SecurityFocus Newsletter #223
John Boletta <[email protected]> Mon, 17 Nov 2003 14:25:53 -0700 (MST)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #223
------------------------------
Is your network vulnerable to worms like Blaster? Scan Your Network for
FREE for the 2003 SANS Top 20 Vulnerabilities.
http://www.securityfocus.com/sponsor/Qualys_sf-news_031117
Qualys FreeScan enables the enterprise to immediately identify the
prevalent and critical security vulnerabilities most likely to be
exploited on the network perimeter. With the largest vulnerability testing
database in the industry, QualysGuard enables you to assess, prioritize,
and remediate the vulnerabilities in heterogeneous networks of any size.
Our Web-based service provides you with the ability to run immediate
assessments without installation of hardware or software.
Click on the link below to scan your network perimeter.
http://www.securityfocus.com/sponsor/Qualys_sf-news_031117
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Oracle Row Level Security: Part 2
2. Banking Scam Revealed
3. Electronic Voting Debacle
4. Proposed: a Bounty for Bugs
II. BUGTRAQ SUMMARY
1. IBM DB2 Multiple Command-line Format String Vulnerabilities
2. IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulne...
3. TerminatorX Command-line Format String Vulnerability
4. TerminatorX Multiple Command-Line and Environment Buffer Ove...
5. phpBB Profile.PHP SQL Injection Vulnerability
6. WMAPM Privilege Escalation Vulnerability
7. Conquest Unspecified Local Environment Variable Buffer Overf...
8. Qualcomm Eudora Reply-to-all Buffer Overrun Vulnerability
9. TelCondex SimpleWebserver Directory Traversal Vulnerability
10. Epic CTCP Nickname Server Message Buffer Overrun Vulnerabili...
11. OnlineArts DailyDose dose.pl Remote Command Execution Vulner...
12. Bugzilla Javascript Buglists Remote Information Disclosure V...
13. Winace UnAce Command Line Argument Buffer Overflow Vulnerabi...
14. PureFTPd displayrate() Remote Denial of Service Vulnerabilit...
15. nCube Server Manager Directory Traversal Vulnerability
16. Hylafax HFaxD Unspecified Format String Vulnerability
17. Symbol Technologies PDT 8100 Default WEP Keys Configuration ...
18. Microsoft FrontPage Server Extensions Remote Debug Buffer Ov...
19. Microsoft FrontPage Server Extensions SmartHTML Interpreter ...
20. Microsoft Internet Explorer DHTML Drag and Drop Local File S...
21. Microsoft Excel XLM Macro Security Level Bypass Vulnerabilit...
22. Microsoft Windows Workstation Service Remote Buffer Overflow...
23. Microsoft Internet Explorer XML Object Zone Restriction Bypa...
24. Microsoft Internet Explorer Script URL Cross-Domain Access V...
25. Microsoft Internet Explorer Function Pointer Override Cross-...
26. Microsoft Internet Explorer ExecCommand Cross-Domain Access ...
27. Omega-RPG Environment Variable Buffer Overrun Vulnerability
28. Fujitsu tsworks Attachment Expansion Buffer Overflow Vulnera...
29. PHP-Coolfile Unauthorized Administrative Access Vulnerabilit...
30. Opera Multiple MIME Type File Dropping Weakness
31. Nokia IPSO Voyager HTTPDAccessLog.TCL Remote Script injectio...
32. Opera Web Browser Opera: URI Handler Directory Traversal Vul...
33. Microsoft Internet Explorer file.writeline Local File Writin...
34. Cerberus FTP Server Unspecified Buffer Overflow Vulnerabilit...
35. Multiple Vendor Bluetooth Device Unspecified Information Dis...
36. SCO UnixWare/Open UNIX Insecure Handling Of ProcFS Vulnerabi...
37. Qualcomm Eudora Spoofed Attachment Line Denial Of Service Vu...
38. Spoofed Kernel Netlink Interface Message Denial of Service V...
39. Qualcomm Eudora Encrypted EMail Attachment/Image Storage Vul...
40. GNU Zebra / Quagga Remote Denial of Service Vulnerability
41. Clam AntiVirus E-mail Address Logging Format String Vulnerab...
42. Nokia Bluetooth Device Unauthorized Access Vulnerability
43. FortiGate Firewall Web Interface Cross-Site Scripting Vulner...
44. Multiple BEA WebLogic Server/Express Denial of Service and I...
45. PeopleSoft PeopleTools Gateway Administration Servlet Path D...
46. PeopleTools PeopleSoft IScript Cross-Site Scripting Vulnerab...
47. PeopleSoft PeopleBooks psdoccgi.exe Directory Traversal Vuln...
48. PeopleSoft PeopleBooks psdoccgi.exe Denial of Service Vulner...
49. WebWasher Classic Error Message Cross-Site Scripting Vulnera...
50. OpenSSH PAM Conversation Memory Scrubbing Weakness
51. PeopleSoft PeopleTools IClient Servlet Arbitrary Code Execut...
52. HP-UX Partition Manager Unspecified Remote Vulnerability
53. Web Wiz Forums location HTML Injection Vulnerability
54. Symantec PCAnywhere Privilege Escalation Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
1. Garage door DMCA case dismissed
2. Wireless hacking bust in Michigan
3. Ashcroft takes on foreign government hackers
4. Bluetooth is attack vector for mobile phones
5. Microsoft aims to 'shift the tide' in war on spam
6. Phishing and viral tech combines in new menace
IV. SECURITYFOCUS TOP 6 TOOLS
1. SILC (Secure Internet Live Conferencing)(Toolkit) v0.9.11
2. afick v1.4-0
3. GPGMail (v30) (10.3 (Panther)) v1.0
4. Figaro's Password Manager v0.58
5. NuFW v0.5.3
6. OSIRIS v2.1.0
V. SECURITYJOBS LIST SUMMARY
1. Sr. Software Engineer in Protland (Thread)
2. Director of Technology / Principal Scientist in Sant... (Thread)
3. Security Sales - Penetration Testing, UK (Thread)
4. Business Security Advisor vacancy (Thread)
5. Technology & Security Risk Services-Attack & Penetra... (Thread)
6. Citrix Systems: Senior Security Developer / Analyst ... (Thread)
7. Attack & Penetration Testing Manager, London (Thread)
8. Major contract in Northern VA (Thread)
9. Attack and Pen Engineer - Incident Response Support ... (Thread)
10. Sr. SQA Engineer Linux/Networking/VPN experience a m... (Thread)
11. Security Consultant (Thread)
12. SQA Engineer - Symantec in Redwood City - Linux/Netw... (Thread)
13. Audit (Security & IT) (Thread)
14. Application Security Consultant -- Seattle, WA (Thread)
15. position available - NL - evaluator IT Security (Thread)
16. Product Manager (Thread)
17. Symantec - Director, OEM / On-line Security - Santa ... (Thread)
18. Sr. SQA Engineer - Symantec - Santa Monica (Thread)
19. NSA/DOD Information Assurance Opportunity Needed (Thread)
20. Symantec - Systems Response - Santa Monica, CA (Thread)
21. Symantec - Development Manager - Santa Monica, CA (Thread)
22. Symantec - Research Position (2) - Waltham and Santa... (Thread)
23. Entry level/very junior security position in Washing... (Thread)
24. Checkpoint / Nokia Upgrade Assistance (Thread)
25. Ethical Hacker (Thread)
26. Lead Performance Tester- Seattle, WA. (Thread)
27. Security Sales Engineers-SanFran, Boston, VA, Atlant... (Thread)
28. Senior Application Security Consultant #781JS - NY -... (Thread)
29. NY Channel Sales Security (Thread)
30. Manager - BD/Technology Partnerships - Neoteris - Si... (Thread)
31. Intrusion detection/firewall developer - Bay Area, C... (Thread)
32. Candidate with a unique blend of IT, Pre Law & Busin... (Thread)
33. DC area pre-sales senior consultant (Thread)
VI. INCIDENTS LIST SUMMARY
1. idgsearch.com and googleMS.dll (Thread)
2. idsearch.com and GoogleMs.dll (Thread)
3. Strange Port 0 Traffic (Thread)
4. SQL Slammer doing the rounds again? (Thread)
5. [despammed] RE: SQL Slammer doing the rounds again? (Thread)
6. New PayPal Email Scam (Thread)
7. client's TCP port 256 hammered by several hosts- sol... (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. burneye, how i can defeat it? (Thread)
2. ms03-049 sp1a and sp0 now working. (Thread)
3. KDE 3.1 - Suse 8.2 - kdeglobals world writable (Thread)
4. thttpd-2.24 (Thread)
5. Reversing Code Coverage Tool (Thread)
6. ms03-049 exploit xp sp0 (Thread)
7. lame ms-ftp large file creation bug (Thread)
8. New mac-10.3 vulnerable to a fork bomb (Thread)
9. Re[2]: ms03-043 questions (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Exchange question (Thread)
2. New Microsoft Exchange Server Vulnerability (Thread)
3. Exchange question :VSMail mx4 (Thread)
4. Webcast: Microsoft Security VP talks about what Micr... (Thread)
5. AD structure for a school environment (Thread)
6. Exchange SMTP Hole? (Thread)
7. Article Announcement: Proposed: a Bounty for Bugs (Thread)
8. AW: EXCHANGE SMTP HOLE? (Thread)
9. Risks posed by a: drive with IE in kiosk mode (Thread)
10. FTP server security. (Thread)
11. Win2003 RPC failure after Hotfix (Thread)
12. Roll up of facts: FW: Exchange SMTP Hole? (Thread)
13. MS event logging (Thread)
14. SecurityFocus Microsoft Newsletter #162 (Thread)
15. Allowing site redirection with URLScan (Thread)
16. Article Announcememt: Reeducation Campaign (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Updating SSH (Thread)
2. "Boot time scripts should have an .sh extension" (Thread)
