SecurityFocus Newsletter #224
John Boletta <[email protected]> Mon, 24 Nov 2003 14:44:17 -0700 (MST)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #224
------------------------------
This issue is sponsored by: NeoScale - Enterprise Storage Security that's
Simple, Reliable Secure.
Got Storage Security Risks? Consolidation, Continuity, Compliance
Connected, accessible and distributed storage can enable unauthorized
access to sensitive, trusted and regulated information. What are best
storage security practices? Discover how to alleviate exposures within
shared and managed storage, disaster recovery, vaulting, as well as
auditing and compliance processes. Obtain your FREE whitepaper from
NeoScale at http://www.securityfocus.com/sponsor/NeoScale_sf-news_031124
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Home User Security: Your First Defense
2. Oracle Row Level Security: Part 2
II. BUGTRAQ SUMMARY
1. PHPList Remote File Include Vulnerability
2. KDE 3.1 Global Configuration Files Insecure Default Permissi...
3. monopd Race Condition Denial of Service Vulnerability
4. Minimalist Unspecified Remote Command Execution Vulnerabilit...
5. SAP DB Privilege Escalation and Buffer Overrun Vulnerabiliti...
6. SAP DB web-tools Multiple Vulnerabilities
7. Symantec PCAnywhere Chat Client Privilege Escalation Vulnera...
8. phpWebFileManager index.php Directory Traversal Vulnerabilit...
9. Koch Roland Rolis Guestbook $path Remote File Include Vulner...
10. PostMaster Proxy Service Cross-Site Scripting Vulnerability
11. Justin Hagstrom Auto Directory Index Cross-Site Scripting Vu...
12. MediaWiki 'IP' Parameter Remote File Include Vulnerability
13. SqWebMail Session Hijacking Vulnerability
14. NetServe Web Server Directory Traversal Vulnerability
15. HP-UX IPFilter Unsupported Interface Vulnerability
16. OpenBSD IBCS2 Binary Length Parameter Kernel-Based Buffer Ov...
17. HP-UX CDE dtmailpr Display Environment Variable Buffer Overr...
18. HP-UX DCE Unspecified Remote Denial Of Service Vulnerability
19. Sun Cobalt RaQ550 Unspecified Information Disclosure Vulnera...
20. Apple Safari Web Browser Null Character Cookie Stealing Vuln...
21. PostgreSQL 7.4 Release To Fix Several Security Vulnerabiliti...
22. Apple MacOS X Terminal sudo command Unauthorized Access Vuln...
23. Valve Software Half-Life Dedicated Server Information Disclo...
24. Kerio WinRoute Firewall Authentication Credentials Exposure ...
25. Yak! Chat Client FTP Server Default Username Credential Weak...
26. OpenBSD sysctl Local Denial of Service Vulnerability
27. Apple Mac OS X Jaguar/Panther Multiple Vulnerabilities
28. phpFriendlyAdmin Unspecified Cross-Site Scripting Vulnerabil...
29. Sun Solaris PGX32 Libraries Unspecific Privilege Escalation ...
30. EffectOffice Server Remote Service Buffer Overflow Vulnerabi...
31. IBM AIX RCP Utility Local Buffer Overrun Vulnerability
32. FreeRADIUS Tag Field Heap Corruption Vulnerability
33. Sybase Adaptive Server Remote Password Array Heap Overflow V...
III. SECURITYFOCUS NEWS ARTICLES
1. Exploit Code on Trial
2. New charges in Lowe's wi-fi hacks
3. Court limits in-car FBI spying
4. Wi-Fi hacker caught downloading child porn
5. Check your sums, Debian advises developers after breach
6. Sentencing postponed in nuclear lab hack case
IV. SECURITYFOCUS TOP 6 TOOLS
1. Botan v1.3.4
2. GNU Simple Authentication and Security Layer (SASL) v0.0.9
3. SecureServ v1.0
4. dnsgraph 0.9 v0.9
5. pmacct v0.5.3
6. CryptoFS v0.2.1
V. SECURITYJOBS LIST SUMMARY
1. Who says all the best jobs are already taken? (Thread)
2. Windows Vulnerability Engineer Silicon Valley CA (Thread)
3. Los Angeles-Threat, Vulnerability, & IT Audit (Thread)
4. Security Product Development/Engineering Manager - S... (Thread)
5. Systems Engineer - Silicon Valley - Startup (Thread)
6. ERP (PeopleSoft) audit in LA (Thread)
7. Product Manager for NJ (Thread)
8. Systems Engineer - Los Angeles - Netscreen SAPG (Thread)
9. need HIPAA consultant in Boston (Thread)
10. Windows Vulnerability Engineer Silicon Valley CA (Thread)
11. Tampa - Sr. Security Pre Sales Engineer (Thread)
12. UK based experienced (3+ yrs) Pen Tester (Thread)
13. Threat & Vulnerability Assessment (Bay Area) (Thread)
14. Application Security Development Manager - Security ... (Thread)
15. Kirkland, WA - Security Pre Sales Manager (Thread)
16. San Francisco: Manager, Network Security Architectur... (Thread)
17. San Francisco: Network Security Manager (Thread)
18. Best Geographies - come on (Thread)
19. Security Consultant Opportunities (Thread)
20. Los Angeles: JD Edwards Security Implementation Spec... (Thread)
21. Looking for a position in the South Jersey/Philadelp... (Thread)
22. Los Angeles, and San Francisco: Network Security Sr.... (Thread)
23. Best Geographies (Thread)
24. Security Jobs (Thread)
25. Security Jobs (Thread)
26. CISSP in need (again) (Thread)
27. Security Consultant able to relocate ASAP (Thread)
28. Security Engineer in Southern California (Thread)
29. Senior Software Engineer Portland OR (Thread)
30. SECURITY CONSULTANT / EX BLACKHAT (NJ/NY) (Thread)
31. Enterprise Sales Executive Need/Chicago - Security S... (Thread)
32. National Account Manager (West Coast) (Thread)
33. New Article @SecurityFocus (Thread)
34. QA Management position at Vontu, Inc., in San Franci... (Thread)
35. Product Manager - Security Solutions (Thread)
36. Software development jobs at Vontu, Inc., in San Fra... (Thread)
37. Technology & Security Risk Services - Attack & Penet... (Thread)
38. BORED (Thread)
39. Senior Information Security Technical Engineer (Thread)
40. J2EE Security Architect Position (Thread)
VI. INCIDENTS LIST SUMMARY
1. Strange SNMP probes suddenly appearing (Thread)
2. Seen this: iareqdll.dll? (Thread)
3. UDP destination port 0 probes (Thread)
4. idsearch.com and GoogleMs.dll (Thread)
5. Strange Port 0 Traffic (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Can you exploit this XSS? (Thread)
2. openbsd 3.4 ps bug (Thread)
3. Linux Kernel <= 2.4.21 MXCSR Local DOS Exploitation (Thread)
4. GetPC code (was: Shellcode from ASCII) (Thread)
5. burneye, how i can defeat it? (Thread)
6. ms03-049 sp1a and sp0 now working. (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. TechNet Security Webcast Week (Thread)
2. iis - authenticate thru domain username/password (Thread)
3. Hiding MS SQL databases in Enterprise Manager (Thread)
4. IIS traffic (Thread)
5. Strange behaviour of MS SQL 2000 (Thread)
6. MS03-049 Scanner? (Thread)
7. MS03-049 Vulnerability (Thread)
8. SecurityFocus Microsoft Newsletter #163 (Thread)
IX. SUN FOCUS LIST SUMMARY
1. New SecurityFocus Article (Thread)
X. LINUX FOCUS LIST SUMMARY
1. Status of Debian compromise? (Thread)
2. New SecurityFocus article (Thread)
XI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Home User Security: Your First Defense
By Sarah Granger
This article focuses on protecting the home office through personal
firewall software, as well as general security measures that are often
overlooked by home users.
