
An additional issue was also addressed in exec_elf.c that could
potentially result in a kernel panic. This particular problem also
involved insufficient checks before calling malloc(), in this case with
the ELF program header size value as an argument. If a malicious binary
with a malformed size were handled, this may cause an unexpected
calculation in the code, effectively triggering a kernel panic.
The OpenBSD team has addressed this issue by verifying the size of the two
size values prior to calling the malloc() function.
An attacker could exploit this condition by constructing a malicious iBCS2
or ELF binary. It should be noted that, in the case of an iBCS2 binary,
support for the format would explicitly need to supported by the kernel
configuration.
*** November 5, 2003 - New information discovered by the researcher
suggests that the implications of this vulnerability could in fact be
higher then initially anticipated. As such, it is believed that successful
exploitation of this issue under some conditions could potentially lead to
code execution within the context of the kernel. This has been conjectured
due to varying crashes observed when triggering the condition. Due to the
lack of details regarding this possiblity, the status of this BID will
remain the same until more information is available.
38. Apple MacOS X Terminal Unspecified Unauthorized Access Vulne...
BugTraq ID: 8979
Remote: No
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8979
Summary:
Apple's MacOS X operating system includes the Terminal application, which
is a GUI-based Unix command shell.
Apple has reported that a vulnerability has recently been fixed in MacOS X
10.3, specifically in the Terminal application. Exploitation of the issue
is said to grant an attacker unauthorized access, however further
technical details have not yet been made available. Although unconfirmed
it has been conjectured that this condition is likely exploitable by a
local user to gain elevated privileges.
The local or remote context of this vulnerability is not currently known,
however due to the nature of the affected application, for the time being
the condition will be marked as local.
This vulnerability is said to only affected MacOS X version 10.3, all
previous versions are unaffected.
This BID will be updated as further information is made available.
39. Microsoft Internet Explorer Double Slash Cache Zone Bypass V...
BugTraq ID: 8980
Remote: Yes
Date Published: Nov 05 2003
Relevant URL: http://www.securityfocus.com/bid/8980
Summary:
A vulnerability has been reported in Internet Explorer that may allow
cached Internet content to be rendered in the My Computer zone. Normally,
cached content should be limited to the Internet Zone, where the default
security restrictions on the content are much stricter and the affects of
malicious script code should be limited. However, due to this
vulnerability, it is possible to cause this content to be treated as
though it were in the My Computer Zone. It is possible to exploit this
issue by including an extra slash when referencing cached content from
within a web page, for example:
[SysDrive]:\\Documents and Settings\[user_name]\Local Settings\Temporary
Internet Files\Content.IE5
The extra slash prior to "Documents and Settings" will cause the
referenced content to be handled in the context of the My Computer zone.
Combined with other vulnerabilities, this issue could lead to execution of
arbitrary code on the client system. A proof-of-concept has been released
to demonstrate this issue may be exploited with other issues to cause
execution of arbitrary code in the context of the client user. Analysis
of the proof-of-concept is currently underway to determine which
vulnerabilities are exploited. When analysis is complete, the appropriate
BIDs will be updated with information about the proof-of-concept.
40. Multiple Vendor S/MIME ASN.1 Parsing Denial of Service Vulne...
BugTraq ID: 8981
Remote: Yes
Date Published: Nov 05 2003
Relevant URL: http://www.securityfocus.com/bid/8981
Summary:
Multiple vulnerabilities have been reported to be present in various
implementations of S/MIME protocol. S/MIME is used to send binary data
and attachments across e-mail in a secure fashion. S/MIME is also used to
package ASN.1.
It has been reported that various products may be affected by denial of
service issues resulting from improperly handling of exceptional ASN.1
elements. An attacker may exploit this issue by sending an exceptional
ASN.1 element to a vulnerable system in order to cause a denial of service
condition.
Successful exploitation of this issue may allow an attacker cause the
software to behave in an unstable manner leading to a crash or hang.
Theses issues are reported to affect ASN.1 parsing routines, however
cryptographic libraries that implement S/MIME may affected as well due to
sharing of ASN.1 code between the cryptographic functions and S/MIME.