3. Disabling rpcbind/portmapper (Thread)
X. LINUX FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2003-11-10 to 2003-11-17.
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Oracle Row Level Security: Part 2
By Pete Finnigan
This paper explores the row level security feature added to Oracle 8i and
above, and provides examples. One of the main uses of row level security
is to allow all of a company's data to be stored in one database for
different departments, or for a hosting company to store data for
different companies in one database. Part Two.
http://www.securityfocus.com/infocus/1744
2. Banking Scam Revealed
By Secure Science Corporation
A detailed analysis of the recent "phishing" scam that targeted Citibank
customers. This paper describes the use of compromised hosts, Website
redirection and the specifics of a unique bulk-mailing tool that has been
repeatedly used in the recent rash of financial email scams.
http://www.securityfocus.com/infocus/1745
3. Electronic Voting Debacle
By Scott Granneman
Grave concerns over the security of electronic voting machines in the
United States means the heart of American democracy is at risk. ... >>
http://www.securityfocus.com/columnists/198
4. Proposed: a Bounty for Bugs
By Mark Rasch
Instead of paying hard cash to punish computer criminals, vendors should
reward grey hat hackers for responsibly finding and reporting the security
holes that make cyber attacks possible.
http://www.securityfocus.com/columnists/197
II. BUGTRAQ SUMMARY
-------------------
1. IBM DB2 Multiple Command-line Format String Vulnerabilities
BugTraq ID: 8989
Remote: No
Date Published: Nov 07 2003
Relevant URL: http://www.securityfocus.com/bid/8989
Summary:
DB2 is the database implementation maintained and distributed by IBM. It
is available for the UNIX, Linux, and Microsoft Windows platforms. The
db2govd, db2start, and db2stop database components are typically installed
setuid.
Multiple format string vulnerabilities have been discovered within the IBM
DB2 database specifically within the aforementioned components. The
problems occur due to erroneous usage of format-based functions and could
potentially allow an attacker to gain elevated privileges on a local
system.
The db2start and db2stop binaries are both prone to a format string bug
when handling a basic command-line argument, for example "./dbstart %x".
The db2govd binary is prone to the condition when handling parameters
passed as part of the 'validate garbage' and 'stop' options.
An attacker could potentially exploit one of these conditions by passing
specially calculated format string sequences to a target program. When
handled, the program may be controlled in such a way that arbitrary code
may be executed. All instructions executed would be run with the
privileges of the owner of the specific binary.
2. IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulne...
BugTraq ID: 8990
Remote: No
Date Published: Nov 07 2003
Relevant URL: http://www.securityfocus.com/bid/8990
Summary:
DB2 is the database implementation maintained and distributed by IBM. It
is available for the UNIX, Linux, and Microsoft Windows platforms. The
db2govd, db2start, and db2stop database components are typically installed
setuid/setgid.
IBM DB2 has been reported to be prone to multiple buffer overflow
vulnerabilities that present themselves in binaries that are shipped with
DB2. The vulnerabilities are likely caused due to a lack of sufficient
boundary checks performed on user-supplied command-line arguments before
they are copied into a reserved buffer in memory. By supplying data that
exceeds the size of the reserved memory buffer used to store command line
arguments, a local attacker may overflow the bounds of the affected buffer
and corrupt adjacent memory. Because this memory contains values that are
crucial to controlling program execution flow, the attacker may influence
the execution flow of the vulnerable binary into attacker-controlled
memory.
It has been reported that arguments between 65 and 9901 bytes in size may
trigger this issue in the respective vulnerable executables. Ultimately
this may lead to the execution of arbitrary attacker-supplied instructions
with elevated privileges.
Although this issue has been reported to affect IBM DB2 versions v7 and v8
other versions may also be affected.
3. TerminatorX Command-line Format String Vulnerability
BugTraq ID: 8992
Remote: No
Date Published: Nov 07 2003
Relevant URL: http://www.securityfocus.com/bid/8992
Summary:
TerminatorX is a freely available, open source music manipulation program.
It is available for the Linux platform.
It has been reported that TerminatorX may be prone to a format string
vulnerability when handling command-line parameters. Specifically, due to
the erroneous usage of a format-based function, it is possible to have
format specifiers passed as the '-f' file argument interpreted by the
program.
As a result, an attacker may be capable of exploiting the application in a
way to execute arbitrary code with elevated privileges. It should be noted
that TerminatorX is not installed setuid by default, however the author
recommends that users make the application setuid root.
4. TerminatorX Multiple Command-Line and Environment Buffer Ove...
BugTraq ID: 8993
Remote: No
Date Published: Nov 07 2003
Relevant URL: http://www.securityfocus.com/bid/8993
Summary:
terminatorX is a freely available, open source music manipulation program.
It is available for the Linux platform.
It has been reported that TerminatorX may be prone to multiple
vulnerabilities when handling command-line and environment variable data.
The problem specifically occurs due to insufficient bounds checking when
handling the LADSPA_PATH environment variable and the '-f' and '-r'
command-line parameters.
As a result, an attacker may be capable of exploiting the application in a
variety ways to execute arbitrary code with elevated privileges. It should
be noted that TerminatorX is not installed setuid by default, however the
author recommends that users make the application setuid root.
5. phpBB Profile.PHP SQL Injection Vulnerability
BugTraq ID: 8994
Remote: Yes
Date Published: Nov 08 2003
Relevant URL: http://www.securityfocus.com/bid/8994
Summary:
phpBB is an open-source web forum application that is written in PHP and
supported by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.
A SQL injection vulnerability has been reported for phpBB systems.
phpBB, in some cases, does not sufficiently sanitize user-supplied input,
which is used when constructing SQL queries to execute on the underlying
database. As a result, it is possible to manipulate SQL queries. This may
allow a remote attacker to modify query logic or potentially corrupt the
database.
This vulnerability was reported to exist in the profile.php script file. A
remote attacker can exploit this vulnerability by manipulating the $u URI
parameter to modify SQL query logic.
SQL injection attacks may also potentially be used to exploit latent
vulnerabilities in the underlying database implementation.
It should be noted that although this vulnerability has been reported to
affect phpBB version 2.0.5 and prior, it may also affect version 2.0.6.
6. WMAPM Privilege Escalation Vulnerability
BugTraq ID: 8995
Remote: No
Date Published: Nov 08 2003
Relevant URL: http://www.securityfocus.com/bid/8995
Summary:
wmapm is a Window Maker Dock App that is used as a battery power status
monitor for laptops.
wmapm has been reported prone to a local privilege escalation
vulnerability. The vulnerability has been conjectured to result from a
lack of relative path use while the vulnerable dock app is calling the
'apm' binary. As a result of this, a local attacker may manipulate local
path settings and have the setuid wmapm dock app erroneously invoke a
trojan binary that is located in a directory that the attacker has
permissions to write to.
The code contained in the invoked binary will be executed with the
privileges of the vulnerable wmapm app; this may ultimately result in
elevating the privileges of the attacker.
It has been reported that wmapm is setUID operator in FreeBSD if it is
compiled via the ports collection, alternatively if wmapm is compiled from
source on FreeBSD or Linux it is reportedly setUID root.
It should be noted that although this issue has been reported to affect
wmapm version 3.1, previous versions might also be affected.
7. Conquest Unspecified Local Environment Variable Buffer Overf...
BugTraq ID: 8996
Remote: No
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/8996
Summary:
conquest is a simple curses based strategy game developed for unix based
operating systems. It has been reported that on the Debian Linux
distribution, the conquest binary is setgid conquest.
A local buffer overrun vulnerability has been reported for conquest. The
problem occurs due to insufficient bounds checking when parsing
unspecified data contained in the user's environment. As a result, an
attacker may be capable of controlling the execution flow of the conquest
program and effectively executing arbitrary code with elevated privileges.