http://www.securityfocus.com/infocus/1746
2. Oracle Row Level Security: Part 2
By Pete Finnigan
This paper explores the row level security feature added to Oracle 8i and
above, and provides examples. One of the main uses of row level security
is to allow all of a company's data to be stored in one database for
different departments, or for a hosting company to store data for
different companies in one database. Part Two.
http://www.securityfocus.com/infocus/1744
II. BUGTRAQ SUMMARY
-------------------
1. PHPList Remote File Include Vulnerability
BugTraq ID: 9046
Remote: Yes
Date Published: Nov 14 2003
Relevant URL: http://www.securityfocus.com/bid/9046
Summary:
PHPlist is a newsletter application written in PHP.
A vulnerability has been reported to exist in the software that may allow
an attacker to include malicious files containing arbitrary code to be
executed on a vulnerable system. Remote attackers could potentially
exploit this issue to include a remote malicious PHP script, which will be
executed in the context of the web server hosting the vulnerable PHPlist
software.
PHPlist versions 2.6.2 and prior have been reported to be vulnerable to
this issue.
2. KDE 3.1 Global Configuration Files Insecure Default Permissi...
BugTraq ID: 9047
Remote: No
Date Published: Nov 14 2003
Relevant URL: http://www.securityfocus.com/bid/9047
Summary:
KDE is a graphical user interface (GUI) designed for the Linux operating
system. KDE implements the use of the QT graphical library.
The kdeglobals configuration file is referenced by KDE whenever a local
user attempts to invoke the interface. This file is used to define a
number of default directory and executable locations, as well as various
behavioral options.
It has been reported that this configuration file is stored with world
writeable permissions by default on SuSE 8.2 installations. The file is
stored in the /etc/opt/kde3/share/config directory, and due to it's
permissions may be modified by an arbitrary local user.
An attacker could take advantage of these permissions to place malicious
data within the configuration file, such as defining the location of
trojaned executable in place of legitimate ones. This new malformed data
will become part of the KDE environment when another system user invokes
KDE.
Ultimately this could be exploited to carry out actions with the
privileges of another use of KDE.
It should be noted that the following configuration files have also been
reported to be installed world writeable:
/etc/opt/kde3/share/config/kmailrc
/etc/opt/kde3/share/config/kioslaverc
/etc/opt/kde3/share/config/kdeglobals.SuSEconfig
The modification of these files could also potentially be used to gain
elevated privileges or carry out actions as another user.
Although unconfirmed, other versions of SuSE as well as other
distributions may also store these configuration files insecurely.
3. monopd Race Condition Denial of Service Vulnerability
BugTraq ID: 9048
Remote: Yes
Date Published: Nov 15 2003
Relevant URL: http://www.securityfocus.com/bid/9048
Summary:
monopd is a game server for Monopoly-like board games. It is designed for
use with Linux variant operating systems.
A race condition error in monopd has been reported that could cause a
denial of service.
If a user who is part of a running game were to send a specially crafted
message under specific conditions, monopd will fail. This may also cause
an excessive consumption of system and network resources.
4. Minimalist Unspecified Remote Command Execution Vulnerabilit...
BugTraq ID: 9049
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9049
Summary:
Minimalist is a mailing list manager available for Linux operating
systems.
It has been reported that Minimalist is vulnerable to an input validation
issue. User-supplied input is not properly sanitized, which could allow a
remote user to execute arbitrary commands on the system running the
vulnerable software. Commands would likely execute with the privileges of
Minimalist.
Specific details of this vulnerability are not currently known. This BID
will be updated if and when more details about this vulnerability become
available.
5. SAP DB Privilege Escalation and Buffer Overrun Vulnerabiliti...
BugTraq ID: 9050
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9050
Summary:
Multiple vulnerabilities have been reported in SAP DB. The following
issues were reported:
A local privilege escalation issue (CAN-2003-0938) exists in SAP DB on
Windows platforms that may allow an attacker to load a malicious .DLL,
resulting in execution of arbitrary code with elevated privileges. If a
local attacker has write permissions to the current working directory for
SAP DB, which is the case in default installations of the database, it is
possible to replace 'NETAPI32.DLL' with a malicious version. When the
attacker-supplied library is loaded, code will be executed with elevated
privileges. It is also reported that this issue may be exploited with the
'SQLAT' stored procedure included in SAP DB.
