SecurityFocus Newsletter #225

SecurityFocus Newsletter #225
------------------------------
This Issue is Sponsored by: Tenable Security

Tenable provides security software which enables enterprises to
distribute, manage, and communicate vulnerability and intrusion detection
information across the entire organization.  Tenable's breakthrough
Lightning(tm) technology elegantly simplifies the complex nature of
network security by offering detailed useable reports for network and
security administrators and high-level organizational reports for CxOs.
In addition, Tenable offers both active (NeWT) and passive (NeVO)
vulnerability detection solutions to further enhance your network
vulnerability identification. For more information, Tenable can be
reached at 410-872-0555 or on the Internet at
http://www.securityfocus.com/sponsor/TenableSecurity_sf-news_031201
------------------------------------------------------------------------
I. FRONT AND CENTER
     1. Fighting Spammers With Honeypots: Part 1
     2. Fighting Spammers With Honeypots: Part 2
     3. Ending the Free Lunch
     4. The Wells Fargo Example
     5. Exploiting Cisco Routers: Part 2
II. BUGTRAQ SUMMARY
     1. Microsoft MSN Messenger Information Leakage Weakness
     2. Imatix Xitami Post Request Header Remote Denial Of Service V...
     3. SGI rpc.mountd Unspecified Denial of Service Vulnerability
     4. SGI rpc.mountd Unauthorized Drive Mounting Vulnerability
     5. OpenBSD semctl/semop Local Unexpected Array Indexing Vulnera...
     6. PrimeBase SQL Database Server Administrative Server Password...
     7. VBPortal Friend.PHP Remote E-Mail Relaying Weakness
     8. Opera Skin Zip File Buffer Overflow Vulnerability
     9. GEdit Large IOStream File Memory Corruption Vulnerability
     10. Thomson Cable Modem Remote Denial Of Service Vulnerability
     11. Linux IPRoute Spoofed Kernel Messages Denial Of Service Vuln...
     12. Pan Long Author Address Denial Of Service Vulnerability
     13. CommerceSQL Shopping Cart index.cgi Directory Traversal Vuln...
     14. Anthill Remote File Include Vulnerability
     15. Apple Mac OS X Finder Application Access Validation Vulnerab...
     16. SIRCD Server Operator Privilege Escalation Vulnerability
     17. Monit HTTP Content-Length Parameter Denial of Service Vulner...
     18. Monit Overly Long HTTP Request Buffer Overrun Vulnerability
     19. Qualcomm Eudora Attachment LaunchProtect Warning Bypass Weak...
     20. Thomson SpeedTouch DSL Router Port Scan Denial Of Service Vu...
     21. HP ProCurve Switch Denial of Service Vulnerability
     22. Mozilla Chatzilla IRC URI Handler Memory Corruption Vulnerab...
     23. Microsoft Internet Explorer MHTML Forced File Execution Vuln...
     24. Microsoft Internet Explorer Invalid ContentType Cache Direct...
     25. Microsoft Internet Explorer Browser MHTML Redirection Local ...
     26. Microsoft Internet Explorer Window.MoveBy/Method Caching Mou...
     27. Microsoft Internet Explorer BackToFramedJPU Cross-Domain Pol...
     28. Apple MacOS X DHCP Response Root Compromise Vulnerability
     29. Macromedia JRun Administrative Interface Multiple Cross-Site...
     30. My_EGallery Module Remote Include Command Injection Vulnerab...
     31. ISC BIND Negative Cache Poison Denial Of Service Vulnerabili...
     32. GnuPG ElGamal Signing Key Private Key Compromise Vulnerabili...
     33. RNN Guestbook Multiple Vulnerabilities
     34. GNU Screen Escape Sequence Buffer Overrun Vulnerability
     35. Microsoft Exchange Server 2003 Outlook Web Access Lowered Se...
     36. Traceroute Detection Security Tool Remote Format String Vuln...
     37. RemotelyAnywhere Autologon.HTML Password/Domain Cross-Site S...
     38. Bitfolge Snif Downloads Directory Traversal Vulnerability
     39. phpBB search.php SQL Injection Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
     1. Nachi worm infected Diebold ATMs
     2. Exploit Code on Trial
     3. New charges in Lowe's wi-fi hacks
     4. .name registry site hacked
     5. Reseller touts home WLAN pack with easy to use security
     6. Police arrest ID thief in Wells Fargo case
IV. SECURITYFOCUS TOP 6 TOOLS
     1. Sentry Firewall CD-ROM v1.5.0-rc7(dev)
     2. AstroFlowGuard Bandwidth & Security Management v1.005
     3. SILC (Secure Internet Live Conferencing)(client) v1.0
     4. CleanPOP v1.0
     5. ThePacketMaster Linux Security Server v1.0.1
     6. Fast Logging Project for Snort v1.0
V. SECURITYJOBS LIST SUMMARY
     1. Looking for a position in Australia (Thread)
     2. Baltimore, MD - Security, Vulnerability, Networking (Thread)
     3. Incident Response Software- Federal Account Executiv... (Thread)
     4. US ARMY Account Executive- Security Management-  VA/... (Thread)
     5. Security Analysts, DC Metro Area (Thread)
     6. List closure for the holidays (Thread)
     7. Information Security Analyst (Thread)
     8. Threat/Incident Analyst, Calgary AB, Symantec (Thread)
     9. Position: Security Consultant (Thread)
     10. Software Engineer - Calgary AB Canada, Symantec (Thread)
     11. VP of Sales Need - Security background required / Sa... (Thread)
     12. Manager of Security Monitoring and Compliance positi... (Thread)
     13. DC Area Senior Presales Consultant--Computer Assoica... (Thread)
     14. Seeking Entry-Level Position (Thread)
     15. Technical Evangelist Needed for Network Associates (Thread)
     16. IT Security Government Sales Manager required for EM... (Thread)
     17. Security Software Direct Sales Job opening - midwest (Thread)
     18. Direct Sales position available- midwest region (Thread)
     19. Harrah's Entertainment (Thread)
     20. Incident Response Team Lead,   Silver Spring, MD   $... (Thread)
     21. Security Specialists required for Auckland (New Zeal... (Thread)
     22. Cryptography and INFOSEC Positions (Thread)
VI. INCIDENTS LIST SUMMARY
     1. Chunked encoding worm on tcp/80 (Thread)
     2. Strange SNMP probes suddenly appearing (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
     1. Win32 Shellcode question. (Thread)
     2. Applied Watch Response to Bugtraq.org post - Was: Mu... (Thread)
     3. Multiple Remote Issues in Applied Watch IDS Suite(ad... (Thread)
     4. Multiple Remote Issues in Applied Watch IDS Suite (a... (Thread)
     5. Can you exploit this XSS? (Thread)
     6. win32 bof question (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
     1. are my binaries being exposed on my ASP.NET website? (Thread)
     2. local admin account password (Thread)
     3. how do I force secure ASP.NET session cookies? (Thread)
     4. Strange behaviour of MS SQL 2000 (Thread)
     5. IIS traffic (Thread)
     6. SecurityFocus Microsoft Newsletter #164 (Thread)
     7. Administrivia: Article Announcements (Thread)
     8. TS group policy / hide notification area (Thread)
     9. Article Announcement: Busting the Worm Writers (Thread)
     10. Betr.: Strange behaviour of MS SQL 2000 (Thread)
IX. SUN FOCUS LIST SUMMARY
     1. Administrivia:  Your Responses (Thread)
     2. New SecurityFocus Articles (Thread)
     3. Sunscreen cluster: "You must log in before using the... (Thread)
X. LINUX FOCUS LIST SUMMARY
     1. Administrivia:  Your responses (Thread)
     2. New SecurityFocus articles (Thread)
XI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Fighting Spammers With Honeypots: Part 1
By Laurent Oudot