Currently Hitachi PKI Runtime Library and Hitachi Hitachi Groupmax Mail -
Security Option version 6 and possibly prior have reported to be
vulnerable, however this BID will be updated as more information becomes
available.
41. Clearswift MAILsweeper for SMTP Zip Archive Filtering Bypass...
BugTraq ID: 8982
Remote: Yes
Date Published: Nov 05 2003
Relevant URL: http://www.securityfocus.com/bid/8982
Summary:
MAILsweeper for SMTP is a commercial application for filtering e-mail
content at the gateway level.
A vulnerability has been reported to be present in the software that may
cause the software to fail in detecting malicious zip archives. It has
been reported that the software does not filter certain malicious zip
archives such as those generated by the Mimail worm (MCID 1763).
Successful exploitation may allow malicious code to be executed on client
systems. This is due to the fact that the malicious e-mail will not be
filtered at the gateway level and may affect users within an organization
that is using MAILsweeper to filter e-mail content. Exploitation can only
occur if a user executes a malicious attachment and malicious files must
also bypass any local anti virus software.
MAILsweeper for SMTP 4.3.10 and prior versions have been reported to be
prone to this issue.
42. X-CD-Roast Local Insecure File Creation Symlink Vulnerabilit...
BugTraq ID: 8983
Remote: No
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8983
Summary:
X-CD-Roast is a freely available CD burning utility available for Linux
and Unix based systems.
X-CD-Roast has been reported prone to an insecure file creation
vulnerability that may be exploited to corrupt arbitrary files. The issue
has been reported to present itself because X-CD-Roast will follow
symbolic links when writing certain specific files. The problem is also
conjectured to be exaggerated as a result of a lack of sufficient access
controls set by X-CD-Roast on the files that it creates and employs.
Ultimately a local user may exploit this condition by creating a symbolic
link in the place of the vulnerable X-CD-Roast file. The malicious
symbolic link will point to an arbitrary file on the system. When an
unsuspecting user invokes X-CD-Roast the file linked by the symbolic link
will be corrupted, the file corruption will occur only if the user
invoking X-CD-Roast has sufficient privileges to write to the target file.
A local user may leverage this condition to corrupt arbitrary files
triggering a system wide denial of service or potentially elevating their
system privileges.
43. Microsoft Internet Explorer Self Executing HTML Arbitrary Co...
BugTraq ID: 8984
Remote: Yes
Date Published: Nov 05 2003
Relevant URL: http://www.securityfocus.com/bid/8984
Summary:
Microsoft Internet Explorer has been reported prone to an arbitrary code
execution vulnerability.
The issue presents itself when Internet Explorer is rendering malicious
self-executing HTML pages that contain executables that are embedded in a
specific manner. It has been demonstrated that an attacker may exploit
this vulnerability to execute arbitrary code by crafting a malicious web
page that contains visual basic script designed to point to and invoke an
executable that is embedded as a string array in the same malicious web
page. When this page is rendered the script is interpreted and the
embedded executable is crafted and invoked with the privileges of the user
running the vulnerable web browser.
It should be noted that while this issue has been reported to affect
Internet Explorer versions 5.5 and 6.0, other versions might also be
affected.
44. HP-UX NLSPATH Environment Variable Privilege Escalation Vuln...
BugTraq ID: 8985
Remote: No
Date Published: Nov 06 2003
Relevant URL: http://www.securityfocus.com/bid/8985
Summary:
HP-UX allows the NLSPATH to be set for setuid root programs, which use
catopen(3C) and may be executed by other local users. catopen(3C) is used
to open message catalogues, using the NLSPATH environment variable as a
search path for the catalogue to be opened. The expected behavior is that
the NLSPATH will not be honored for setuid programs. HP reports that the
source of the problem is that the superuser cannot restrict the paths set
in the environment variable.
This could result in privilege escalation as an attacker could specify an
arbitrary path for a message catalogue, which will be opened with elevated
privileges. If successfully exploited, an attacker could gain root
privileges.