A buffer overrun (CAN-2003-0939) exists in SAP DB for multiple platforms
(Windows, Linux, HP-UX and Solaris). The issue is present in the
'niserver' (on Unix-based systems) and 'serv.exe' (on Windows) and may
allow for remote attackers to execute code on a vulnerable host, resulting
in full system compromise. In particular, the problem is due to
insufficient bounds checking while extracting strings from the
variable-sized segment of the connect packet. As a result, it is possible
to corrupt adjacent regions of memory with attacker-supplied values,
allowing for control of program execution flow and execution of malicious
instructions. The vulnerable service listens on TCP port 7269. (** It
should be noted that the @stake advisory reported an erroneous port number
for the service, the correct port number is 7269)
These issues are pending further analysis and will be divided into
individual BIDs when analysis is complete.
6. SAP DB web-tools Multiple Vulnerabilities
BugTraq ID: 9051
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9051
Summary:
SAP DB is a free open source database server from SAP AG. The product
also ships with a 'web-tools' component that may be integrated with an
existing web server or run with its own web server.
SAP DB has been prone to multiple vulnerabilities in the web server
provided with the software. These issues may cumulatively allow an
attacker to gain access to sensitive information, bypass user and
administrative level authentication, and execute arbitrary code on a
vulnerable host in order to gain unauthorized access.
A directory traversal issue (CAN-2003-0940) has been reported to exist in
the 'web-tools' component. The issue may allow a remote attacker to
traverse outside the server root directory by using '../' character
sequences. The problem exists due to insufficient sanitization of
user-supplied data through a URI. It has been reported that the SAP web
servers runs in Local SYSTEM context by default on Windows NT/2000/XP
Platforms which may allow an attacker to retrieve all files from a
vulnerable host.
Another issue (CAN-2003-0941) is reported to be present in the web
administration page of web-tools that may allow an attacker to gain
administrative access to a system without proper authentication. The
problem occurs when a user with access to web-tools request a URL such as
'http://www.example.com/waadmin.wa'. The software does not verify
authentication credentials allowing a user to access and modify
configuration of different services.
A buffer overflow vulnerability (CAN-2003-0942) has been reported to exist
in the web administration component of web-tools due to insufficient
bounds checking. This issue occurs when a URL of excessive length is
requested. This issue may allow an attacker to execute arbitrary code on
a system. This issue may allow an attacker to execute arbitrary code on a
system, resulting in full system compromise.
The 'waecho' service of web-tools is also reported to be prone to a buffer
overflow vulnerability (CAN-2003-0944) due to insufficient bounds
checking. This service is installed as part of the default installation.
The issue occurs if an attacker supplies a large number of characters to
the 'requestURI' parameter of a URI request to the service. This issue
may allow an attacker to execute arbitrary code on a system, resulting in
full system compromise.
It has been reported that the 'websql' and 'webdbm' default services may
allow an attacker to gain unauthorized access to a database which are not
intended to be publicly accessible via web applications. CAN-2003-0943
has been assigned to the default services issues.
Web Database Manager has been reported to a weakness (CAN-2003-0945) due
to a improper generation of sessions IDs. It has been reported that
sessions IDs are stored in the URL and may not be randomly generated
therefore allowing an attacker to gain unauthorized access to sessions.
These issues are currently undergoing further analysis. Where appropriate,
individual BIDs will be created to represent new issues and existing BIDs
will be updated for previously known issues.
7. Symantec PCAnywhere Chat Client Privilege Escalation Vulnera...
BugTraq ID: 9052
Remote: No
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9052
Summary:
Symantec pcAnywhere is a remote host control solution. pcAnywhere
provides for remote management and file transfer. pcAnywhere can be
installed as a service that listens for incoming connections from a remote
administrator.
Symantec pcAnywhere has been reported prone to a locally exploitable
vulnerability when it has been configured to run in service mode. It has
been reported that a local user or a user who has been granted interactive
access to a system via pcAnywhere, may exploit this issue to elevate
privileges to that of the SYSTEM user. The issue presents itself because
a chat session that contains exploitable functionality may be spawned from
the 'AWHOST32' process. The 'AWHOST32' process runs with SYSTEM
privileges by default. By using 'save' functionality of the chat
interface, an attacker may invoke any other program in the context of the
'AWHOST32' process.
It should be noted that this vulnerability affects Symantec pcAnywhere
version 9.01 and 9.2 (which are unsupported). pcAnywhere 10.x is also
affected.
8. phpWebFileManager index.php Directory Traversal Vulnerabilit...
BugTraq ID: 9053
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9053
Summary:
phpWebFileManager is file management tool written in PHP. It is designed
for inclusion in large projects it can also act as a PostNuke module.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to access information outside the server root directory.
The problem exists due to insufficient sanitization of user-supplied data
through a URI parameter named 'f'. The issue may allow a remote attacker
to traverse outside the server root directory by using '../' character
sequences.
Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive information that may be used to launch further
attacks against a vulnerable system.
phpWebFileManager version 2.0.0 is reported to be prone to this issue,
however other versions may be affected as well.
9. Koch Roland Rolis Guestbook $path Remote File Include Vulner...
BugTraq ID: 9054
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9054
Summary:
Rolis Guestbook is a web based guestbook application.
A vulnerability has been reported to exist in the software that may allow
an attacker to include malicious files containing arbitrary code to be
executed on a vulnerable system. The issue exists due to improper
validation of $path variable. Remote attackers could potentially exploit
this issue via the $path variable to include a remote malicious script,
which will be executed in the context of the web server hosting the
vulnerable software.
Rolis Guestbook version 1.0 has been reported to be prone to this issue,
however other versions may be affected as well.
10. PostMaster Proxy Service Cross-Site Scripting Vulnerability
BugTraq ID: 9055
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9055
Summary:
PostMaster is a combined email and proxy server developed for Windows
platforms.
PostMaster has been reported prone to a cross-site scripting
vulnerability. The issue presents itself due to a lack of sufficient
sanitization that is performed by the proxy service on user-supplied data.
An attacker may construct a malicious HTTP request link that contains
embedded HTML and script code. When this request is handled by the proxy
service, the malicious HTML and script code contained in the request will
be incorporated into an error page and in turn will be rendered in the
browser of a user who follows the link. Script code execution will occur
in the context of the vulnerable PostMaster proxy service.