This paper will evaluate the usefulness of using honeypots to fight
spammers on several fronts. Part one discusses the methods spammers use to
harvest addresses, maintain stealth and manipulate open mail relays on the
Internet. Then honeypots will be considered that create fake email
addresses to be harvested, identify and track spammers, and simulate open
proxies for spammers to use.

http://www.securityfocus.com/infocus/1747

2. Fighting Spammers With Honeypots: Part 2
By Laurent Oudot

Part two continues the discussion of open proxies, describes creating fake
open mail relays with various honeypots, discusses architecture decisions,
and then provides some recent test results that proved very successful. A
honeypot can clearly be used to detect, slow and stop spam-related
activities while promoting a clean Internet -- but more people must pitch
in for them to truly make a difference.

http://www.securityfocus.com/infocus/1748

3. Ending the Free Lunch
By Hal Flynn

Linux vendors spend money building security bug fixes. How much longer
will they give them away for free?

http://www.securityfocus.com/columnists/200

4. The Wells Fargo Example
By Mark Rasch

Companies should protect consumer data better than Wells Fargo did, but in
cleaning up its laptop data spill the bank blazed a trail worth following.

http://www.securityfocus.com/columnists/201

5. Exploiting Cisco Routers: Part 2
By Mark Wolfgang

This is the second of a two-part series that focuses on identifying and
then exploiting vulnerabilities and poor configurations in Cisco routers.
This article will look at what we can do once we've gotten in.

http://www.securityfocus.com/infocus/1749


II. BUGTRAQ SUMMARY
-------------------
1. Microsoft MSN Messenger Information Leakage Weakness
BugTraq ID: 9082
Remote: Yes
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9082
Summary:
MSN Messenger is an instant messenging client for Microsoft Windows
systems, based on the Passport system.

MSN Messenger is prone to an information leakage weakness.
It has been reported that the problem exist in the MSN client during a
file transfer invitation requests.  The client improperly processes
incoming requests and may send sensitive data such as the IP address of
the client to the remote host without first identifying that host.  The
expected behavior is that the client must accept the file transfer prior
to revealing its IP address.  However, by exploiting this weakness, it is
possible to obtain the client IP address prior to the client user
accepting the file transfer request.  This presents a security threat
because it will allow an attacker to enumerate IP addresses of client
users.

This information could be used to launch direct attacks against the client
system and network.

MSN Messenger versions 6.0.0602 and prior and all versions of Windows
Messenger have been reported to be prone to this issue.  Other versions of
MSN Messenger could be affected as well.

2. Imatix Xitami Post Request Header Remote Denial Of Service V...
BugTraq ID: 9083
Remote: Yes
Date Published: Nov 21 2003
Relevant URL: http://www.securityfocus.com/bid/9083
Summary:
Xitami is a freely available web server package distributed by Imatix.  It
is available for the Unix, Linux, and Microsoft platforms.

A problem has been identified in the handling of certain types of requests
by Imatix Xitami.  Because of this, it is possible for a remote attacker
to deny service to legitimate users of a vulnerable server.

When an attacker crafts POST request with a header containing certain
malformed fields, it is possible to force the Xitami server into an
endless loop in execution.  This typically results in the Xitami server
crashing, resulting in a denial of service, and requiring a manual restart
of the server to resume normal service.

3. SGI rpc.mountd Unspecified Denial of Service Vulnerability
BugTraq ID: 9084
Remote: Yes
Date Published: Nov 21 2003
Relevant URL: http://www.securityfocus.com/bid/9084
Summary:
rpc.mountd is an RPC server that handles NFS file system mount requests.

SGI has announced the existence of an unspecified denial of service
vulnerability in rpc.mountd. The precise technical details are unknown,
however it is believed that this condition could potentially be exploited
to deny access to NFS services.

This BID will be updated as further details regarding this issue are
disclosed.

4. SGI rpc.mountd Unauthorized Drive Mounting Vulnerability
BugTraq ID: 9085
Remote: Yes
Date Published: Nov 21 2003
Relevant URL: http://www.securityfocus.com/bid/9085
Summary:
rpc.mountd is an RPC server that handles NFS file system mount requests.

SGI has announced the existence of a vulnerability in rpc.mountd that
could lead to the unauthorized mounting of drives. The problem is said to
occur due to rpc.mountd erroneously allowing mount requests from
unprivileged ports. This could potentially result in the disclosure or
modification of sensitive information.

The precise details regarding this issue are currently unknown, however
this BID will be updated as further information is made available.

5. OpenBSD semctl/semop Local Unexpected Array Indexing Vulnera...
BugTraq ID: 9086
Remote: No
Date Published: Nov 21 2003
Relevant URL: http://www.securityfocus.com/bid/9086
Summary:
The semop system call is used to carry out an array of operations on a
specified set of semaphores. The semctl system call allows for a number of
control operations to be carried out on a specified semaphore.

A vulnerability has been discovered in an operation carried out by both
system calls, specifically when handling the 'semid' parameter. The
problem occurs within the sysv_sem.c source file when carrying out sanity
checks on the aforementioned parameter.

The first operation carried out by both system calls after deriving the
appropriate semid value, is to ensure that the value is not negative and
is not larger then a specific variable. However, the code incorrectly
compares the size of semid to seminfo.semmsl, rather than the correct
seminfo.semmni variable. This could potentially allow for semid to be
larger then expected.