Exploiting this condition may allow an attacker to gain group 'conquest'
privileges that could be used to modify sensitive information or could be
used to leverage attacks against other previously inaccessible utilities.
8. Qualcomm Eudora Reply-to-all Buffer Overrun Vulnerability
BugTraq ID: 8997
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/8997
Summary:
Eudora is an e-mail client for Microsoft Windows and other operating
systems. It is maintained and distributed by Qualcomm.
Qualcomm Eudora is prone to a buffer overrun when performing reply-to-all
operations with message header fields (such as "From" or "Reply-To") of
excessive length. To exploit this issue, an attacker must send a
malicious message to a user of the client, which the user must then
respond to using the reply-to-all. When the malformed message header
fields are processed, adjacent regions of memory will be corrupted with
attacker-supplied values. In this manner it may be possible to control
execution flow and execute arbitrary code in the context of the client
user.
This issue was reported to affect Windows versions of the software. It is
not known if other platforms are similarly affected.
9. TelCondex SimpleWebserver Directory Traversal Vulnerability
BugTraq ID: 8998
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/8998
Summary:
TelCondex SimpleWebServer is a Web server designed for use with the
Microsoft Windows operating systems.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to access information outside the server root directory.
The problem exists due to insufficient sanitization of user-supplied data.
The issue may allow a remote attacker to traverse outside the server root
directory by using '.../' character sequences.
Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive information that may be used to launch further
attacks against a vulnerable system.
TelCondex SimpleWebserver version 2.13.31027 build 3289 is reported to be
prone to this issue, however other versions may be affected as well.
10. Epic CTCP Nickname Server Message Buffer Overrun Vulnerabili...
BugTraq ID: 8999
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/8999
Summary:
Epic is a freely available IRC client for Unix and Linux variants.
A remotely exploitable buffer overrun has been reported in Epic. This
issue may reportedly be exploited by a malicious server that supplies an
overly long nickname in a CTCP message. It may be also be possible for a
malicious client to send such a message, but it is likely that the server
will limit the length.
Reportedly if a nickname of over 512 bytes is supplied in such a message,
the client may attempt to call alloca() with a negative number, which
could potentially result in corruption of stack memory. In this manner,
it may be possible for a malicious IRC server to trigger this condition to
execute arbitrary code on the client system in the context of the client
user.
11. OnlineArts DailyDose dose.pl Remote Command Execution Vulner...
BugTraq ID: 9000
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9000
Summary:
DailyDose is an application used to generate random quotes. It is written
in perl and can be used without SSI.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to execute arbitrary commands on a vulnerable system.
The problem is reported to exist in the dose.pl script. It has been
reported that the $temp variable of dose.pl is not properly verified for
user-supplied input. An attacker may submit arbitrary commands that will
be executed in the context of the web server hosting the vulnerable
script.
Exploitation of this vulnerability may be dependent on configuration and
may differ across systems.
DailyDose v 1.1 has been reported to be prone to this issue however other
versions may be affected as well.
12. Bugzilla Javascript Buglists Remote Information Disclosure V...
BugTraq ID: 9001
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9001
Summary:
Bugzilla is a freely available, open source bug tracking system. It is
available for the Unix, Linux, and Microsoft Windows platforms.
A problem exists in the handling of buglists by Bugzilla when the lists
are implemented with Javascript. Because of this, a remote user may be
able to gain unauthorized access to sensitive information.
The problem is in the storage of information when placed in Javascript
arrays. It is possible for a remote user to create a buglink in their
page that correctly reflects information about a bug, including details
which may be restricted from the public due to sensitivity of information.
This may result in unauthorized disclosure of information.
This problem has also been reported to affect bookmarklets. The issue is
known to affect verion 2.7.15 only.
13. Winace UnAce Command Line Argument Buffer Overflow Vulnerabi...
BugTraq ID: 9002
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9002
Summary:
Winace is a file compression/decompression tool that was originally
developed for Microsoft Windows platforms. Winace was ported to Linux
platforms as UnAce.
UnAce has been reported to be prone to a buffer overflow vulnerability.
The issue presents itself when UnAce handles ace filenames that are
greater than 610 bytes in length including the ace file extension. When
this filename is passed to the UnAce utility as an argument for the 'e'
(extract command line switch), the string is copied into a reserved buffer
in memory. Data that exceeds the size of the reserved buffer will overflow
its bounds and will trample any saved data that is adjacent to the
affected buffer. Because variable that are crucial to controlling program
execution flow for UnAce are conjectured to be stored adjacent to the
affected buffer, an attacker may corrupt these values and influence UnAce
program execution flow into attacker controlled memory. Ultimately this
may lead to the execution of arbitrary instructions in the context of the
user who is running UnAce.
If UnAce is associated with a specific file type in for example an
Internet browser, clicking on a malicious ace filename may be sufficient
to result in the execution of arbitrary instructions on an affected host.
14. PureFTPd displayrate() Remote Denial of Service Vulnerabilit...
BugTraq ID: 9003
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9003
Summary:
PureFTPd is an FTP server based on Troll-FTPd and designed with a focus on
security. It is available for the BSD and Linux operating systems.
A denial of service vulnerability has been discovered in PureFTPd. The
problem occurs within the displayrate() function. When data returned from
the realpath() function is subsequently tested for a specific value, it
may be possible to trigger a procedure, which will ultimately cause
PureFTPd to crash.
Specifically, the realpath() function is passed two variables, name and
resolved_path. The resolved name is stored in resolved_path, which is then
tested for a zero byte as shown below:
if (resolved_path[sizeof_resolved_path - 1U] != 0)
If this condition is met, PureFTPd will enter an infinite for loop,
continuously writing a zero value to a pointer incremented each iteration.
This will ultimately result in an attempt to write to unpaged memory,
effectively triggering a segmentation violation and thus a denial of
service.
It should be noted that PureFTPd will typically fork a new process for
each new connection to the FTP service, specifically when running as a
standalone server, however it has not been confirmed whether this is
always the case.
If forking children is the only behavior under all configurations, this
condition may not have any implications beyond closing the session of a
malicious user. This BID will be updated, as further details regarding
this information are made available.
*** November 10, 2003 - The vendor has confirmed that the condition occurs
only within the individual session under which the condition occurs.
Furthermore, additonal details made available by the vendor state that
realpath() is designed in such a way that only a specific amount of data
can be filled. As such, the aforementioned test will always always fail.
As a result of this new information, this BID will subsequently be
retired.
15. nCube Server Manager Directory Traversal Vulnerability
BugTraq ID: 9004
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9004
Summary:
nCUBE Server Manager has been reported prone to a directory traversal
vulnerability. The issue presents itself likely due to a lack of
sufficient sanitization performed on user-supplied URI parameters. A
remote attacker may exploit this condition by supplying directory
traversal sequences as a value for the 'files' URI parameter passed to the
Server Manager 'nph-showlogs.pl' script. Ultimately this may allow the
attacker to break out of the webserver root and view arbitrary directory
listings and potentially arbitrary files on the vulnerable system.
An attacker may employ data harvested in this manner to aid in further
attacks launched against the target system.
It should be noted that although this issue has been reported to affect
nCUBE Server Manager version 1.0, other versions might also be affected.
16. Hylafax HFaxD Unspecified Format String Vulnerability
BugTraq ID: 9005
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9005
Summary:
Hylafax is a software package designed to handle the transmission of
Faxes.
Hylafax hfaxd (daemon) has been reported prone to an unspecified format
string vulnerability that may be exploited under non-standard
configurations to execute arbitrary instructions remotely as the root
user.
It has been conjectured that a remote attacker may design a string that
contains specially crafted format string specifiers, the attacker may then
transmit this string to the hfaxd server in a manner sufficient to trigger
the condition. The malicious format specifiers contained in this string
will be interpreted literally by the affected server; this may result in
arbitrary memory corruption and ultimately in the execution of arbitrary
attacker-supplied instructions in the context of the affected server.
This BID will be updated if and when explicit information regarding this
vulnerability is published.
17. Symbol Technologies PDT 8100 Default WEP Keys Configuration ...
BugTraq ID: 9006
Remote: No
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9006
Summary:
The PDT 8100 is a wireless access point solution distributed and
maintained by Symbol Technologies.
A problem has been identified in the default configuration of the Symbol
Technologies PDT 8100. Because of this, a local user may be able to gain
unauthorized access to network resources.
The problem is in the handling of WEP keys. When a PDT 8100 is configured
the party configuring the device is not prompted to change the default WEP
keys configuration. If this configuration is not changed, a user of the
device may access the WEP keys in plain text on the device.
The 8146-T2B940US model is known to be affected by this issue. Other
models may also be affected.
18. Microsoft FrontPage Server Extensions Remote Debug Buffer Ov...
BugTraq ID: 9007
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9007
Summary:
FrontPage Server Extensions are a component for FrontPage that allows
authorized users to edit and maintain content.