An attacker may exploit this issue to steal cookie based authentication
credentials; other attacks are also likely possible.
11. Justin Hagstrom Auto Directory Index Cross-Site Scripting Vu...
BugTraq ID: 9056
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9056
Summary:
Auto Directory Index is a web based application used to browser folders on
a web site. It is written in PHP.
A cross-site scripting vulnerability has been reported in the software.
The problem is reported to exist due to improper handling of user-supplied
data through the 'dir' parameter. This data will then be included in a
dynamically generated web page. This vulnerability makes it possible for
an attacker to a construct a malicious link containing HTML or script code
that may be rendered in a user's browser upon visiting that link. This
attack would occur in the security context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Other attacks are also possible
such as manipulating site content.
Auto Directory Index version 1.2.3 is reported to be prone to this issue,
however other versions may be affected as well.
12. MediaWiki 'IP' Parameter Remote File Include Vulnerability
BugTraq ID: 9057
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9057
Summary:
MediaWiki is editing software designed to run Wikipedia.
A new version of MediaWiki has been released, addressing a vulnerability
that may allow a remote attacker to execute arbitrary code. The problem
occurs due to insufficient input validation carried out on the
user-supplied 'IP' URI parameter. This issue is present within the
UpdateClasses.php, Title.php, Setup.php, GlobalFunctions.php, and
DatabaseFunctions.php script files.
As a result, an attacker may be capable of causing a malicious PHP header
file to be interpreted by a target system. Depending on the payload, this
could potentially allow an attacker to gain unauthorized remote access to
a vulnerable system.
13. SqWebMail Session Hijacking Vulnerability
BugTraq ID: 9058
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9058
Summary:
SqWebMail is a web-based e-mail application.
SqWebMail is prone to a vulnerability that may allow remote attackers to
hijack webmail sessions. This vulnerability occurs if the victim user
follows a malicious link provided by an attacker via an e-mail that is
viewed from the webmail system. This will permit an attacker to gain
unauthorized access to the user's session ID, which may be then used to
hijack the user's session, if it hasn't timed out. It should be noted
that the session will time out after approximately 20-30 minutes. The
source of the problem is likely that the session ID is being sent in the
HTTP REFERER to the malicious website when a link is visited from within
an e-mail, though this has not been confirmed.
SqWebMail is included in the Courier mail server, but is also available as
a stand-alone CGI application.
14. NetServe Web Server Directory Traversal Vulnerability
BugTraq ID: 9059
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9059
Summary:
NetServe Web Server is a compact web server for Microsoft Windows
platforms.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to access information outside the server root directory.
The problem exists due to insufficient sanitization of user-supplied data.
The issue may allow a remote attacker to traverse outside the server root
directory by using '../' character sequences. It has been reported that
this issue could be exploited to gain access to configuration files and
harvest administrator login and password information.
Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive information that may be used to launch further
attacks against a vulnerable system.
NetServe Web Server version 1.0.7 is reported to be prone to this issue,
however other versions may be affected as well.
15. HP-UX IPFilter Unsupported Interface Vulnerability
BugTraq ID: 9060
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9060
Summary:
HP-UX IPFilter is a stateful firewall system. IPFilter is designed to
filter IP packets and thereby control packet flow in or out of a protected
system.
Hewlett-Packard has reported that IPFilter does not provide protection for
unsupported network interfaces. This issue may lead a network
administrator into a false sense of security; a situation of this type may
arise when it is believed that an unsupported interface is sufficiently
protected by IPFilter. In reality the interface is not being protected at
all.
16. OpenBSD IBCS2 Binary Length Parameter Kernel-Based Buffer Ov...
BugTraq ID: 9061
Remote: No
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9061
Summary:
iBCS2 (Intel Binary Compatibility Specification 2) is a binary
compatibility format design commonly used by SCO and ISC binaries. The
iBCS2 kernel code is used to handle a variety of binaries, including the
COFF format. The COFF file header includes a number of fields including
the 's_scnptr' and 's_size' values, which are respectively a pointer to
section data and the size of that data.
A vulnerability has been discovered in the OpenBSD kernel code designed to
invoke iBCS2 binaries. The problem occurs within the ibcs2_exec.c source
file, specifically when reading in COFF section data.
The problem occurs during a call to the vn_rdwr() function, which copies
section data pointed to by 's_scnptr' into the 128 byte 'buf' array. The
problem lies in the fact that the 's_size' value, specified in the binary
is used as the size argument to the vn_rdwr() function call. Because no
sanity checks are carried out on this size value, data greater then that
of 'buf' may be copied into memory.
On OpenBSD 2.x-3.3 systems, it is possible to exploit this condition to
manipulate kernel control structures which can be leveraged to escalate
local privileges. However, it is said that exploitation of this condition
will cause a kernel panic on OpenBSD 3.4 systems. Although unconfirmed,
this may be due to the various memory protection schemes deployed in the
release of OpenBSD 3.4.
17. HP-UX CDE dtmailpr Display Environment Variable Buffer Overr...
BugTraq ID: 9062
Remote: No
Date Published: Nov 18 2003
Relevant URL: http://www.securityfocus.com/bid/9062
Summary:
HP-UX is a UNIX Operating System variant distributed and maintained by HP.
It has been reported by HP that an issue in the dtmailpr distributed with
HP-UX contains a buffer overrun vulnerability in a function called by the
program that could be exploited by an attacker. This issue is due to
insufficient bounds checking of the DISPLAY environment variable, which
could allow for corruption of process memory with attacker-supplied
values. In this manner it may be possible to control execution flow of
the program, causing attacker-supplied instructions to be executed.
Due to the fact that dtmailpr is installed as a setuid application in a
default implementation, this could result in unauthorized privilege gain.
It is not known if this issue affects dtmailpr on other platforms.
18. HP-UX DCE Unspecified Remote Denial Of Service Vulnerability
BugTraq ID: 9063
Remote: Yes
Date Published: Nov 18 2003
Relevant URL: http://www.securityfocus.com/bid/9063
Summary:
HP-UX is a UNIX Operating System variant distributed and maintained by HP.