A pointer to a specific semaphore set structure is subsequently obtained
by indexing into an array of semaphore ids,  via the semid value. Because
the value may be larger then expected, the pointer will be obtained from
an unintended location in memory and could potentially contain an invalid
memory address.

Subsequent to the pointer being calculated, the value is dereference in an
attempt to query structure parameter values. Due to the aforementioned
conditions, it is likely that this will result in an attempt to
dereference an unpaged location in memory, effectively triggering a
segmentation violation and causing the kernel to panic.

Despite the number of restrictive conditions that would need to be met, it
has been speculated that a sufficiently skilled attacker could
theoretically exploit this condition to elevate local privileges. This
information has not yet been confirmed.

It should be noted that an attacker's ability to elevate privileges on an
OpenBSD 3.4 system may be hampered by the memory protection schemes
recently implemented into the operating system. However, despite these
changes a sufficiently skilled attacker may still be capable of bypassing
the protections.

6. PrimeBase SQL Database Server Administrative Server Password...
BugTraq ID: 9087
Remote: No
Date Published: Nov 22 2003
Relevant URL: http://www.securityfocus.com/bid/9087
Summary:
PrimeBase SQL Database Server is a database implementation that is
available for Unix, Linux, and Microsoft Windows platforms.

A problem has been reported in the storage of credentials in PrimeBase SQL
Database Server.  Because of this, it may be possible for an attacker to
gain unauthorized access to resources.

The problem is in the storage of authentication credentials.  The
administrative server included with PrimeBase SQL Database Server does not
store authentication credentials in a secure format, keeping them in a
plain text file.  This problem is compounded by the fact that file is
created with a default umask that permits world read access to the file.

This issue may permit an attacker with shell-level access to a system
hosting the server to gain access to the database server administrative
interface.

7. VBPortal Friend.PHP Remote E-Mail Relaying Weakness
BugTraq ID: 9088
Remote: Yes
Date Published: Nov 22 2003
Relevant URL: http://www.securityfocus.com/bid/9088
Summary:
vbPortal is a portal application which can be used in conjunction with
vbBulletin forums.

A problem has been identified the Friends.PHP script included in vbPortal.
Because of this, it may be possible for a remote attacker to relay
unauthorized e-mail.

The problem is in the handling of the yname and ymail variables.  These
variables may be modified in the headers, making it possible to define
them as an arbitrary value.  This could permit an attacker to send e-mail
through the server to any location, hiding behind the address of the
vbPortal server.

8. Opera Skin Zip File Buffer Overflow Vulnerability
BugTraq ID: 9089
Remote: Yes
Date Published: Nov 22 2003
Relevant URL: http://www.securityfocus.com/bid/9089
Summary:
Opera is a web browser available for a number of operating systems,
including the Microsoft Windows, Linux, Unix, and Apple MacOS platforms.

A problem has been identified in the handling of zipped skin files by
Opera.  Because of this, it may be possible for an attacker to gain
unauthorized access to a system using the vulnerable browser.

The problem is in the handling of specially crafted zip files.  When a
skin zip file with data appended after the zipped data is downloaded by
Opera, the data contained after the zip data results in a boundary
condition error.  This could be exploited to overwrite sensitive process
memory, potentially resulting in the modifying of program flow and
execution of attacker-supplied instructions.

It should be noted that exploitation of this vulnerability may result in
the execution of code with the privileges of the Opera browser user.

9. GEdit Large IOStream File Memory Corruption Vulnerability
BugTraq ID: 9090
Remote: No
Date Published: Nov 23 2003
Relevant URL: http://www.securityfocus.com/bid/9090
Summary:
gEdit is a freely available, open source text processing application.  It
is available for the Unix and Linux platforms.

A problem has been reported in the handling of certain file types by
gEdit.  Because of this, it may be possible to cause memory corruption.

The problem is in the handling of files with long strings.  When a file
with long strings and no terminators is opened with gEdit, a memory
corruption error occurs.  This problem is likely a buffer overflow, though
this has not been confirmed.

In the event that this is an exploitable overflow, it could be possible to
execute arbitrary code by embedding arbitrary instructions in a
maliciously crafted file.  Any instructions executed through gEdit would
be with the privileges of the gEdit user.

10. Thomson Cable Modem Remote Denial Of Service Vulnerability
BugTraq ID: 9091
Remote: Yes
Date Published: Nov 24 2003
Relevant URL: http://www.securityfocus.com/bid/9091
Summary:
The TCM product line are cable modems distributed by Thomson.

A problem has been identified in Thomson Cable Modems when handling long
requests on the HTTP port.  Because of this, it may be possible for an
attacker to deny service to legitimate users of the device.

The problem is in the handling of strings of excessive length in HTTP
requests.  When a request containing 100 or more bytes of data is made to
the HTTP server on the modem, the modem becomes unstable and crashes.
This could be repeated to perform a prolonged denial of service.

The problem is likely related to a boundary condition error in the device
firmware.  If this is the case, the possibility exists for code execution
on the device under the right circumstances.

It is not currently known if this device permits access to the web server
on the WAN interface.  However, it is an unlikely design, and exposure is
likely limited to the LAN interface.

11. Linux IPRoute Spoofed Kernel Messages Denial Of Service Vuln...
BugTraq ID: 9092
Remote: No
Date Published: Nov 24 2003
Relevant URL: http://www.securityfocus.com/bid/9092
Summary:
iproute is a freely available, open source network suite for the Linux
platform.

A problem has been discovered in iproute when handling messages from the
kernel.  Because of this, it may be possible for an attacker to deny
service to legitimate users of a system.

The problem is in the checking of the origins of messages from the kernel.
By creating specially crafted messages, it is possible to send spoofed
messages on the kernel netlink interface that will fool iproute into
reacting unpredictably.  This could lead to loss of proper routing tables,
or other types of routing attacks.

12. Pan Long Author Address Denial Of Service Vulnerability
BugTraq ID: 9093
Remote: Yes
Date Published: Nov 24 2003
Relevant URL: http://www.securityfocus.com/bid/9093
Summary:
Pan is a freely available, open source news reading utility.  It is
available for the Unix and Linux platforms.

A problem has been reported in the handling of addresses in Pan.  Because
of this, it is possible for a remote attacker to deny service to
legitimate users of an application.

The problem is in the handling of news posts containing long author e-mail
addresses.  When the program encounters such an article, it becomes
unstable and crashes.  The program will continue to crash each time an
attempt to read the malicious article is made.

13. CommerceSQL Shopping Cart index.cgi Directory Traversal Vuln...
BugTraq ID: 9094
Remote: Yes
Date Published: Nov 24 2003
Relevant URL: http://www.securityfocus.com/bid/9094
Summary:
CommerceSQL Shopping Cart is a shopping cart application.