FrontPage Server Extensions includes remote debugging functionality,
allowing users to connect to the server to debug content using software
such as Visual Interdev. A remotely exploitable buffer overrun
vulnerability has been reported in the remote debugging functionality
provided by the software.
This issue is due to an unchecked buffer size in a .DLL (fp30reg.dll)
included with the extensions. It is possible to trigger this issue by
sending a malformed chunked-encoded HTTP POST request. This will allow
the attacker to influence the values in the ECX and EDI registers, which
may be leveraged to execute arbitrary code. Exploitation may allow a
remote attacker to execute arbitrary code on a vulnerable system with
Local System privileges.
19. Microsoft FrontPage Server Extensions SmartHTML Interpreter ...
BugTraq ID: 9008
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9008
Summary:
FrontPage Server Extensions are a component for FrontPage that allows
authorized users to edit and maintain content. FrontPage
FrontPage Server Extensions include the SmartHTML interpreter, which
allows web pages to access various FrontPage features. A denial of
service vulnerability has been reported in the SmartHTML interpreter that
may be exploited by remote attackers. It is possible to send an invalid
request that will cause the interpreter to cycle, denying availability of
CPU resources. In this manner, it is possible to cause a denial of
service by exhausting available resources on the system.
20. Microsoft Internet Explorer DHTML Drag and Drop Local File S...
BugTraq ID: 9009
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9009
Summary:
Microsoft has announced a vulnerability in Internet Explorer when handling
specific DHTML events. Specifically, the problem is said to occur due when
Internet Explorer handles Drag and Drop event. Following such a link is
said to allow an arbitrary file to be dropped (saved) to the users local
filesystem. The user will not be prompted in any way when this occurs.
Successful exploitation of this condition could ultimately allow an
attacker to trigger the execution of arbitrary code with the privileges of
the user. This could be possibly accomplished by dropping the malicious
executable into the systems startup directory, or other sensitive
locations on the system.
Microsoft has stated that dropping the executable to specific locations on
the system may trigger the immediate execution of the file.
This vulnerability can be exploited via a malicious web page or via
malicious HTML e-mail. Other applications that use the Internet Explorer
engine are affected as well (Outlook, MSN Messenger, etc.).
21. Microsoft Excel XLM Macro Security Level Bypass Vulnerabilit...
BugTraq ID: 9010
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9010
Summary:
Microsoft Excel contains a macro security feature. This feature scans a
document when a user opens it to determine if there are any embedded
macros. Then, depending on the security setting, the user is prompted
whether or not to allow the macro to run, or the macro is executed
automatically depending on user settings.
A vulnerability has been reported to affect Microsoft Excel that could be
exploited by an attacker to execute an XLM [Excel 4] macro regardless of
the macro security level. The issue has been reported to present itself
due to a failure by Excel to sufficiently scan a malicious spreadsheet
file before opening it. As a result of this failure an XLM macro embedded
in a malicious spreadsheet will be executed when the document is opened,
without Excel presenting a macro security warning and regardless of Excel
macro security settings. Macro code execution will occur in the context of
the user who is running the vulnerable version of Excel and could
ultimately allow an attacker to perform arbitrary scripted tasks with
administrative privileges.
22. Microsoft Windows Workstation Service Remote Buffer Overflow...
BugTraq ID: 9011
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9011
Summary:
A vulnerability in Microsoft Windows Workstation service has been
reported. Because of this issue, it may be possible for a remote attacker
to gain unauthorized access to a vulnerable host.
The problem is in the handling of requests by the Workstation Service
(WKSSVC.DLL). The Workstation Service is accessed by a remote system
through Remote Procedure Call (RPC). RPC is handled through services
listening on TCP and UDP ports 138, 139, and 445.
The Workstation Service does not properly check bounds on remote data.
Because of this, it is possible to overwrite sensitive regions of system
memory. The problem exists due to insufficient bounds checking in the
network management functions provided through the DCE/RPC service. Some
of these management events generate a logfile in the 'Debug' subdirectory
within the Windows installation folder. When log entries are created, the
logging function in 'WKSSVC.DLL' calls the 'vsprintf' routine without
performing bounds checking. Therefore, if an exceptionally long string is
provided as a parameter to an RPC function that writes it to the log file,
a stack-based buffer overflow will occur.
This issue could be exploited by a remote user to execute code with the
privileges of the Workstation Service, which is typically invoked with
SYSTEM privileges.
23. Microsoft Internet Explorer XML Object Zone Restriction Bypa...
BugTraq ID: 9012
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9012
Summary:
Microsoft has announced that a vulnerability exists in Internet Explorer
when handling malicious XML objects. This issue affects Microsoft Internet
Explorer 5.5 to 6.0.
The vulnerability is said to occur due to Internet Explorer failing to
validate the path to which an XML object is bound, making it possible to
access the contents of files outside of the current zone. As a result, it
may be possible for an attacker to expose the contents of a victim's local
file system, despite the object being within the Internet or Intranet
zone.
Microsoft has stated that, when a victim user visits a website containing
the malformed object, they will be prompted to download an HTML file. Only
when this file is downloaded will exploitation occur.
Successful exploitation of this issue could result in an attacker
disclosing sensitive information from a users system. This data could
possibly aid in launching future attacks against the user or systems to
which they have access.
This vulnerability can be exploited via a malicious web page or via
malicious HTML e-mail. Other applications that use the Internet Explorer
engine are affected as well (Outlook, MSN Messenger, etc.).
24. Microsoft Internet Explorer Script URL Cross-Domain Access V...
BugTraq ID: 9013
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9013
Summary:
An issue has been reported in Microsoft Internet Explorer that could allow
malicious script code from one domain to be executed in the context of
another domain.
The issue exists because the Script URL method is able to bypass
cross-domain security checks performed by Internet Explorer.
This vulnerability could allow a web page from one domain to access
information from another domain, including the local system.
Additionally, a remote attacker could run any executable file on the local
system, though this would require exploitation of multiple vulnerabilities
in tandem.
Further information has been made available stating that this issue was
discovered by Liu Die Yu and publicly known prior to the release of
MS03-048. This issue was originally described as one of the
vulnerabilities in BID 8577 "Multiple Microsoft Internet Explorer Script
Execution Vulnerabilities". This new information is currently under
investigation, this BID will be updated with specific technical details
when analysis is complete.
25. Microsoft Internet Explorer Function Pointer Override Cross-...
BugTraq ID: 9014
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9014
Summary:
An issue has been reported in Microsoft Internet Explorer that could allow
malicious script code from one domain to be executed in the context of
another domain.
The issue exists because the Function Pointer Override method is able to
bypass cross-domain security checks performed by Internet Explorer.
This vulnerability could allow a web page from one domain to access
information from another domain, including the local system.
Additionally, a remote attacker could run any executable file on the local
system, though this would require exploitation of multiple vulnerabilities
in tandem.
Further information has been made available stating that this issue was
discovered by Liu Die Yu and publicly known prior to the release of
MS03-048. This issue was originally described as one of the
vulnerabilities in BID 8577 "Multiple Microsoft Internet Explorer Script
Execution Vulnerabilities". This new information is currently under
investigation, this BID will be updated with specific technical details
when analysis is complete.
26. Microsoft Internet Explorer ExecCommand Cross-Domain Access ...
BugTraq ID: 9015
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9015
Summary:
An issue has been reported in Microsoft Internet Explorer that could allow
malicious script code from one domain to be executed in the context of
another domain.
The issue exists because the ExecCommand method is able to bypass
cross-domain security checks performed by Internet Explorer.
This vulnerability could allow a web page from one domain to access
information from another domain, including the local system.
Additionally, a remote attacker could run any executable file on the local
system, though this would require exploitation of multiple vulnerabilities
in tandem.
Further information has been made available stating that this issue was
discovered by Liu Die Yu and publicly known prior to the release of
MS03-048. This issue was originally described as one of the
vulnerabilities in BID 8577 "Multiple Microsoft Internet Explorer Script
Execution Vulnerabilities". This new information is currently under
investigation, this BID will be updated with specific technical details
when analysis is complete.
27. Omega-RPG Environment Variable Buffer Overrun Vulnerability
BugTraq ID: 9016
Remote: No
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9016
Summary:
omega-rpg is a game for Linux/Unix variants.
omega-rpg is prone to a locally exploitable buffer overrun. This is due
to insufficient bounds checking of environment variables, which will be
copied into an internal buffer. By supplying an environment variable of
excessive length, it is possible to corrupt memory with attacker-supplied
values, potentially allowing the attacker to control execution flow of the
program and execute arbitrary code. omega-rpg may be installed setgid,
which could allow for execution of arbitrary code in the context of group
'games' if this issue were successfully exploited.
28. Fujitsu tsworks Attachment Expansion Buffer Overflow Vulnera...
BugTraq ID: 9017
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9017
Summary:
Fujitsu tsworks is a Mail User Agent that supports SMTP and POP3 for
Windows operating systems.
tsworks is prone to a buffer overflow that could allow arbitrary code
execution.