45. HP-UX Software Distributor Local Buffer Overrun Vulnerabilit...
BugTraq ID: 8986
Remote: No
Date Published: Nov 06 2003
Relevant URL: http://www.securityfocus.com/bid/8986
Summary:
HP has reported that some Software Distributor (SD) utilities are prone to
locally exploitable buffer overrun vulnerabilities. Affected utilities
include swinstall(1M) and swverify(1M). The nature of the vulnerabilities
is that an attacker can corrupt process memory with attacker-specified
data, allowing the attacker to control execution flow and execution
arbitrary code. Since these utilities are installed with setuid/setgid
privileges, a local attacker could exploit these issues to gain elevated
privileges.
It is likely that the attacker could gain root privileges through
exploitation of the vulnerable utilities.
46. Linux Kernel Trojan Horse Vulnerability
BugTraq ID: 8987
Remote: No
Date Published: Nov 05 2003
Relevant URL: http://www.securityfocus.com/bid/8987
Summary:
It has been announced that a file 'kernel/exit.c' was modified on the
kernel.bkbits.net Linux Kernel CVS tree by a malicious party. The file
'kernel/exit.c' was modified to include trojan horse code that would
potentially allow a local user to elevate privileges.
Specifically, when '__WCLONE|__WALL' is passed to the sys_wait4() function
in a sufficient manner a malicious procedure in the trojaned kernel
'current->uid = 0' is performed to elevate the malicious user to uid '0'
or root system privileges.
It is not currently known what version of the Linux kernel is affected by
this issue. This BID will be updated as further information regarding this
issue is disclosed.
47. Ganglia gmond Malformed Packet Remote Denial of Service Vuln...
BugTraq ID: 8988
Remote: Yes
Date Published: Nov 06 2003
Relevant URL: http://www.securityfocus.com/bid/8988
Summary:
Ganglia Monitoring Daemon (gmond) is cluster monitoring software available
for a wide variety of Unix-based operating systems, as well as Linux.
When a user transmits a packet to the gmond service, advertising a metric,
a hashing function handles the packet. The advertisement packet, when
transmitted from an official client, will include a name string that will
be a minimum of 2 bytes; 1 character followed by a NULL byte. The hashval
function, located within the lib/hash.c source file, parses the string
name and attempts to calculate the hash value within a for loop. The
calculated value is then used as an index into a specific array of hashes.
A vulnerability has been discovered in this procedure that could
potentially result in a denial of service condition. The problem occurs
when a malformed packet from a modified client or custom program is
transmitted with a 1 byte name string. When the hashval function handles
this packet, due to the unexpected name string size, the calculated value
will not be run through a modulus operation designed to ensure the value
is a legitimate index. As a result, a 1 byte number of greater size than a
valid index could potentially cause an unexpected calculation or invalid
pointer dereference.
It has been reported that due to this miscalculation, the gmond service
will crash when attempting to lock access to the hash entry by locking the
data at the calculated pointer. This would effectively result in a denial
of service condition.
This vulnerability is said to affected gmond version 2.5.3 however, other
versions may also be affected.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Ashcroft takes on foreign government hackers
By: Kevin Poulsen
New rules for FBI national security investigations officially classify
foreign probes of American computers a threat to national security.
http://www.securityfocus.com/news/7398
2. Thwarted Linux backdoor hints at smarter hacks
By: Kevin Poulsen
A failed attempt to submerge a subtle backdoor in the Linux kernel
confirms that sophisticated source code tampering is more than security
geek speculation.
http://www.securityfocus.com/news/7388
3. Unlucky phisher pleads guilty
By: Kevin Poulsen
Woman who unwittingly spammed the FBI in her scheme to harvest credit card
numbers pleads guilty to federal conspiracy charges.