A vulnerability has been reported to exist in the software that may allow
a remote attacker to access information outside the server root directory.
The problem exists due to insufficient sanitization of user-supplied data
through a URI parameter named 'page'. The issue may allow a remote
attacker to traverse outside the server root directory by using '../'
character sequences.

Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive information such as a password file that may
be used to launch further attacks against a vulnerable system.

CommerceSQL versions 2.2 and prior may be prone to this issue.

14. Anthill Remote File Include Vulnerability
BugTraq ID: 9095
Remote: Yes
Date Published: Nov 24 2003
Relevant URL: http://www.securityfocus.com/bid/9095
Summary:
Anthill is a PHP based bug tracking system.

A vulnerability has been reported to exist in the software that may allow
an attacker to include malicious files containing arbitrary code to be
executed on a vulnerable system.  It has been reported that an attacker
may include an attachment to the server containing malicious code that
could be executed remotely.

Remote attackers could potentially exploit this issue to include a remote
malicious PHP script, which will be executed in the context of the web
server hosting the vulnerable Anthill software.

Anthill version 0.2.5 has been reported to be prone to this issue.

15. Apple Mac OS X Finder Application Access Validation Vulnerab...
BugTraq ID: 9096
Remote: No
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9096
Summary:
The finder application is included in Apple Mac OS X distributions to
provide a method for a desktop user to navigate and manage the Mac OS X
filesystem and peripherals. The finder application is designed to observe
file and folder permissions for the user who is running finder.

Apple Mac OS X finder has been reported prone to an access validation
vulnerability. The issue has been reported to present itself, when a user
with 'admin' privileges attempts to access the '/System/Library'
directory. This directory is owned by root/wheel users and is set with 755
permissions by default, these permission would normally grant the 'admin'
read and execute rights to '/System/Library'.  The finder application
correctly presents an authentication dialog to control access to the
aforementioned directory, however if the user authenticates using admin
user credentials they are incorrectly granted full permissions to the
'/System/Library' directory.

It has been reported that this issue exists because the finder application
employs the file '/etc/authorization' when authenticating a user, the
finder application will look for the 'com.apple.desktopservices' right and
because this entry does not exist in the authorization control list,
finder relies on a default rule, which grants the admin user full
permissions over the '/System/Library' directory.

Additionally, the 'Go To Folder..' functionality provided by finder can
also be used in this manner to grant write access for the 'admin' user to
any directory including /private on the affected system.

It has been reported that this vulnerability exists even if the 'admin'
user is removed from the sudoers list.

An attacker may exploit this vulnerability to elevate local system
privileges.

It should be noted that although this vulnerability has been reported to
affect Mac OS X 10.3, other versions might also be affected.

16. SIRCD Server Operator Privilege Escalation Vulnerability
BugTraq ID: 9097
Remote: Yes
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9097
Summary:
sircd is an IRC server daemon, for Linux and Unix platforms.

sircd has been reported prone to a privilege escalation vulnerability. The
issue has been reported to exist in s_client.c. It has been reported that
any user logged on to the sircd server, may set their usermode to +o, or
operator mode.

An attacker may exploit this condition to hijack IRC channels or
impersonate users, these privileges may aid the attacker in further
attacks launched against the target server.

It should be noted that although sircd versions 0.5.2 and 0.5.3 have been
reported vulnerable other versions might also be affected.

17. Monit HTTP Content-Length Parameter Denial of Service Vulner...
BugTraq ID: 9098
Remote: Yes
Date Published: Nov 24 2003
Relevant URL: http://www.securityfocus.com/bid/9098
Summary:
Monit is a utility for the Linux and Unix operating systems that is
designed to monitor processes, devices, files, and directories. The
application makes use of an HTTPS interface to allow remote users to
monitor system statistics.

A vulnerability has been discovered in Monit 4.1 and earlier that could
potentially allow an anonymous attacker to crash the daemon process. The
problem occurs due to Monit failing to sanitize a specific HTTP parameter
before passing its values to a memory allocation function.

Specifically, Monit does not verify the sanity of the Content-Length HTTP
parameter before passing it as an argument to the xmalloc() function. As a
result, passing a negative value as the Content-Length will cause the
value to be cast as unsigned by the aforementioned function, causing the
value to be interpreted as an excessively large value. This will likely
cause the xmalloc() function to unexpectedly fail, resulting in the daemon
crashing.

Although unconfirmed, the crash may in fact occur due to the program
failing to handle NULL values returned from xmalloc(), possibly resulting
in a NULL pointer dereference.

18. Monit Overly Long HTTP Request Buffer Overrun Vulnerability
BugTraq ID: 9099
Remote: Yes
Date Published: Nov 24 2003
Relevant URL: http://www.securityfocus.com/bid/9099
Summary:
Monit is a utility for the Linux and Unix operating systems that is
designed to monitor processes, devices, files, and directories. The
application makes use of an HTTPS interface to allow remote users to
monitor system statistics.

A buffer overrun vulnerability has been discovered in Monit 4.1 and
earlier that could potentially allow a remote attacker to execute
arbitrary code with root privileges. The problem occurs due to Monit
failing to carry out sufficient bounds checking when handling HTTP request
data.

An attacker could potentially exploit this condition to overwrite
sensitive process memory variables, allowing for the execution flow of
Monit to be controlled. Successful exploitation of this vulnerability
could lead to an attacker gaining remote root access to an affected
system.

19. Qualcomm Eudora Attachment LaunchProtect Warning Bypass Weak...
BugTraq ID: 9101
Remote: Yes
Date Published: Nov 25 2003
Relevant URL: http://www.securityfocus.com/bid/9101
Summary:
Eudora is the freely available mail user agent (MUA) maintained and
distributed by Qualcomm.  It is available for the Microsoft Windows
platform.

A problem has been identified in the implementation of LaunchProtect
within Eudora.  Because of this, it may be possible to trick users into
performing dangerous actions.

The problem is in the handling of files outside of the LaunchProtect
directory.  When an attachment is saved inside the LaunchProtect
directory, Eudora displays a warning message prior to opening any
executable attachments.  However, this is limited to the attach directory.
An attachment placed outside of the attach directory would not prompt the
warning from Eudora.  This may lull the user into a false sense of
security as they will not be cautioned about the attachment when opening
it.  The user would still need to interactively open the attachment.

The threat of this problem could be further increased by the issue
described in Bugtraq ID 5432.

20. Thomson SpeedTouch DSL Router Port Scan Denial Of Service Vu...
BugTraq ID: 9102
Remote: Yes
Date Published: Nov 25 2003
Relevant URL: http://www.securityfocus.com/bid/9102
Summary:
SpeedTouch is a line of DSL routers distributed by Thomson.