A problem has been identified in the Distributed Computing Environment
(DCE) that may allow attackers to deny service to legitimate users.
It has been reported by HP that an issue in the Distributed Computing
Environment implementation distributed with HP-UX contains a
vulnerability. Specific information about this vulnerability is not
currently available, however, it is known that this issue may be taken
advantage of to allow a remote user to deny service to legitimate users of
DCE services.
Though information to make a conclusive relation is not available, it is
conjectured that this issue may be related to the recently reported issues
in other DCE implementations, such as that in Bugtraq ID 8371.
19. Sun Cobalt RaQ550 Unspecified Information Disclosure Vulnera...
BugTraq ID: 9064
Remote: No
Date Published: Nov 18 2003
Relevant URL: http://www.securityfocus.com/bid/9064
Summary:
Sun Cobalt RaQ550 is a server appliance from Sun.
A vulnerability has been reported to exist in the software that may allow
an attacker to gain access to potentially sensitive information. The
problem is reported to present itself in the user interface of the server
where a user may access sensitive information without proper validation of
privileges.
Although unconfirmed, successful exploitation of this issue may disclose
sensitive information about the system to an attacker that may be used to
mount further attacks.
Due to a lack of information, further details about this issue are not
available at the moment. This BID will be updated as more information
becomes available.
20. Apple Safari Web Browser Null Character Cookie Stealing Vuln...
BugTraq ID: 9065
Remote: Yes
Date Published: Nov 18 2003
Relevant URL: http://www.securityfocus.com/bid/9065
Summary:
Apple Safari 1.1 is a web browser application available exclusively for
the Mac OS Panther release.
An issue has been discovered in Apple Safari 1.1 which may allow an
attacker to steal cookie-based authentication credentials from a user of a
vulnerable web browser. The problem is in the handling of NULL (%00)
characters in URLs.
It is possible for an attacker to read cookie-based authentication
credentials that are stored on a web user's system for any domain. The
attacker simply creates a malicious link that contains the hostname of a
server under their control, followed by a NULL character, followed by the
domain the attacker wishes to steal cookies from.
Following the malicious link causes the victim web user to connect to the
hostname specified in the first part of the link. The malicious server can
then access cookies set for the domain that was placed in the URL after
the NULL byte.
This issue may only be exploited to steal cookies set for a domain, as
opposed to cookies set for a specific host in that domain. Cookies set
with the secure flag can be stolen if the attacker uses SSL.
It has been reported that this vulnerability may be exploited even if
cookies are disabled.
This vulnerability is said to affected Apple Safari 1.0 v88 through 1.1
v100.1.
21. PostgreSQL 7.4 Release To Fix Several Security Vulnerabiliti...
BugTraq ID: 9066
Remote: Yes
Date Published: Nov 18 2003
Relevant URL: http://www.securityfocus.com/bid/9066
Summary:
PostgreSQL is a freely distributed Object-Relational DBMS. It is
available for a number of platforms including Unix and Linux variants and
Microsoft Windows operating systems.
The PostgreSQL development group has reported the release of PostgreSQL
version 7.4. This release contains feature and security enhancements.
The release also contains fixes for several potential security
vulnerabilities. Issues fixed in this release include a contributed fix
for a condition where an ampersand character in an XML document could
trigger a violation in the PostgreSQL server and cause it to crash. This
issue may be exploited to deny service to legitimate PostgreSQL users.
Additionally, a fix has been implemented that is designed to address a
condition where users without sufficient privileges may potentially
disable server log variables/logging that were added or enabled by the
administrator. An attacker may potentially exploit this condition to hide
malicious activity.
This BID will be updated as further details regarding these
vulnerabilities are disclosed.
22. Apple MacOS X Terminal sudo command Unauthorized Access Vuln...
BugTraq ID: 9069
Remote: No
Date Published: Nov 19 2003
Relevant URL: http://www.securityfocus.com/bid/9069
Summary:
Apple's MacOS X operating system includes the Terminal application, which
is a GUI-based Unix command shell.
A vulnerability has been reported to exist in the software that may allow
an attacker to gain unauthorized access to the system. The problem is
reported to exist in the sudo command implemented by the Terminal
application. It has been reported that sudo command will wait for five
minutes after a password is entered before prompting for the password
again. The issue is reported to present itself when an Apple laptop has
been put to sleep after issue a sudo command. The sudo program uses the
Terminal application clock instead of the internal system clock. After
the system is awakened, it takes approximately 10 to 20 seconds for the
system to update the clock in the Terminal interface, therefore giving a
physical attacker a window of opportunity to gain unauthorized access to
the system.
This issue has been tested on laptops running Apple OS X 10.2.3 Jaguar, OS
X 10.2.7 Jaguar, and OS X 10.3 Panther, however other versions may be
affected as well.
23. Valve Software Half-Life Dedicated Server Information Disclo...
BugTraq ID: 9070
Remote: Yes
Date Published: Nov 19 2003
Relevant URL: http://www.securityfocus.com/bid/9070
Summary:
Half-Life is a game distributed and maintained by Valve Software. It
includes a dedicated game server component that allows multiple users to
game across a network. The game engine is used in many modifications.
Half-Life dedicated server has been reported prone to an information
disclosure vulnerability. This issue may also be exploited to deny service
to legitimate users of the Half-Life dedicated server.
The issue presents itself due to a flaw in download functionality that is
provided by the Half-Life dedicated server. Normally this type of
functionality would be employed by the server to push new game 'maps' out
to gamers who connect to a server. It has been reported however, that a
malicious attacker may exploit this functionality to download any file
from the root folder of the current running game type, or from the valve
folder. This may enable an attacker to download and disclose server
configuration files or other files stored in an accessible folder that may
contain potentially sensitive information.
Additionally it has been reported that an attacker may download any large
file to trigger a violation in the vulnerable servercausing it to crash,
this may effectively deny service to legitimate users.
It should be noted that 'allowdownload' must be enabled in the Half-Life
dedicated server configuration files for this issue to exist. This issue
has been reported to affect all versions of the Half-Life dedicated
server.