http://www.securityfocus.com/news/7329
4. At Microsoft, security flaws emerge as business shortcomings
By: Helen Jung, The Associated Press
http://www.securityfocus.com/news/7395
5. Canadian Net fraud suspect arrested
By: John Leyden, The Register
http://www.securityfocus.com/news/7392
6. Snag in next-gen Wi-Fi security unearthed
By: John Leyden, The Register
http://www.securityfocus.com/news/7381
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Pathalizer v0.6
By: Arnout Engelen
Relevant URL: http://pathalizer.bzzt.net
Platforms: FreeBSD, Linux, POSIX
Summary:
Pathalizer is a tool for visualizing the paths most users take when
browsing a Web site. This information can be used to decide how to improve
the navigation of the site, and for determining wihch parts are most worth
improving and keeping up to date. It generates a directed, weighed graph
from an Apache log, but could easily be modified to analyze any list of
events.
2. darkstat v2.6
By: Emil Mikulic
Relevant URL: http://members.optushome.com.au/emikulic/net/darkstat/
Platforms: Linux, Solaris
Summary:
Darkstat is an ntop-workalike network statistics gatherer. Built to be
faster and smaller than ntop, it uses libpcap to capture network traffic
and serves up Web page reports of statistics such as data transferred by
host, port, and protocol. It also has a neat bandwidth usage graph.
3. N-View v2.9
By: Wolfgang Ullrich
Relevant URL: http://www.n-view.de/index_en.html
Platforms: Java
Summary:
N-View is a network monitor for small and medium-sized networks. It
features automatic scanning of subnets for host addresses, monitoring of
ICMP responses from all hosts, signalling of timeouts and delays in the
GUI and by mail, a portscanner, an SNMP client (MIB browser and trap
receiver), a graphical display of network traffic for network interfaces,
connectivity to hosts by telnet, HTTP browser, or an arbitrary external
program (such as ssh), printing of network diagrams, automatic generation
of HTML pages, and more.
4. testmail v3.1.7
By: c.kruk
Relevant URL: http://strony.wp.pl/wp/c_kruk/
Platforms: Perl (any system supporting perl)
Summary:
testmail is a Perl script that checks email availability at the POP3
server, filters it according to defined rules, and--depending on the
selected method--gets the messages to the local mailbox and/or removes it
from the server. It uses Perl libnet module and helps you escape from
spam.
5. mod_parmguard v1.2
By: Jerome Delamarche
Relevant URL: http://www.trickytools.com/php/mod_parmguard.php
Platforms: Linux
Summary:
Apache module that intercepts the requests and rejects those which are not
compliant with the constraints expected by the scripts. Use a XML
Configuration file that describe the type and allowed values for the
parameters. Released with automated tools that help the Administrator
building the XML Configuration file.
6. PwM Password Manager v 0.3.1
By: Michael Buesch
Relevant URL: http://passwordmanager.sourceforge.net/
Platforms: POSIX
Summary:
PwM is a password manager. Passwords are protected using strong Blowfish
encryption. It supports many features such as importing and exporting
KPasman, GPasman, and plain-text files. The password-list can be encrypted
with a master-password or with a key-card (a.k.a. chipcard or smartcard).