A problem has been reported in SpeedTouch DSL routers when routing certain
types of traffic.  Because of this, it may be possible to deny service to
legitimate users of a vulnerable router.

The problem is in the handling of scans from some types of security
software.  Reports indicate that when security scans are initiated from
software such as Nessus and NMAP and routed across the router to a remote
system, the router becomes unstable.  This problem has been reported to
reproduce a reliable crash, resulting in a denial of service to network
users.

This problem is currently known to affect the 510 model, though other
models may also be affected.

21. HP ProCurve Switch Denial of Service Vulnerability
BugTraq ID: 9103
Remote: Yes
Date Published: Nov 26 2003
Relevant URL: http://www.securityfocus.com/bid/9103
Summary:
A denial of service vulnerability has been reported to exist in the HP
ProCurve Switches.  The problem is reported to occur in the presence of
RPC worms such as W32.Welchia.Worm (MCID 1811) and W32.Blaster.Worm (MCID
1761).

Reports have indicated that the vulnerable switches react in an unstable
manner in the presence of certain RPC worms.  This issue results in
deteriorated network traffic leading to a denial of service condition for
network users.  This problem is reported to affect systems running
Microsoft Windows operating systems.

This vulnerability may cause the software to crash therefore denying
service to legitimate users.

22. Mozilla Chatzilla IRC URI Handler Memory Corruption Vulnerab...
BugTraq ID: 9104
Remote: Yes
Date Published: Nov 26 2003
Relevant URL: http://www.securityfocus.com/bid/9104
Summary:
Mozilla web browser includes support for various chat protocols such as
IRC via the Chatzilla component.

The Mozilla Chatzilla IRC URI handler is prone to a memory corruption
vulnerability when handling URIs of excessive length.  This condition can
reportedly be triggered if the client visits an irc: URI that is
approximately 40K in length.  This will cause the browser to crash with an
access violation error in js3250.dll.  Though unconfirmed, this issue
could theoretically be exploited to execute arbitrary code if an attacker
can corrupt specific regions of memory and control execution flow of the
program.

This issue was reported for Mozilla on Windows platforms.  It is not known
if other versions are similarly affected.

This issue may be related to BID 4637.

23. Microsoft Internet Explorer MHTML Forced File Execution Vuln...
BugTraq ID: 9105
Remote: Yes
Date Published: Nov 25 2003
Relevant URL: http://www.securityfocus.com/bid/9105
Summary:
A vulnerability has been discovered in Microsoft Internet Explorer when
handling MHTML file URIs that may be exploited to download a malicious
file to the client system and execute it if active content can be run in
the Local Zone.

This issue involves using MHTML file and res URIs to redirect the browser
into downloading an attacker-specified file. MHTML file URIs are used to
specify the location of content embedded in an MHT file. MHTML URIs have
the following format:

mhtml:[Mhtml_File_Uri]![Original_Resource_Uri]

It has been reported that if the resource specified in the Mhtml_File_Uri
cannot be found, the browser will attempt to retrieve the resource
specified in the Original_Resource_Uri.

The vulnerability can be exploited by setting the CODEBASE property of an
OBJECT tag, using a previously unused CLSID, to a non-existent
Mhtml_File_Uri and attacker-supplied Original_Resource_Uri. When the
browser fails to retrieve the non-existent resource initially specified in
the first part of the MHTML URI, it downloads content specified by the
attacker instead in the second part of the URI. The content downloaded
will subsequently be executed. This could be exploited in combination with
other vulnerabilities such as those described in BID 9107 and 9109 to
ultimately execute code within the Local Zone.

Due to the ease of exploitation and the existence of other vulnerabilities
which may be exploited in tandem with this BID, it is probable that this
issue will be widely exploited in the wild.

This issue was originally covered in BID 9100 "Multiple Internet Explorer
Browser Security Model Compromise Vulnerabilities" and is now being
assigned
its own BID.

24. Microsoft Internet Explorer Invalid ContentType Cache Direct...
BugTraq ID: 9106
Remote: Yes
Date Published: Nov 25 2003
Relevant URL: http://www.securityfocus.com/bid/9106
Summary:
Microsoft Internet Explorer is prone to a weakness that may allow
attackers to enumerate where cached Internet content is stored on the
client filesystem.  The attacker can exploit this by specifying an invalid
ContentType in an HTTP response to the browser.

If the attacker can determine the location of cached content, it may be
possible to reference this content using other known issues.  This
presents an attacker with the possibility of causing malicious active
content to be stored in the cache and then referenced through exploitation
of a number of other known issues in the browser.  There are also existing
issues in the browser that will allow this content to be interpreted in
the context of the Local Zone (My Computer).  This could be exploited in
tandem with these other vulnerabilities from a malicious web page to cause
code to be executed on a system running the vulnerable client.

Symantec has confirmed that this issue is exploitable on IE 5.0 as well as
the version tested by the researcher.  However, other external reports
indicate difficulties reliably reproducing this issue on various versions
of Microsoft Internet Explorer 6.0.  This may have to do with particular
browser and operation system settings.  This BID will be updated if
further information is made available to clarify which versions, patch
levels and configurations are affected.

Due to the ease of exploitation and the existence of other vulnerabilities
which may be exploited in tandem with this BID, it is probable that this
issue will be widely exploited in the wild.

This issue was originally covered in BID 9100 "Multiple Internet Explorer
Browser Security Model Compromise Vulnerabilities" and is now being
assigned its own BID.

25. Microsoft Internet Explorer Browser MHTML Redirection Local ...
BugTraq ID: 9107
Remote: Yes
Date Published: Nov 25 2003
Relevant URL: http://www.securityfocus.com/bid/9107
Summary:
A vulnerability has been reported in Internet Explorer that may allow an
attacker to parse local files on a system.

A vulnerability (MhtRedirParsesLocalFile) has been reported that may be
exploited to cause Internet Explorer to parse a local file inside of an
IFRAME. This vulnerability relies on use of MHTML file URIs to redirect
the browser to a local resource. MHTML file URIs are used to specify the
location of content embedded in an MHT file. MHTML URIs have the following
format:

mhtml:[Mhtml_File_Uri]![Original_Resource_Uri]

It has been reported that if the resource specified in the Mhtml_File_Uri
cannot be found, the browser will attempt to retrieve the resource
specified in the Original_Resource_Uri. This works much like an HTTP
redirect. Due to insufficient security checks when accessing the
Original_Resource_Uri, it is possible to use this to redirect the browser
to a local resource.  This issue may be combined with BID 9105 in order to
execute arbitrary code on a vulnerable system.