24. Kerio WinRoute Firewall Authentication Credentials Exposure ...
BugTraq ID: 9071
Remote: Yes
Date Published: Nov 19 2003
Relevant URL: http://www.securityfocus.com/bid/9071
Summary:
Kerio WinRoute Firewall is an enterprise level firewall that is also
capable of proxying networks. It is available for the Microsoft Windows
operating system.
If the WinRoute software has been configured as a proxy and authentication
has been enabled, each time a web request is made from an internal host
the client browser will include the Proxy-Connection HTTP header field.
This value of this field will contain a Base64 encoded username and
password, allowing the users request to be transmitted to the intended
host.
A vulnerability has been discovered in WinRoute when acting as an
authenticating proxy that could result in the exposure of authentication
credentials. The problem lies in the fact that the software fails to
sufficiently rebuild HTTP requests containing Proxy-Connection fields. The
application simply replaces the first character of the field (P) with an
X, and forwards the request to its intended destination. Because this
field contains the aforementioned encoded credentials, a malicious web
site administrator may be capable of parsing incoming HTTP requests for
"Xroxy-Connection" and harvesting users proxy authentication credentials.
Access to these credentials could allow an attacker to carry out some form
of attack on the proxy or possibly use the proxy as a means to hide the
origin of attacks against unrelated hosts.
It should be noted that the exposure of user credentials is exaggerated by
the fact that users are often known to use identical authentication
credentials across varying services.
This vulnerability is reported to affected Kerio WinRoute Firewall 5.10,
however other versions may also be affected.
25. Yak! Chat Client FTP Server Default Username Credential Weak...
BugTraq ID: 9072
Remote: Yes
Date Published: Nov 19 2003
Relevant URL: http://www.securityfocus.com/bid/9072
Summary:
Yak! is a commercially-available chat client distributed by Digicraft
Software. It is available for the Microsoft Windows platform.
It has been reported that a weakness exists in the Yak! client FTP server.
This problem may increase the chances of an attacker gaining unauthorized
access to resources.
The problem is in the default username credential created with the Yak!
FTP server. When the FTP server is installed, it installs a user
'y049575046' with a potentially predictable password string by default.
This user is granted full access to the file system on which the FTP
server resides. The FTP server listens on port 3535.
26. OpenBSD sysctl Local Denial of Service Vulnerability
BugTraq ID: 9073
Remote: No
Date Published: Nov 19 2003
Relevant URL: http://www.securityfocus.com/bid/9073
Summary:
Sysctl is used to set and retrieve the state of the kernel.
A denial of service vulnerability has been reported for OpenBSD,
specifically when handling malformed calls to sysctl. By invoking systcl
and including a malformed 'old' parameter it is said to be possible to
trigger a kernel panic. This could be exploited by a malicious
unprivileged local user to crash a target system.
New information suggests that the condition occurs within the
uvm_vsunlock() function, which is called via sysctl. The problem appears
to occur when calling the trunc_page() function on the invalid pointer.
This new information also suggested that the CTL_KERN flag may not
explicitly be required to trigger the condition, however this has not yet
been confirmed.
The precise technical details regarding this vulnerability are currently
unknown. This BID will be updated as further information is made
available.
27. Apple Mac OS X Jaguar/Panther Multiple Vulnerabilities
BugTraq ID: 9074
Remote: Yes
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9074
Summary:
Apple has released APPLE-SA-2003-11-19 which includes security updates to
address several known vulnerabilities in components included in Jaguar and
Panther releases of Mac OS X.
An update was released for Mac OS X 10.2.8 to address the following
vulnerabilities:
A format string vulnerability (CAN-2001-1411) in the gm4 utility could
potentially allow for arbitrary code execution with elevated privileges.
While no known setuid/setgid utilities are known to use gm4, this update
is intended as a preventative measure against potential attacks that could
result from this issue. This issue is also mentioned in BID 8917, which
reflects multiple vulnerabilities that were patched in Panther. This
update addresses the issue in Jaguar.
A format string vulnerability in the groff component pic could potentially
be exploited to execute arbitrary code.
An issue (CAN-2003-0881) has been reported to exist in the Mac OS X Mail
application. This issue presents itself when an account is configured to
use MD5 Challenge Response. If an attempt to login fails the program
switches to plain text passwords. This issue is also mentioned in BID
8917, which reflects multiple vulnerabilities that were patched in
Panther. This update addresses the issue in Jaguar.
A vulnerability (CAN-2003-0107) in zlib was addressed. This issue is a
buffer overrun in the gzprinft() function, which is described in further
detail in BID 6913. It is reported that no Mac OS X applications used the
vulnerable function, but it is possible that third-party applications may,
constituting a potentially exploitable vulnerability.
A vulnerability (CAN-2003-0878) is reported to exist when Personal File
Sharing is enabled that may allow an attacker to gain elevated privileges.
This issue occurs because the slpd daemon may create a file owned by root
in the tmp directory. This could overwrite an existing file resulting in
elevated privileges. This issue is also mentioned in BID 8917, which
reflects multiple vulnerabilities that were patched in Panther. This
update addresses the issue in Jaguar.
An unspecified vulnerability in QuickTime for Java was also addressed.
This issue is described in BID 8922.
The following updates were also released for Mac OS X 10.3.1:
Fixes were included for the aforementioned zlib vulnerability.
A denial of service vulnerability in OpenSSL (CAN-2003-0851) was fixed.
This is related to ASN.1 parsing and is described in further detail in BID
8970.
The appropriate BIDs for these vulnerabilities will be updated when
further analysis of these issues is complete. Where it is required, new
BIDs will be created for individual vulnerabilities.
28. phpFriendlyAdmin Unspecified Cross-Site Scripting Vulnerabil...
BugTraq ID: 9075
Remote: Yes
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9075
Summary:
phpFriendlyAdmin is a remote database management tool written in PHP.
An unspecified cross-site vulnerability has been reported to exist in the
software that may allow a remote attacker to execute HTML or script code
in a user's browser. The problem exists due to improper sanitization of
user-supplied data. This vulnerability makes it possible for an attacker
to a construct a malicious link containing HTML or script code that may be
rendered in a user's browser upon visiting that link. This attack would
occur in the security context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Other attacks are also possible
such as manipulating site content.
phpFriendlyAdmin versions 1.4 and prior have been reported to be prone to
this issue, however other versions may be affected as well.