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. [TENABLE] Sales Engineers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343963
2. [TENABLE] Managed Services Support Engineers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343962
3. [TENABLE] Product Support Engineers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343961
4. [TENABLE] Senior Windows/UNIX Product Development En... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343960
5. [TENABLE] Sales Account Managers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343959
6. Senior Information Assurance Security Engr. Sought f... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343958
7. Secure Systems Architect - Tennessee (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343957
8. Intrusion Prevention Account Executive- DOD - VA/MD/... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343956
9. VP Sales Federal Division-Information Management and... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343955
10. SAN Security Systems Engineer- VA/DC/MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343954
11. Senior Architect, Windows Security Solutions - NY - ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343887
12. Ebay Job Opening - Information Security Engineer (45... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343886
13. Information Security Engineers/Consultants (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343885
14. Information Security Sales -DoD VA/DC/MD (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343884
15. Junior Secuirty Consultant Jobs UK/US (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343883
16. Product Marketing Director/Manager, Sunnyvale, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343882
17. Full-Time Staff Position at GA State University, ATL... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343881
18. DITSCAP Expert Needed in Charleston, SC. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343880
19. Security Support Applications Developer needed 3rd s... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343709
20. Network Infrastructure Security Administrators neede... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343708
21. Senior Software Sales Executive Need - Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343707
22. Technical Manager-Information Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343706
23. Security Engineers, DC Metro Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343705
24. Seeking position as a Sr. Pre/Post Sales Systems Eng... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343678
25. SW Vulnerability Engineer Silicon Valley (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343677
26. Director or VP of Enterprise Sales Opportunity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343676
27. Product Manager-Santa Clara, CA. -Hardware Product. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343649
28. Sr. System Engineer, TS is needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343646
29. Seeking "Gurus to the Gurus", consultants to the Sec... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343634
30. Lead IT Auditor (Washington-DC metro) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343633
31. FEDERAL SOFTWARE SALES REP - SECURITY SOFTWARE (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343632
32. Network Security Analyst- Sunnyvale, CA-Silicon Vall... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343630
33. Student from University of Southern California (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343626
34. Security Analysts, Consultants, Managers needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343625
35. Attack and Penetration Engineer $80k-95K Maryland (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343623
36. Oracle/PKI/LDAP authentication SW Developer w/TS SCI... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343622
37. Incident Response Team Lead, Silver Spring, MD $... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343620
38. Lead Security Integration Engineer Martinsburg, WVA... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343619
39. Network Security Analyst-Sunnyvale, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343618
40. Product Marketing Director/Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343617
41. Washington state, CISSP Forensics seeking position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343615
42. Pre/Post Sales Sr. Infrastructure Engineer (Metro DC... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343614
43. Director, Business Development & Channels (Metro DC) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343613
44. Tivoli Access Manager position in CHICAGO!! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343612
45. Tivoli/LDAP consultant required. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343611
46. Immediate Need for System Admin w/Virus Protection E... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343610
47. Classified Security Consultant (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343408
48. Systems Engineer - Silicon Valley - Startup (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343407
49. Software Engineer - FreeBSD/Security - Silicon Valle... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343405
50. Director of Vertical Market Development - NJ (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343404
51. Italy-based consultant looking for global opportunit... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343239
52. VP Application Security/NJ (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343210
53. Sr. IT Security Positions-Iraq-MUST HAVE CURRENT US ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/343207
VI. INCIDENTS LIST SUMMARY
--------------------------
1. client's TCP port 256 hammered by several hosts (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344029
2. Large increase in TCP/554 (rtsp) scans (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/343849
3. looking for help (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/343512
4. new ADMscript worm ? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/343472
5. resolv.conf - overwrite (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/343467
6. Scans on 1240/tcp? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/343260
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. thttpd-2.24 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/343968
2. Bug in libXcursor , is it exploitable? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/343946
3. lame ms-ftp large file creation bug (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/343944
4. WTMP file (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/343653
5. Re[3]: ms03-043 questions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/343652
6. Re[2]: ms03-043 questions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/343541
7. ms03-043 questions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/343539
8. arp packet payload (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/343255
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. IIS 6 features (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344000
2. IIS 6 features- loooong response (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/343999
3. Event Log messages for failed logon attempts (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/343759
4. Notable "Windows Postulates" from Linux Gurus (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/343758
5. ICF Firewall - How can I do it? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/343660
6. SecurityFocus Microsoft Newsletter #161 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/343315
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Disabling rpcbind/portmapper (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/343797
2. How to identify whether a given UID is a member of a... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/343751
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Relay control in qmail (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/343656
2. [despammed] Re: Relay control in qmail (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/343654
XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: SpiDynamics
FREE White Paper: Layer 7/Web Apps- "Future of Security Vulnerabilities"
This paper covers:
- How the web browser is the most dangerous hacking tool
- The definition of Layer 7 or web application vulnerabilities
- The importance of proactive security measures
- The key factors for successful web vulnerability assessment
Download this *FREE* white paper from SPI Dynamics for a complete guide to
protection!
http://www.securityfocus.com/sponsor/SPIDynamics_sf-news_031110
------------------------------------------------------------------------