Symantec has confirmed that this issue is exploitable on IE 5.0 as well as
the version tested by the researcher.

This issue was originally covered in BID 9100 "Multiple Internet Explorer
Browser Security Model Compromise Vulnerabilities" and is now being
assigned
its own BID.

26. Microsoft Internet Explorer Window.MoveBy/Method Caching Mou...
BugTraq ID: 9108
Remote: Yes
Date Published: Nov 25 2003
Relevant URL: http://www.securityfocus.com/bid/9108
Summary:
Microsoft Internet Explorer is an Internet browser application that is
shipped with Microsoft Windows. Internet Explorer provides support for
JavaScript by default. window.moveBy(), is a JavaScript function that
moves the current window on an x and y axis specified by arguments passed
to the function. In BID 8755, it was reported that by using the
window.moveBy() function an attacker could potentially hijack mouse click
events and influence an Internet Explorer user into invoking unintended
procedures. This vulnerability was addressed by the MS03-048 cumulative
security update for Internet Explorer.

It has been reported that a variation on the attack described in BID 8755
has been discovered that will bypass security measures implemented in the
MS03-048 cumulative security update. MS03-048 enforced measures to make
the window.moveBy() function inaccessible, however it has been reported
that by using JavaScript method caching functions(SaveRef) an attacker may
again make the window.moveBy() function available and so may potentially
hijack mouse click events.

An attacker may exploit this issue to hijack mouse click events and
ultimately influence an unsuspecting user into invoking unintended
procedures.

This issue was originally covered in BID 9100 "Multiple Internet Explorer
Browser Security Model Compromise Vulnerabilities" and is now being
assigned its own BID.

27. Microsoft Internet Explorer BackToFramedJPU Cross-Domain Pol...
BugTraq ID: 9109
Remote: Yes
Date Published: Nov 25 2003
Relevant URL: http://www.securityfocus.com/bid/9109
Summary:
A vulnerability has been reported in sub-frames in Microsoft Internet
Explorer.  Because of this, an attacker may be able to violate
cross-domain policy.

The problem is a variation of vulnerabilities previously reported by Liu
Die Yu (which are covered in BID 8577).  The issue involves navigating
sub-frames to a JavaScript protocol URI and the use of history.back().
The problem components could allow for script code to access properties of
a page from a foreign domain, stored in the browser history.  This issue,
by itself, could permit a malicious web page to interact with a foreign
domain, potentially allowing for theft of sensitive information or other
attacks.  By exploiting this issue in combination with other
vulnerabilities (such as BIDs 9105 and 9107), it will be possible to
execute malicious code on the client system in the context of the Local
Zone.

Symantec has confirmed that this issue is exploitable on IE 5.0 as well as
the version tested by the researcher.

Due to the ease of exploitation and the existence of other vulnerabilities
which may be exploited in tandem with this BID, it is probable that this
issue will be widely exploited in the wild.

This issue was originally covered in BID 9100 "Multiple Internet Explorer
Browser Security Model Compromise Vulnerabilities" and is now being
assigned its own BID.

28. Apple MacOS X DHCP Response Root Compromise Vulnerability
BugTraq ID: 9110
Remote: Yes
Date Published: Nov 26 2003
Relevant URL: http://www.securityfocus.com/bid/9110
Summary:
A vulnerability has been identified in Apple MacOS X that may allow an
attacker to gain root access to a vulnerable system via DHCP responses.

The problem reportedly occurs due to certain default setting that could
cause a vulnerable host to trust a malicious DHCP server for user, group,
and volume mounting settings.  It has been reported that systems running
MacOS X attempt to negotiate DHCP on all available interfaces.  If an
Airport Card is installed and a network is not found, then that system
will attempt to connect to any network in order to obtain an address.  The
system will also attempt to connect to an LDAP or NetInfo server on the
network by using DHCP provided fields.

The vulnerability exists because by default the system places a higher
priority for the LDAP or NetInfo server than that of the local user
settings and implicitly trusts the server for correct information.  As a
result of this, by hosting and malicious configuring a DHCP server on the
internal network of an affected system, it has been reported that an
attacker may capable of logging into a vulnerable system using any login
name and a user id (uid) of 0.

Successful exploitation of this issue may allow a remote attacker to gain
root level access to a vulnerable system when the system is started in a
malicious network.

Although unconfirmed, this issue could affect Apple MacOS X versions
released prior to 10.2.

29. Macromedia JRun Administrative Interface Multiple Cross-Site...
BugTraq ID: 9112
Remote: Yes
Date Published: Nov 26 2003
Relevant URL: http://www.securityfocus.com/bid/9112
Summary:
Macromedia JRun is a J2EE application server for use with IIS 4/5 on the
Microsoft Windows operating systems.

Macromedia JRun includes a web-based administrative console which listens
on TCP port 8000. When this page is accessed, the user is prompted for an
administrative login.

It is said that an unauthenticated user may be capable of passing
malicious script code embedded within URI parameters to the various
scripts used by the interface, that will be interpreted by an
authenticated user when the page is loaded.

This problem is said to occur due to the application failing to sanitize
specific parameters passed to the webserverlist.jsp, clusterframe.jsp,
jrunwebserverconfig.jsp, and serverframe.jsp script files.

An attacker could exploit this condition by constructing malicious links
containing embedded script code and coaxing an administrative user to
follow them. If followed, this could potentially allow an attacker to
expose the administrators authentication credentials, ultimately allowing
them to gain access to the interface. Access such as this could lead to
further more serious attacks against specific hosts.

These issues are said to be present in Macromedia JRun 4 (build 61650)
however, it is possible that other versions are also affected.

30. My_EGallery Module Remote Include Command Injection Vulnerab...
BugTraq ID: 9113
Remote: Yes
Date Published: Nov 26 2003
Relevant URL: http://www.securityfocus.com/bid/9113
Summary:
My_eGallery is a freely available, open source PostNuke module.  It is
available for the Unix and Linux platforms.

A vulnerability has been identified in the handling of input by
My_eGallery.  Because of this, it may be possible for a remote user to
gain unauthorized access to a system using the vulnerable software.

It is possible to influence the include path of certain files, which could
lead to an attacker including arbitrary PHP files from an external system.
Upon inclusion, commands contained in the attacker-supplied includes would
be executed on the local system.  It has been reported that the problem
may exist in multiple scripts including the 'basepath' parameter of
'displayCategory.php'.

Commands executed through this vulnerability could permit an attacker to
gain access to a vulnerable system with the privileges of the web server
process.