When an e-mail attachment containing an unusually long string is expanded
using the tsworks 'Expand the Attachment' feature, an internal buffer may
be overrun. This could allow arbitrary code execution in the security
context of the e-mail client.
This vulnerability was reported to affect tsworks 3.0, however, earlier
versions may also be vulnerable.
29. PHP-Coolfile Unauthorized Administrative Access Vulnerabilit...
BugTraq ID: 9018
Remote: Yes
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9018
Summary:
PHP-Coolfile is a website manager application implemented in PHP. It
allows users to manage files on a website.
PHP-Coolfile allows unprivileged users to gain access to the
administrative username and software for the site.
This is due to a coding error in the way the action.php file evaluates
access permission. Because of this error, any user can use the 'edit'
action in action.php to view the contents of the config.php file which
contains the administrator username and password.
30. Opera Multiple MIME Type File Dropping Weakness
BugTraq ID: 9019
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9019
Summary:
Opera includes support for multiple MIME types used for configuration and
installation of browser skins that potentially could be abused by a
malicious web page to drop files onto a client system in a predictable
location. The following is a list of MIME types that may be abused in
this manner, and the location that files will be dropped (in a default
installation of the browser):
"application/x-opera-skin" - File is dropped into C:\Program
Files\Opera7\profile\Skin
"application/x-opera-configuration-skin" - File is dropped into C:\Program
Files\Opera7\profile\skin.
"application/x-opera-configuration-keyboard" - File is dropped into
C:\Program Files\Opera7\profile\keyboard.
"application/x-opera-configuration-mouse" - File is dropped into
C:\Program Files\Opera7\profile\mouse.
"application/x-opera-configuration-menu" - File is dropped into C:\Program
Files\Opera7\profile\menu.
"application/x-opera-configuration-toolbar - File is dropped into
C:\Program Files\Opera7\profile\toolbar.
Through exploitation of another reported vulnerability (BID 9021), further
attacks may result, such as execution of script code or information
disclosure.
31. Nokia IPSO Voyager HTTPDAccessLog.TCL Remote Script injectio...
BugTraq ID: 9020
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9020
Summary:
IPSO is the security hardware operating system maintained and developed by
Nokia.
It has been reported that Nokia IPSO httpdaccesslog.tcl script does not
properly handle some types of input from access logs. Because of this, an
attacker render HTML in the browser of an individual viewing the access
logs.
An attacker must have access to the Voyager interface to exploit this
issue, which by default requires authentication. By placing a request to
the Voyager interface that contains HTML in the request, the attacker may
inject code into the access log. When the access log is reviewed in the
Voyager interface through the httpdaccesslog.tcl script, the script does
not safely handle the contents of the access log. This may result in the
rendering of any code contained in the access log. This could allow for
theft of cookie-based authentication credentials or other attacks.
An attacker could use this vulnerability to perform unauthorized actions
in the Voyager interface. Any actions performed would be with the
privileges of the user reviewing the access logs.
32. Opera Web Browser Opera: URI Handler Directory Traversal Vul...
BugTraq ID: 9021
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9021
Summary:
Opera is a web browser available for a number of platforms, including
Microsoft Windows, Linux and Unix variants and Apple MacOS.
Opera uses an internal URI handler called 'Opera:' or 'about:' to display
help files and other documentation. Common uses for this command include
"opera:history", "opera:plugins", "opera:cache", and "opera:drives". A
vulnerability has been reported to exist in the software that may allow an
attacker to access information outside the intended directories for help
files and documentation. The problem exists due to insufficient
sanitization of user-supplied data through the 'Opera:' URI handler. The
issue may allow an attacker to traverse the client file system by using
'..%5c' or '..%2f' character sequences.
Successful exploitation of this vulnerability may allow an attacker to
gain access to sensitive information that may be used to launch further
attacks against a vulnerable system.
It has been reported that this issue may be exploited with another issue
described in BID 9019 to drop files onto a client system in a predictable
location and cause these files to be executed.
Opera Web Browser versions 7.21 and prior are reported to be prone to this
issue. This issue was reported to exist in Windows versions of the web
browser. It is not known if versions for other platforms are similarly
affected.
33. Microsoft Internet Explorer file.writeline Local File Writin...
BugTraq ID: 9022
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9022
Summary:
A problem has been reported in the handling of the file.writeline function
in Microsoft Internet Explorer. Because of this, it may be possible for
an attacker to write a file to a known location.
Reports indicate that under some circumstances, the Javascript
file.writeline method is not properly restricted by the browser. When the
method is invoked by a remote site, it is possible to write potentially
malicious HTML or script code into a file on the system. The file could
be written in a location that is predictable or known.
The attacker could take advantage of this issue to execute the file
containing attacker-supplied content through another bug that allows the
execution of the file on the local host. By doing so, the attacker could
potentially execute code on the local system with the privileges of the
user of the web browser.
This problem is known to affect Internet Explorer versions 5.0. It is not
currently known what other, if any, versions are also affected by this
issue.
34. Cerberus FTP Server Unspecified Buffer Overflow Vulnerabilit...
BugTraq ID: 9023
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9023
Summary:
Cerberus FTP Server is an FTP server designed to provide powerful,
multithreaded FTP server performance for a desktop user.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to execute arbitrary code on a vulnerable system in
order to gain unauthorized access. The condition is present due to
insufficient boundary checking.
An attacker may leverage the issue by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing an
affected procedure to return to an address of their choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the vulnerable software in order to gain
unauthorized access to a vulnerable system.
Cerberus version 2.11 BETA and prior may be vulnerable to this issue.
This BID will be updated as more information becomes available.
35. Multiple Vendor Bluetooth Device Unspecified Information Dis...
BugTraq ID: 9024
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9024
Summary:
Bluetooth is a wireless communication protocol which, amongst other
functions, is designed to allow interoperability between devices produced
by different vendors, such as a cellphone and headset.
Under certain configurations Bluetooth devices will allow an anonymous
user to establish a connection and carry out various actions. These modes
are typically called "discoverable" and "visible". It has been reported
that, even when the aforementioned modes have been disabled an anonymous
user may be capable of connecting to a Bluetooth device and accessing
sensitive information stored therein. This could allow an attacker to
expose phone book, calendar, and other sensitive information.
The precise technical details regarding this vulnerability have not yet
been made available. This BID will be updated as further information is
made available.
36. SCO UnixWare/Open UNIX Insecure Handling Of ProcFS Vulnerabi...
BugTraq ID: 9025
Remote: No
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9025
Summary:
procfs is a virtual file system, it is not associated with a block device
but rather exists in memory. The files in the procfs provide for access to
data from the kernel. 'as' contained in the procfs, is used to store the
current address space image of a running process. 'as' is by default
created with read/write access for the user who owns the running process.
There exists a protection facility in procfs to prevent access to certain
files in the procfs when setuid/setgid executables are run by an
unprivileged user. The 'as' file is one of the files that is protected in
this manner.
The SCO UnixWare/Open UNIX implementation of procfs has been reported
prone to a vulnerability that will allow a local attacker to bypass procfs
setuid/setgid 'as' file protection procedures. Specifically if the
attacker discovers the descriptor of an unprivileged process that he owns
and then invokes a setuid binary, by using a execve() system call within
that process, the setuid executable will be executed and the descriptor
will remain open allowing the attacker to gain read/write access to the
'as' file of a privileged process.
A local attacker may exploit this vulnerability to elevate privileges on a
vulnerable system.
37. Qualcomm Eudora Spoofed Attachment Line Denial Of Service Vu...
BugTraq ID: 9026
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9026
Summary:
Eudora is an e-mail client for Microsoft Windows and other operating
systems. It is maintained and distributed by Qualcomm.
A vulnerability has been reported by Qualcomm that may be exploited by a
remote attacker to cause the Eudora e-mail client to crash. The issue has
been reported to present itself within procedures employed by Eudora to
handle attachment converted lines. It has been reported that a malicious
email that contains a spoofed attachment converted line will trigger this
issue in a vulnerable release of Eudora when the malicious message is
viewed.
A remote attacker may exploit this issue to crash a remote users Eudora
client; this may result in a loss of data.
38. Spoofed Kernel Netlink Interface Message Denial of Service V...
BugTraq ID: 9027
Remote: No
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9027
Summary:
The Linux kernel includes the use of an optional netlink driver, which
when used creates the netlink device. This device can be used to allow a
channel between the kernel and userland applications for the transfer of
data and other information. This data can be transferred through the use
of netlink datagrams and messages.
The glibc getifaddrs() function is designed to store a linked list of the
local systems network interfaces.
GNU Zebra is an open source implementation of TCP/IP routing software. It
supports BGP-4, RIPv1, RIPv2 and OSPFv2 protocols. Quagga is a routing
software suite which was derived from GNU Zebra.