29. Sun Solaris PGX32 Libraries Unspecific Privilege Escalation ...
BugTraq ID: 9076
Remote: No
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9076
Summary:
The PGX32 is a frame buffer distributed by Sun Microsystems. It is
available for some types of Sun Sparc hardware.
A problem has been reported in the libraries used by PGX32 frame buffers.
Because of this, a local user may be able to gain unauthorized privileges.
Specific details concerning this issue are currently not available. What
is known is that systems are vulnerable only if the PGX32 is installed on
the host. The issue could result in a local user gaining administrative
access on a system with the device and vulnerable libraries installed.
This Bugtraq ID will be further updated when more information is
available.
30. EffectOffice Server Remote Service Buffer Overflow Vulnerabi...
BugTraq ID: 9077
Remote: Yes
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9077
Summary:
EffectOffice Server is a commercially available office software
infrastructure. It is available for the Microsoft Windows platform.
A problem has been reported in the service used by EffectOffice Server.
Because of this, it may be possible for a remote user to deny service to
legitimate users of the software.
EffectOffice Server launches a process that listens for inbound TCP
connections on port 56004. However, when an attacker remotely connects to
the service and sends strings of excessive length, the service becomes
unstable and crashes. The service requires a manual restart to resume
normal operations.
This problem is likely a boundary condition error, though no conclusive
proof exists at this time. If this is the case, it could be possible for
a remote attacker to execute code with the privileges of the EffectOffice
Server process.
31. IBM AIX RCP Utility Local Buffer Overrun Vulnerability
BugTraq ID: 9078
Remote: No
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9078
Summary:
rcp is the remote file copy program. It is designed to allow the copying
of files from one system to another across a TCP/IP network. It is also
designed to be syntactically similar to the cp program, and uses port
514/TCP on the server side of the connection.
IBM has announced the existence of a local buffer overrun vulnerability in
the rcp utility that could be exploited to gain root privileges. The
precise details regarding this condition are unknown, however it is likely
that the problem occurs due to insufficient bounds checking when handling
command-line or environment data.
This issue is said to occur on AIX 4.3.3, 5.1, and 5.2 systems.
32. FreeRADIUS Tag Field Heap Corruption Vulnerability
BugTraq ID: 9079
Remote: Yes
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9079
Summary:
FreeRADIUS is a freely available, open source implementation of the RADIUS
protocol. It is available for the Unix and Linux platforms.
A problem has been identified in the handling of tag field input by
FreeRADIUS. Because of this, an attacker may be able to deny service to
legitimate users of a vulnerable FreeRADIUS server.
The problem is in the handling of tag field input when supplied with
specific constructs. By supplying a malicious tag field to the server, an
attacker could force the invocation of the memcpy function with a negative
value. This could potentially cause an error, resulting in the
overwriting of heap structures with roughly 3840 bytes of
attacker-supplied data.
Due to the method in which memcpy can be invoked, this vulnerability is
likely limited to resulting in a remote denial of service against
vulnerable servers. This is because of the casting of the length
parameter of the memcpy function, which will interpret the negative value
as an overly large unsigned integer. As a result, an attempt to access an
excessive amount of heap memory will occur, likely resulting in the
dereferencing of invalid memory. However, the possibility exists that
this issue could be exploited to execute code with the privileges of the
FreeRADIUS server process.
This issue was initially reported as a vulnerability in how the
"Tunnel-Password" attribute in Access-Request packets is handled. The
issue turned out to have wider scope, affecting tag field input in
general.
This vulnerability affects version 0.4.0 through 0.9.2.
33. Sybase Adaptive Server Remote Password Array Heap Overflow V...
BugTraq ID: 9080
Remote: Yes
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9080
Summary:
Sybase Adaptive Server is a full SQL relational database management
system. It is available for a variety of platforms including Microsoft
Windows operating systems.
Sybase adaptive server has been reported prone to heap overflow
vulnerability. The issue has been reported to present itself when invalid
password and servername buffer lengths in a remote password array are
passed to the affected server. A heap overflow condition may be triggered,
potentially causing heap memory management structures to be corrupted.
It has been reported that an attacker may exploit this vulnerability to
trigger a denial of service condition. The impact of this denial of
service differs depending on the platform that the Adaptive Server is
installed.
On a Windows platform a single successful exploit attempt on a client
thread, will cause the server to cease to negotiate login attempts and
will additionally prevent the server from responding to all commands.
On a Linux platform the exploited client process will crash, but other
clients and the server process will remain unaffected. However the
attacker may exploit the issue in quick succession and in doing so may
potentially prevent clients from successfully negotiating Adaptive Server
login attempts.
It has been conjectured that due to the nature of this vulnerability an
exploit may be written that manipulates heap management structures in a
manner that is sufficient so that remote arbitrary code execution occurs,
this however has not been confirmed.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Exploit Code on Trial
By: Kevin Poulsen
Security researchers and vendors ponder the ethics of releasing
proof-of-concept code for software vulnerabilities.
http://www.securityfocus.com/news/7511
2. New charges in Lowe's wi-fi hacks
By: Kevin Poulsen
One hacker allegedly confesses, two inform on a third, and prosecutors put
a new defendant in the car.
http://www.securityfocus.com/news/7507
3. Court limits in-car FBI spying
By: Kevin Poulsen
An appeals court overturns a decision that allowed the FBI to transform a
luxury car's navigation system into an eavesdropping device.
http://www.securityfocus.com/news/7491
4. Wi-Fi hacker caught downloading child porn
By: John Leyden, The Register
http://www.securityfocus.com/news/7514
5. Check your sums, Debian advises developers after breach
By: Andrew Orlowski, The Register
http://www.securityfocus.com/news/7513
6. Sentencing postponed in nuclear lab hack case
By: John Leyden, The Register
http://www.securityfocus.com/news/7504
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Botan v1.3.4
By: Jack Lloyd
Relevant URL: http://botan.randombit.net/
Platforms: N/A
Summary:
Botan is a library of cryptographic algorithms written in C++. It includes
a wide selection of block and stream ciphers, public key algorithms, hash
functions, and message authentication codes. It has an easy-to-use filter
interface and supports many common industry standards, including X.509v3.