31. ISC BIND Negative Cache Poison Denial Of Service Vulnerabili...
BugTraq ID: 9114
Remote: Yes
Date Published: Nov 26 2003
Relevant URL: http://www.securityfocus.com/bid/9114
Summary:
ISC BIND is a server program that implements the domain name service
protocol. It is widely used on the Internet.

BIND has been reported prone to a DNS cache poisoning vulnerability; this
issue is due to negative answers being cached from an incorrect source. A
remote attacker who has control of a DNS server capable of serving
authoritative negative responses may exploit this issue. Ultimately if the
vulnerable BIND DNS server queries the malicious attacker-controlled name
server, authoritative negative responses that should not be accepted will
poison the cache of the vulnerable BIND server. This will result in the
inability of resolver procedures to resolve the domains specified in the
negative records. It has been reported that this denial of service effect
will last until the bad DNS record expires from the DNS cache. An attacker
may ensure that a high TTL value is used, so that the malicious record
remains in the target DNS server cache for as long as possible.

The vendor has stated the fixes were added to affected versions as
anti-cache poisoning measures to negative answers.

A remote attacker may exploit this vulnerability to deny service to
affected servers for legitimate users. There may also be other
consequences associated with this vulnerability, though this has not been
confirmed.

This BID will be updated when further explicit information relating to
this vulnerability is made public.

32. GnuPG ElGamal Signing Key Private Key Compromise Vulnerabili...
BugTraq ID: 9115
Remote: Yes
Date Published: Nov 27 2003
Relevant URL: http://www.securityfocus.com/bid/9115
Summary:
GnuPG includes optional support for use of the ElGamal algorithm to
signing and encryption.  This will allow users to generate public/private
key sets which may be used to sign content using ElGamal.

A vulnerability has been reported in how ElGamal signing keys are
implemented that could compromise private keys.  The vendor has stated
that this vulnerability could be practically exploited to compromise
private keys in seconds.  Compromised private keys may then be used to
sign content, which will appear authentic and may be trusted based on this
appearance.  If content is encrypted using ElGamal sign+encrypt keys, it
could also be at risk, though this has not been confirmed.

This vulnerability was introduced as of version 1.0.2 of GnuPG.  It should
also be noted that this issue does not affect any other key types or
ElGamal keys that are used for encryption only.

Further technical information is not available at this point, though the
vendor advises against the future use of ElGamal signing keys and has
provided a patch which removes support for the keys.

33. RNN Guestbook Multiple Vulnerabilities
BugTraq ID: 9116
Remote: Yes
Date Published: Nov 27 2003
Relevant URL: http://www.securityfocus.com/bid/9116
Summary:
RNN Guestbook is a customizable CGI script.

Multiple vulnerabilities have been reported to exist in the software that
may allow an attacker to carry out command execution, HTML injection,
information disclosure and unauthorized administrative access.

A vulnerability has been reported to exist in the software that may allow
an attacker to gain administrative access to a vulnerable system.  This
problem exists in the 'action' parameter of the 'gbadmin.cgi' script.  It
has been reported that the user is prompted for a password when accessing
this script, however administrative level access may be gained by
supplying values as the QUERY_STRING value in the 'action' parameter.  An
attacker may exploit this issue in order to modify or delete configuration
settings and change the administrative password.

An input validation issue is reported to be present in the 'action'
parameter of the 'gbadmin.cgi' script.  It has been reported that by
accessing 'gbadmin.cgi?action=setup' script and changing the path of
'guestbook entry file' to point to an arbitrary file such as the password
file (/etc/passwd), an attacker may gain access to sensitive information
in the context of the web server.  An attack can also exploit this issue
to execute arbitrary commands on a vulnerable system.  It has been
reported that instead of accessing a sensitive file an attacker may also
insert commands in the path in the following format: '/path/file;<cmd>
<args>|' to be executed in the context of the vulnerable process.

A HTML injection vulnerability has been reported in the software as well
that may allow an attack to execute HTML or script code on a vulnerable
system.  The problem is reported to be present in $name, $email, $refer,
$msn, $aol, $guest_site, $comment, and $ip variables.  The problem exists
due to insufficient sanitization of user-supplied input. It may be
possible for an attacker to include malicious HTML code in one of the
vulnerable fields to  steal cookie-based authentication credentials. Other
attacks are possible as well.

An issue has been discovered that may allow a local user to gain
administrative access to the system.  It has been reported that the
administrator password is stored in plain text format in 'gbpass.pl' file.
This file is stored in the same directory as other guestbook file
therefore a user with privileges to access the guestbook directory can
harvest the administrative password.

RNN Guestbook version 1.2 has been reported to be prone to these issues
however other versions may be affected as well.

Analysis of these issues is currently underway and new BIDs will be
created for individual vulnerabilities where it is appropriate.

34. GNU Screen Escape Sequence Buffer Overrun Vulnerability
BugTraq ID: 9117
Remote: Yes
Date Published: Nov 27 2003
Relevant URL: http://www.securityfocus.com/bid/9117
Summary:
GNU Screen is prone to a buffer overrun vulnerability that may be
triggered by including 2-gigabytes or more of semi-colons (;) in an escape
sequence.

The source of the problem is that the w_NumArgs variable (in the ansi.c
source file) is declared as a signed integer.  A check is done on the
value of the variable to determine if it is less than the MAXARGS
variable.  If enough input is supplied to cause this value to wrap around
to a negative number, the size check will succeed when it technically
should have failed.  There may be other operations which occur afterwards
where this check also succeeds and causes memory to be corrupted with
attacker-controlled data.  Exploitation may potentially allow for
execution of arbitrary code or result in a denial of service.

This issue could be exploited locally to gain elevated privileges or in
some cases remote exploitation may also be possible (though unlikely due
to the amount of data required) since escape sequences could originate
from a remote network session using SSH, telnet or another network client.
Screen is usually installed with setgid utmp or setuid root permissions.

35. Microsoft Exchange Server 2003 Outlook Web Access Lowered Se...
BugTraq ID: 9118
Remote: No
Date Published: Nov 27 2003
Relevant URL: http://www.securityfocus.com/bid/9118
Summary:
Microsoft Exchange Server 2003 is an e-mail and directory server offered
by Microsoft. Outlook Web Access (OWA) is a service provided by Exchange
server that allows users to access their Exchange mailbox via the web.

A weakness is reported to exist in the software that may allow an attacker
to gain unauthorized access to a user's mail through Outlook Web Access
therefore gaining access to sensitive information.

The issue is reported to present itself when Microsoft Windows SharePoint
Services 2.0 is installed on a machine running both Exchange Server 2003
and Microsoft Windows Server 2003.  This installation may cause the
Kerberos authentication employed by the server to be disabled in IIS
(Internet Information Services) and OWA would fall back to the weaker NTLM
authentication protocol.  This may cause Exchange Server to incorrectly
handle OWA requests as well.  It has been reported that this issue may
allow an attacker to gain unauthorized access to a user's mailbox that
could result in a disclosure to sensitive information.