The Red Hat iproute package contains a variety of IP-based networking
utilities.
Applications which make use of the kernel netlink interface are said to be
prone to denial of service attacks.
It has been reported that applications implementing the use of the
getifaddrs() function may be prone to denial of service conditions. The
problem is said to occur due to the way spoofed netlink messages are
handled by the function. Due to this handling, it is said that a malformed
message transmitted to the process may in fact trigger a denial of
service.
The above condition is confirmed to occur on Red Hat 9 systems, however it
is not currently known if other operating systems or glibc versions are
directly affected.
Red Hat has stated that GNU Zebra, Quagga and iproute are also affected by
this vulnerability due to the way they interact with the netlink
interface; exploitation may result in a denial of service.
It is not currently known whether this condition is a problem within the
kernel netlink interface itself or if each application is implementing the
use of code which fails to properly handle specific netlink events. This
BID will be updated, as further information is made available.
39. Qualcomm Eudora Encrypted EMail Attachment/Image Storage Vul...
BugTraq ID: 9028
Remote: No
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9028
Summary:
Eudora is an e-mail client for Microsoft Windows and other operating
systems. It is maintained and distributed by Qualcomm.
Eudora has been reported to be prone to a vulnerability that presents
itself during email decryption procedures. Qualcomm has reported that when
an encrypted email is decrypted, images that are embedded in the body of
the email and attachments of the email are stored in a decrypted format on
the local hard drive. This vulnerability presents itself even if the user
explicitly chooses not to save the decrypted message text.
A local attacker who has sufficient access to read the saved images and
attachments may potentially reveal confidential data that was intended to
be obfuscated from third parties.
Information harvested in this manner could potentially be used to mount
further attacks against the victim.
40. GNU Zebra / Quagga Remote Denial of Service Vulnerability
BugTraq ID: 9029
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9029
Summary:
GNU Zebra is an open source implementation of TCP/IP routing software. It
supports BGP-4, RIPv1, RIPv2 and OSPFv2 protocols. Quagga is a routing
software suite which was derived from GNU Zebra.
A vulnerability has been reported to be present in the software that may
allow a remote attacker to a cause a denial of service condition in the
software. The issue is reported to occur if an attacker attempts to
connect to the Zebra or Quagga telnet management port while a password is
enabled.
The problem specifically occurs due to an invalid (typically NULL) pointer
dereference. This occurs because the vty layer fails to verify whether a
Telnet sub-negotation is currently in progress prior to handling an end
negotiation marker (SE). This will likely occur if the SE is received at
an unexpected time.
Successful exploitation of this issue may allow an attacker who passes a
malformed Telnet command to the server, to cause the software to behave in
an unstable manner leading to a crash or hang.
All versions of GNU Zebra are said to be vulnerable to this issue. All
versions of Quagga prior to 0.96.4 are also vulnerable.
41. Clam AntiVirus E-mail Address Logging Format String Vulnerab...
BugTraq ID: 9031
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9031
Summary:
Clam AntiVirus is an anti-virus product for Linux and Unix derived
operating systems.
Clam AntiVirus is prone to a format string vulnerability when logging
e-mail addresses. This is due to incorrect usage of the syslog() function
to log e-mail addresses. As a result, attackers may supply their own
format specifiers in e-mail addresses. Remote attackers may be required
to craft an e-mail that may generate a loggable event, such as including
an AV test string in the message, to exploit this issue.
This vulnerability may be exploited to overwrite arbitrary locations in
memory with attacker-supplied values, resulting in execution of arbitrary
code. Denial of service attacks are also possible. This will occur in the
context of the clamav user or root, depending on how the software is
invoked.
This issue only affects the clamav-milter component of versions later than
clamav-0.54, which include syslogging functionality.
42. Nokia Bluetooth Device Unauthorized Access Vulnerability
BugTraq ID: 9032
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9032
Summary:
Bluetooth is a wireless communication protocol, which, amongst other
functions, is designed to allow interoperability between devices produced
by different vendors, such as a cellphone and headset.
The Bluetooth protocol allows for certain devices to be 'paired'. When
this occurs, the two devices form a trust relationship, under which a
trusted device may access the contents of the other. Reportedly, in some
situations this may include the entire memory space of the trusting
device.
A vulnerability has been discovered in two Nokia Bluetooth devices that
could result in unauthorized access from a device that is no longer
trusted. The problem occurs due to the Nokia devices failing to fully
remove trust relationships previously established between devices. Even
when a specific device is no longer listed as a 'paired', it is said that
it may still in fact have trusted access to the vulnerable device.
As a result, a malicious user whose device at one point was 'paired' with
another, could potentially have trusted access without the victim user
knowing. This action would go unnoticed, unless the victim user was
physically monitoring the display on their device. Due to an attacker
potentially having access to the entire memory space of the affected
device, this could lead to the cloning of certain devices.
Attacks such as this may be used by an attacker attempting to steal
another persons identify or other malicious actions.
The Nokia 6310i and 7650 models are said to be affected, however it has
been conjectured that a large number of Bluetooth enabled implementations
may be vulnerable.
43. FortiGate Firewall Web Interface Cross-Site Scripting Vulner...
BugTraq ID: 9033
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9033
Summary:
FortiGate are a series of commercial firewall appliances which run an
embedded operating system entitled FortiOS.
Multiple cross-site scripting vulnerabilities have been reported in the
FortiGate Firewall web administrative interface. These issues could be
exploited by enticing an administrative user to follow a malicious link
that includes hostile HTML and script code as values for URI parameters
for various vulnerable interface components. If such a link is followed,
the hostile code may be rendered in the administrator's browser. This
would occur in the context of the interface, allowing attacker-supplied
code to access properties of pages within the interface. This could lead
to theft of cookie-based authentication credentials, which contain the
username and MD5 hash of the password, allowing for full compromise of the
firewall.
44. Multiple BEA WebLogic Server/Express Denial of Service and I...
BugTraq ID: 9034
Remote: Yes
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9034
Summary:
BEA Systems has released patches for multiple vulnerabilities in various
versions of BEA WebLogic Server and Express. The following issues were
reported:
Servers implementing the use of the Weblogic proxy plug-in may be prone to
denial of service attacks. The problem is said to occur when an invalid
URL is passed to the plug-in, possibly causing it to crash. If
successfully exploited this would cause any hosted websites to be
unreachable. This issue affects all WebLogic Server and Express 6.1, 7.0
and 8.1 releases.
On WebLogic servers making use of the T3S protocol, under some
circumstances an SSL request over T3 to a non-SSL port may incorrectly
cause a non-SSL session to be established. This may be unexpected
behaviour to the requesting user and may cause a user to incorrectly
believe that the session is in fact encrypted. This could ultimately lead
to the exposure of sensitive information believed to be encrypted. This
issue affects all WebLogic Server and Express 7.0, 7.0.0.1 and 8.1
releases.
When implementing the use of a foreign provider, the password field
(weblogic.management.configuration.ForeignJMSConnectionFactoryMBean) is
stored in plaintext within the console as well as within the local
config.xml file. This could result in a malicious local user revealing the
foreign provider password and possibly gaining unauthorized access. This
issue is said to only affected servers implementing foreign JMS connection
factories. This issue affects all WebLogic Server and Express 8.1
releases.
When malicious data is passed to the WebLogic Node Manager port, the
application may unexpectedly crash. It has been stated by BEA that this
condition may be triggered by using NMAP. This issue affects all WebLogic
Server and Express 6.1, 7.0, 7.0.0.1 and 8.1 releases.
By default, specific MBeanHome server configurations may allow an
anonymous remote user to access sensitive configuration information.
Access to this data could allow an attacker to map specific system
information that could aid in launching future attacks. This issue affects
all WebLogic Server and Express 6.1, 7.0 and 8.1 releases.
These issues will be separated into individual BIDs when further analysis
is completed.
45. PeopleSoft PeopleTools Gateway Administration Servlet Path D...
BugTraq ID: 9035
Remote: Yes
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9035
Summary:
PeopleSoft PeopleTools Gateway Administration servlet is prone to a path
disclosure vulnerability. The Gateway Administration servlet is used to
configure web-based handlers for PeopleSoft and takes a number of
arguments via a form. If an invalid value is supplied to the servlet via
the form, the path of server configuration files will be disclosed in the
resulting error output.
Exploitation of this issue could allow attackers to gain access to
sensitive information about the underlying file system of the host,
potentially allowing the attacker to enumerate the layout of the file
system. This type of information could be valuable when launching further
attacks.
46. PeopleTools PeopleSoft IScript Cross-Site Scripting Vulnerab...
BugTraq ID: 9036
Remote: Yes
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9036
Summary:
PeopleSoft PeopleTools IScript is reported to be prone to cross-site
scripting attacks. This could allow an attacker to embed hostile HTML and
script code into a malicious link, that could be rendered in the web
browser of a victim user if the link were visited. The vulnerability is
due to insufficient sanitization of data supplied via URI variables, which
will then be echoed back in dynamically generated web pages.