2. GNU Simple Authentication and Security Layer (SASL) v0.0.9
By: Simon Josefsson
Relevant URL: http://www.gnu.org/software/gsasl/
Platforms: POSIX
Summary:
GNU SASL is a library that implements the IETF Simple Authentication and
Security Layer (SASL) framework and some SASL mechanisms. SASL is used in
servers (e.g. IMAP, SMTP, etc.) to request authentication from clients,
and in clients to authenticate against servers.
3. SecureServ v1.0
By: Justin
Relevant URL: http://www.neostats.net/index.php?id=81
Platforms: FreeBSD, IRIX, POSIX, UNIX
Summary:
IRC administrators can now maintain their own definitions file. Help text
has been cleaned up. Onjoin bots now have a random version reply to look
more like real users, and onjoin bots will not check channels that are
already monitored with a monbot. There is updated documentation and many
bugfixes for existing code.
4. dnsgraph 0.9 v0.9
By: Przemek Sztoch
Relevant URL: http://dnsgraph.sourceforge.net
Platforms: Linux
Summary:
dnsgraph is a very simple DNS statistics RRDtool frontend for Bind that
produces daily, weekly, monthly, and yearly graphs of success/failure,
recursion/referral, and nxrrset/nxdomain.
5. pmacct v0.5.3
By: Paolo Lucente
Relevant URL: http://www.ba.cnr.it/~paolo/pmacct/
Platforms: Linux, OpenBSD
Summary:
pmacct is a network tool to gather IP traffic information (source address,
bytes counter, and number of packets). Data is stored in an in-memory
table whose content could be retrieved by a client program via a local
stream-oriented connection. Gathering packets off the wire is done using
the pcap library and one or more network interfaces in promiscuous mode.
6. CryptoFS v0.2.1
By: Christoph Hohmann
Relevant URL: http://reboot.animeirc.de/cryptofs/
Platforms: Linux
Summary:
CryptoFS is a encryption filesystem for the Linux Userland Filesystem.
Files written to the mount point will be stored encrypted (data and
filename) in a directory on a normal filesystem.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Who says all the best jobs are already taken? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345243
2. Windows Vulnerability Engineer Silicon Valley CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345242
3. Los Angeles-Threat, Vulnerability, & IT Audit (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345241
4. Security Product Development/Engineering Manager - S... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345240
5. Systems Engineer - Silicon Valley - Startup (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345239
6. ERP (PeopleSoft) audit in LA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345238
7. Product Manager for NJ (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345237
8. Systems Engineer - Los Angeles - Netscreen SAPG (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345236
9. need HIPAA consultant in Boston (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345235
10. Windows Vulnerability Engineer Silicon Valley CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345234
11. Tampa - Sr. Security Pre Sales Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345233
12. UK based experienced (3+ yrs) Pen Tester (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345232
13. Threat & Vulnerability Assessment (Bay Area) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345231
14. Application Security Development Manager - Security ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345230
15. Kirkland, WA - Security Pre Sales Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345229
16. San Francisco: Manager, Network Security Architectur... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345228
17. San Francisco: Network Security Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345026
18. Best Geographies - come on (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345025
19. Security Consultant Opportunities (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345024
20. Los Angeles: JD Edwards Security Implementation Spec... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345023
21. Looking for a position in the South Jersey/Philadelp... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345022
22. Los Angeles, and San Francisco: Network Security Sr.... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345021
23. Best Geographies (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/345019
24. Security Jobs (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344991
25. Security Jobs (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344989
26. CISSP in need (again) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344988
27. Security Consultant able to relocate ASAP (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344987
28. Security Engineer in Southern California (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344860
29. Senior Software Engineer Portland OR (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344805
30. SECURITY CONSULTANT / EX BLACKHAT (NJ/NY) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344804
31. Enterprise Sales Executive Need/Chicago - Security S... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344802
32. National Account Manager (West Coast) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344801
33. New Article @SecurityFocus (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344788
34. QA Management position at Vontu, Inc., in San Franci... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344787
35. Product Manager - Security Solutions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344786
36. Software development jobs at Vontu, Inc., in San Fra... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344784
37. Technology & Security Risk Services - Attack & Penet... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344783
38. BORED (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344782
39. Senior Information Security Technical Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344780
40. J2EE Security Architect Position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/344779
VI. INCIDENTS LIST SUMMARY
--------------------------
1. Strange SNMP probes suddenly appearing (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/345199
2. Seen this: iareqdll.dll? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/345197
3. UDP destination port 0 probes (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344818
4. idsearch.com and GoogleMs.dll (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344768
5. Strange Port 0 Traffic (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/344767
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Can you exploit this XSS? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/345267
2. openbsd 3.4 ps bug (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/345208
3. Linux Kernel <= 2.4.21 MXCSR Local DOS Exploitation (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/345159
4. GetPC code (was: Shellcode from ASCII) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/345012
5. burneye, how i can defeat it? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344793
6. ms03-049 sp1a and sp0 now working. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/344623
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. TechNet Security Webcast Week (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/345408
2. iis - authenticate thru domain username/password (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/345407
3. Hiding MS SQL databases in Enterprise Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/345406
4. IIS traffic (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/345405
5. Strange behaviour of MS SQL 2000 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/345403
6. MS03-049 Scanner? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344925
7. MS03-049 Vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344924
8. SecurityFocus Microsoft Newsletter #163 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/344817
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. New SecurityFocus Article (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/344765
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Status of Debian compromise? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/345357
2. New SecurityFocus article (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/344766
XI. SPONSOR INFORMATION
-----------------------
This issue is sponsored by: NeoScale - Enterprise Storage Security that's
Simple, Reliable Secure.
Got Storage Security Risks? Consolidation, Continuity, Compliance
Connected, accessible and distributed storage can enable unauthorized
access to sensitive, trusted and regulated information. What are best
storage security practices? Discover how to alleviate exposures within
shared and managed storage, disaster recovery, vaulting, as well as
auditing and compliance processes. Obtain your FREE whitepaper from
NeoScale at http://www.securityfocus.com/sponsor/NeoScale_sf-news_031124
------------------------------------------------------------------------