This vulnerability could be exploited to steal cookie-based authentication
credentials. Since the attacker can influence how the site will be
rendered to the user following the link, other attacks are also possible,
such as misrepresenting site content.
47. PeopleSoft PeopleBooks psdoccgi.exe Directory Traversal Vuln...
BugTraq ID: 9037
Remote: Yes
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9037
Summary:
PeopleSoft PeopleTools is a runtime architecture and integrated
development environment for PeopleSoft financial management software.
PeopleBooks a component of PeopleTools, provides a CGI based search
utility (psdoccgi.exe) as part of the default installation of the
software. This application accepts two arguments called 'headername' and
'footername' that allow the header and footer information to be returned
as part of the search results.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to access information outside the server root directory.
The problem exists due to insufficient sanitization of user-supplied data
to the 'headername' and 'footername' arguments. The issue may allow a
remote attacker to traverse outside the server root directory by passing
malicious strings through these arguments.
Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive information such as configuration files
containing authentication information that may be used to gain
unauthorized access and launch further attacks against a vulnerable
system.
PeopleTools versions 8.43 and prior have been reported to be prone to this
vulnerability.
48. PeopleSoft PeopleBooks psdoccgi.exe Denial of Service Vulner...
BugTraq ID: 9038
Remote: Yes
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9038
Summary:
PeopleSoft PeopleTools is a runtime architecture and integrated
development environment for PeopleSoft financial management software.
PeopleBooks a component of PeopleTools, provides a CGI based search
utility (psdoccgi.exe) as part of the default installation of the
software. This application accepts several arguments such as 'headername'
and 'footername'.
A vulnerability has been reported to be present in the software that may
allow a remote attacker to a cause a denial of service condition in the
software. The exact details of the issue are not available at the moment
however, it may occur due to insufficient sanitization of user-supplied
input provided via arguments accepted by the psdoccgi.exe script of the
software.
Successful exploitation of this issue may allow an attacker to cause the
software to behave in an unstable manner leading to a crash or hang.
PeopleTools versions 8.43 and prior have been reported to be prone to this
vulnerability.
49. WebWasher Classic Error Message Cross-Site Scripting Vulnera...
BugTraq ID: 9039
Remote: Yes
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9039
Summary:
WebWasher Classic is a free Internet filtering software.
A vulnerability has been reported to present in the software that may
allow a remote attacker to execute HTML or script code in a user's
browser.
It has been reported that the problem arises when the software returns an
error message to the user that may contain unsanitized data. This error
message may be generated by sending a HTTP GET request containing script
code to the proxy port (80 TCP) used by the software. The problem exists
due to insufficient sanitization of user-supplied data, therefore making
it possible for an attacker to a construct a malicious link containing
HTML or script code that may be rendered in a user's browser. The script
code would run in the context of the user running the vulnerable software.
The software must be running in server mode for this issue to be remotely
exploitable.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.
WebWasher Classic versions 3.3 Build 44 and 2.2.1 are reported to be prone
to this issue, however other versions may be affected as well.
50. OpenSSH PAM Conversation Memory Scrubbing Weakness
BugTraq ID: 9040
Remote: No
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9040
Summary:
OpenSSH is a freely available, open source implementation of the Secure
Shell protocol. It is available for the Unix, Linux, and Microsoft
platforms.
An issue has been reported in the OpenSSH implementation of PAM
conversation functions. Applications which use PAM modules for
authentication are required to include conversation routines to manage
communications between the application and the PAM module, providing a
means to prompt users for passwords or provide other functionality which
relies on PAM. When a remote user connects to an OpenSSH server and
prematurely cancels the connection through a function such as Control-C,
OpenSSH does not correctly respond. It has been reported that OpenSSH
ends the session with the pam_end() function rather than returning
PAM_CONV_ERR, which is the correct behavior according to the Linux-PAM
developer documentation. As a result, PAM will not handle the aborted
conversation correctly and subsequently fail to scrub memory. The direct
consequence is that sensitive information in memory is more likely to end
up in swap space or core dumps.
This problem may expose authentication credentials to recovery should an
attacker have sufficient privileges on the system to view core dumps or
system memory. This issue may also expose other vulnerabilities in PAM
modules due to unpredictable behavior that could potentially lead to
stability issues and the compromise of sensitive credentials, information,
or privileges.
51. PeopleSoft PeopleTools IClient Servlet Arbitrary Code Execut...
BugTraq ID: 9041
Remote: Yes
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9041
Summary:
PeopleSoft PeopleTools is a runtime architecture and integrated
development environment for PeopleSoft financial management software.
PeopleTools ships with an IClient servlet that is designed to handle core
functionality procedures on the PeopleSoft Webserver. Some of these
procedures include user-profile management, authentication controls and
session controls. In addition to these procedures the IClient servlet
provides for functionality that allows a third party to upload files that
are attached to a form post made to the IClient servlet. The uploaded
files are stored in the PeopleSoft Web root. As a method to prevent the
potential execution of these files, the uploaded files are stored by the
IClient servlet in a random named directory.
The PeopleTools IClient servlet has been reported prone to a vulnerability
that could allow a remote attacker to execute arbitrary code with the
privileges of the web server process. The issue presents itself due to
the weak methods used by the IClient servlet when it is generating random
directory names.
Specifically the procedure used to generate the random directory name is
seeded with the server time at the moment of execution, thus leading to a
folder name that is of insufficient entropy. A remote attacker who can
estimate the current system time on the vulnerable server may potentially
guess the folder name used to store the uploaded file. If successful the
attacker may invoke the file and have arbitrary code executed with the
privileges of the web server process.
It should be noted that the IClient servlet is installed and configured to
run in a default installation of the PeopleSoft Webserver.
52. HP-UX Partition Manager Unspecified Remote Vulnerability
BugTraq ID: 9042
Remote: Yes
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9042
Summary:
HP-UX is the UNIX Operating System distributed and maintained by HP.
A problem has been identified in the HP-UX partition manager (parmgr).
Due to a problem in the software, it is possible to remotely gain
sensitive information, and potentially unauthorized access.
The problem is in the checking of certificates against the Common
Information Model server (cimserver). Specific technical details
concerning this vulnerability have not been released by HP. This entry
will be further updated when more information is available.
53. Web Wiz Forums location HTML Injection Vulnerability
BugTraq ID: 9043
Remote: Yes
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9043
Summary:
Web Wiz Forums is a freely distributed web-based discussion forum
implemented in ASP.
A vulnerability has been reported in the software that may allow a remote
attacker to execute HTML and script code in a user's browser. The issue is
reported to be present in the 'location' field of register.asp scripts.
The problem exists due to insufficient sanitization of user-supplied
input. It may be possible for an attacker to include malicious HTML code
in one of the vulnerable fields. The injected code could then be
interpreted by the browser of a user visiting the vulnerable site. This
attack would occur in the security context of the affected site.
Successful exploitation of this issue may allow a remote attacker to steal
cookie-based authentication credentials. Other attacks are possible as
well.
Web Wiz Forums 7.01 has been reported to be vulnerable to this issue,
however other versions may be affected as well.
54. Symantec PCAnywhere Privilege Escalation Vulnerability
BugTraq ID: 9045
Remote: No
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9045
Summary:
Symantec pcAnywhere is a remote host control solution. pcAnywhere provides
for remote management and file transfer. pcAnywhere can be installed as a
service that listens for incoming connections from a remote administrator.
Local unprivileged users have the ability to exercise some levels of
interaction with the pcAnywhere service via the pcAnywhere icon that is
visible in the systray on a Windows system.
Symantec pcAnywhere has been reported prone to a vulnerability that will
allow a local unprivileged user to elevate privileges to those of the
SYSTEM user. The issue is likely related to the vulnerability in the
windows 'HWND HtmlHelp()' API function call, this issue is described
explicitly in BID 8884. It has been reported that a local user may invoke
pcAnywhere help from functionality provided by right-clicking the
pcAnywhere systray icon. Because pcAnywhere version 10 invokes
'winhlp32.exe' and version 11 invokes 'hh.exe' help executables with
SYSTEM privileges, a local attacker may use the help user interface to
execute an arbitrary executable with SYSTEM privileges.
Ultimately an attacker may exploit this condition to execute any arbitrary
executable that is accessible to the SYSTEM user.
It should be noted that this issue only exists when pcAnywhere is
configured to behave in service mode.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Garage door DMCA case dismissed
By: Kevin Poulsen
Judge rules that a universal remote doesn't violate the controversial
copyright law, in a closely-watched case that exposes insecurities in
"rolling code" garage door openers.
http://www.securityfocus.com/news/7461
2. Wireless hacking bust in Michigan
By: Kevin Poulsen
An FBI stake-out leads to the arrest of a young hacking duo working from
the parking lot of a Lowe's home improvement store.
http://www.securityfocus.com/news/7438
3. Ashcroft takes on foreign government hackers
By: Kevin Poulsen
New rules for FBI national security investigations officially classify
foreign probes of American computers a threat to national security.
http://www.securityfocus.com/news/7398
4. Bluetooth is attack vector for mobile phones
By: John Leyden, The Register
http://www.securityfocus.com/news/7466
5. Microsoft aims to 'shift the tide' in war on spam
By: John Leyden, The Register
http://www.securityfocus.com/news/7465
6. Phishing and viral tech combines in new menace
By: John Leyden, The Register
http://www.securityfocus.com/news/7457
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. SILC (Secure Internet Live Conferencing)(Toolkit) v0.9.11
By: Priikone
Relevant URL: http://silcnet.org/
Platforms: Linux, UNIX
Summary:
SILC (Secure Internet Live Conferencing) is a protocol which provides
secure conferencing services in the Internet over insecure channels. SILC
superficially resembles IRC, although they are very different internally.
The purpose of SILC is to provide secure conferencing services. Strong
cryptographic methods are used to secure all traffic. The SILC is
delivered as SILC Client for end users, SILC Server for system
administrators, and SILC Toolkit for application developers.
2. afick v1.4-0
By: Gerbier Eric
Relevant URL: http://afick.sourceforge.net/
Platforms: Os Independent
Summary:
afick is another file integrity checker, designed to be fast and fully
portable between Unix and Windows platforms. It works by first creating a
database that represents a snapshot of the most essential parts of your
computer system. You can then run the script to discover all modifications
made since the snapshot was taken (i.e. files added, changed, or removed).
The configuration syntax is very close to that of aide or tripwire, and a
graphical interface is provided.
3. GPGMail (v30) (10.3 (Panther)) v1.0
By: Stéphane Corthésy
Relevant URL:
http://www.sente.ch/software/GPGMail/English.lproj/GPGMail.html
Platforms: MacOS
Summary:
GPGMail is a bundle for MailViewer.app (on MacOS X Server) and Mail.app
(on MacOS X), providing a front-end to gpg for some operations. GPGMail
extends Apple's MailViewer/Mail application and allows you to read and
send PGP authenticated and/or encrypted messages. You can use PGP for
plain and MIME messages, following RFC 2015 guidelines. Source code is
available.
4. Figaro's Password Manager v0.58
By: John Conneely <[email protected]>
Relevant URL: http://fpm.sourceforge.net/
Platforms: N/A
Summary:
Figaro's Password Manager (FPM) is a GNOME application that allows you to
securely store your passwords, which are encrypted with the blowfish
algorithm. It allows you to copy passwords or usernames to the clipboard
or primary selection. If a password is for a Web site, FPM can keep track
of the URLs of your login screens and can automatically launch your
browser. You can also teach FPM to launch other applications. FPM can sort
your passwords into categories. Finally, it has a password generator that
can help you choose good passwords.
5. NuFW v0.5.3
By: regit
Relevant URL: http://www.nufw.org
Platforms: Linux, POSIX
Summary:
NuFW is a set of daemons providing filtering of packets at the user level.
On the client side, users have to run a client that sends authentication
packets to the gateway. On the server side, the gateway associates userids
to packets, thus enabling the possibility to filter packets on a user
basis. Furthermore, the server architecture is done to use external
authentication source such as an LDAP server.
6. OSIRIS v2.1.0
By: The Shmoo Group
Relevant URL: http://osiris.shmoo.com
Platforms: BSDI, FreeBSD, Linux, MacOS, OpenBSD, UNIX, Windows 2000,
Windows NT, Windows XP
Summary:
Osiris is a host integrity management system that can be used to monitor
changes to a network of hosts over time and report those changes back to
the administrator(s). Currently, this includes monitoring any changes to
the filesystems. Osiris takes periodic snapshots of the filesystem and
stores them in a database. These databases, as well as the
configurations and logs, are all stored on a central management host.
When changes are detected, Osiris will log these events to the system
log and optionally send email to an administrator. In addition to files,
Osiris has preliminary support for the monitoring of other system
information including user lists, file system details, kernel modules,
and network interface configurations (not included with in this beta
release).
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Sr. Software Engineer in Protland (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344610
2. Director of Technology / Principal Scientist in Sant... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344609
3. Security Sales - Penetration Testing, UK (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344608
4. Business Security Advisor vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344607
5. Technology & Security Risk Services-Attack & Penetra... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344606
6. Citrix Systems: Senior Security Developer / Analyst ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344605
7. Attack & Penetration Testing Manager, London (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344604
8. Major contract in Northern VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344603
9. Attack and Pen Engineer - Incident Response Support ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344602
10. Sr. SQA Engineer Linux/Networking/VPN experience a m... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344601
11. Security Consultant (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344600
12. SQA Engineer - Symantec in Redwood City - Linux/Netw... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344599
13. Audit (Security & IT) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344598
14. Application Security Consultant -- Seattle, WA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344597
15. position available - NL - evaluator IT Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344595
16. Product Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344594
17. Symantec - Director, OEM / On-line Security - Santa ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344326
18. Sr. SQA Engineer - Symantec - Santa Monica (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344325
19. NSA/DOD Information Assurance Opportunity Needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344324
20. Symantec - Systems Response - Santa Monica, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344323
21. Symantec - Development Manager - Santa Monica, CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344322
22. Symantec - Research Position (2) - Waltham and Santa... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344321
23. Entry level/very junior security position in Washing... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344320
24. Checkpoint / Nokia Upgrade Assistance (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344319
25. Ethical Hacker (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344318
26. Lead Performance Tester- Seattle, WA. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344317
27. Security Sales Engineers-SanFran, Boston, VA, Atlant... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344316
28. Senior Application Security Consultant #781JS - NY -... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344315
29. NY Channel Sales Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344313
30. Manager - BD/Technology Partnerships - Neoteris - Si... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344312
31. Intrusion detection/firewall developer - Bay Area, C... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344311
32. Candidate with a unique blend of IT, Pre Law & Busin... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344310
33. DC area pre-sales senior consultant (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344309
VI. INCIDENTS LIST SUMMARY
--------------------------
1. idgsearch.com and googleMS.dll (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344651
2. idsearch.com and GoogleMs.dll (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344650
3. Strange Port 0 Traffic (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344649
4. SQL Slammer doing the rounds again? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344488
5. [despammed] RE: SQL Slammer doing the rounds again? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344486
6. New PayPal Email Scam (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344392
7. client's TCP port 256 hammered by several hosts- sol... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344037
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. burneye, how i can defeat it? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344622
2. ms03-049 sp1a and sp0 now working. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344547
3. KDE 3.1 - Suse 8.2 - kdeglobals world writable (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344546
4. thttpd-2.24 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344480
5. Reversing Code Coverage Tool (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344459
6. ms03-049 exploit xp sp0 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344449
7. lame ms-ftp large file creation bug (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344294
8. New mac-10.3 vulnerable to a fork bomb (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344293
9. Re[2]: ms03-043 questions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344279
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Exchange question (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344582
2. New Microsoft Exchange Server Vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344581
3. Exchange question :VSMail mx4 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344570
4. Webcast: Microsoft Security VP talks about what Micr... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344569
5. AD structure for a school environment (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344472
6. Exchange SMTP Hole? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344469
7. Article Announcement: Proposed: a Bounty for Bugs (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344424
8. AW: EXCHANGE SMTP HOLE? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344420
9. Risks posed by a: drive with IE in kiosk mode (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344415
10. FTP server security. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344414
11. Win2003 RPC failure after Hotfix (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344413
12. Roll up of facts: FW: Exchange SMTP Hole? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344267
13. MS event logging (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344108
14. SecurityFocus Microsoft Newsletter #162 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344106
15. Allowing site redirection with URLScan (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344103
16. Article Announcememt: Reeducation Campaign (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344003
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Updating SSH (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/344468
2. "Boot time scripts should have an .sh extension" (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/344467
3. Disabling rpcbind/portmapper (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/344186
X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2003-11-10 to 2003-11-17.
XI. SPONSOR INFORMATION
-----------------------
Is your network vulnerable to worms like Blaster? Scan Your Network for
FREE for the 2003 SANS Top 20 Vulnerabilities.
http://www.securityfocus.com/sponsor/Qualys_sf-news_031117
Qualys FreeScan enables the enterprise to immediately identify the
prevalent and critical security vulnerabilities most likely to be
exploited on the network perimeter. With the largest vulnerability testing
database in the industry, QualysGuard enables you to assess, prioritize,
and remediate the vulnerabilities in heterogeneous networks of any size.
Our Web-based service provides you with the ability to run immediate
assessments without installation of hardware or software.
Click on the link below to scan your network perimeter.
http://www.securityfocus.com/sponsor/Qualys_sf-news_031117
------------------------------------------------------------------------