Due to a lack to details, exact attack information and exploitation cannot
be specified at the moment.  This BID will be updated as more information
becomes available.

36. Traceroute Detection Security Tool Remote Format String Vuln...
BugTraq ID: 9119
Remote: Yes
Date Published: Nov 27 2003
Relevant URL: http://www.securityfocus.com/bid/9119
Summary:
In issue 51 of Phrack magazine, the detecttr.c utility was released by
Baldor for detecting attempted traceroutes against a specific machine. The
tool is now available from a variety of Unix security resource websites,
and other locations.

Snosoft has reported that the detecttr.c utility is prone to a remote
format string vulnerability. The problem occurs due to erroneous use of
the syslog() function. Specifically, the author failed to include format
specifiers when logging potentially malicious hostnames. As a result, an
attacker may be capable of constructing a malicious hostname containing
embedded format specifiers which may be interpreted by the function when
an attempt is made to log the information.

Successful exploitation of this vulnerability could potentially lead to
the execution of arbitrary code with the privileges of the user who
invoked the detecttr.c tool.

37. RemotelyAnywhere Autologon.HTML Password/Domain Cross-Site S...
BugTraq ID: 9120
Remote: Yes
Date Published: Nov 27 2003
Relevant URL: http://www.securityfocus.com/bid/9120
Summary:
RemotelyAnywhere is a remote host administration solution that allows a
system to be accessed via a web interface from a remote location.

RemotelyAnywhere has been reported prone to a cross-site scripting
vulnerability that exists in the authentication interface
'autologon.html'. It has been reported that this issue  presents itself
due to a lack of sufficient sanitization performed by RemotelyAnywhere on
user supplied password or domain URI parameters. An attacker may exploit
this condition, by crafting a malicious link to the RemotelyAnywhere
service; the URL will contain script code embedded as values for the
password or domain URI parameters. If this link is followed, the malicious
code will be rendered in their browser in the context of the vulnerable
RemotelyAnywhere service.

This condition may ultimately be exploited to steal cookie based
authentication credentials; other attacks may also be possible.

It should be noted that this issue has been reported to affect
RemotelyAnywhere version 5.10.416 and all prior versions.

38. Bitfolge Snif Downloads Directory Traversal Vulnerability
BugTraq ID: 9121
Remote: Yes
Date Published: Nov 27 2003
Relevant URL: http://www.securityfocus.com/bid/9121
Summary:
Bitfolge snif is a script designed to generate web server directory
indices.

snif has been reported prone to a directory traversal issue. The issue is
likely due to a lack of sufficient sanitization performed on 'download'
URI parameters passed to the snif script. It has been reported that by
passing directory traversal sequences '../..' as a value for the
'download' URI parameter an attacker may break out of the web root and may
download web server readable files.

An attacker may use information harvested in this manner to aid in further
attacks launched against the target system.

This vulnerability has been reported to affect sniff 1.2.5 and prior
versions.

39. phpBB search.php SQL Injection Vulnerability
BugTraq ID: 9122
Remote: Yes
Date Published: Nov 27 2003
Relevant URL: http://www.securityfocus.com/bid/9122
Summary:
phpBB is an open-source web forum application that is written in PHP and
supported by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

A vulnerability has been reported to exist in the software that may a
remote user to inject malicious SQL syntax into database queries.  The
problem reportedly exists in the 'search_id' parameter of search.php
script.  This issue is caused by insufficient sanitization of
user-supplied data. A remote attacker may exploit this issue to influence
SQL query logic to disclose sensitive information that could be used to
gain unauthorized access.

A malicious user may influence database queries in order to view or modify
sensitive information potentially compromising the software or the
database.

phpBB version 2.06 has been prone to this issue, however other versions
may be affected as well.


III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Nachi worm infected Diebold ATMs
By: Kevin Poulsen

Windows-based cash machines suffer from the same security holes as servers
and desktops.

http://www.securityfocus.com/news/7517

2. Exploit Code on Trial
By: Kevin Poulsen

Security researchers and vendors ponder the ethics of releasing
proof-of-concept code for software vulnerabilities.

http://www.securityfocus.com/news/7511

3. New charges in Lowe's wi-fi hacks
By: Kevin Poulsen

One hacker allegedly confesses, two inform on a third, and prosecutors put
a new defendant in the car.

http://www.securityfocus.com/news/7507

4. .name registry site hacked
By: Kieren McCarthy, The Register

http://www.securityfocus.com/news/7541

5. Reseller touts home WLAN pack with easy to use security
By: Tony Smith, The Register

http://www.securityfocus.com/news/7534

6. Police arrest ID thief in Wells Fargo case
By: John Leyden, The Register

http://www.securityfocus.com/news/7532


IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Sentry Firewall CD-ROM v1.5.0-rc7(dev)
By: Obsid
Relevant URL: http://www.SentryFirewall.com/
Platforms: Linux
Summary:

Sentry Firewall CD-ROM Version 1.0 is a Linux based bootable CD-ROM
suitable for use as an inexpensive and easy to maintain Firewall or
IDS(Intrusion Detection System) Node. The system is designed to be
immediately configurable for a variety of different operating environments
via a configuration file located on a floppy disk or a local hard drive.

2. AstroFlowGuard Bandwidth & Security Management v1.005
By: NetSoft.Inc
Relevant URL: http://www.netsoft.co.za
Platforms: Os Independent
Summary:

AstroFlowGuard is a Linux-based bandwidth manager, stateful firewall,
intrusion detection system, and VPN server. With its user-friendly
interface, automatic failover, and smart recovery system, it is the
complete tool for anyone wanting to manage bandwidth and network security.
It uses a hierarchical class-based system which provides a logical,
intuitive view of network classes along with their priorities. It has the
ability to manage P2P applications such as Kazaa and the like, manage
firewall and bandwidth by time of the day, precedence, strings in any
packet, and much more. Diagnose your network by powerful reporting tools
that drill down to IP, port, and protocol level with graph and pie charts.
It is a self-contained system that offers simple installation by means of
a bootable CD and ease of use via a Web based GUI.

3. SILC (Secure Internet Live Conferencing)(client) v1.0
By: priikone
Relevant URL: http://silcnet.org/
Platforms: Linux, UNIX
Summary:

SILC Client package is intended for end users who are looking for a good
and full featured SILC client. The SILC Client package currently includes
Irssi-SILC client that supports all SILC features, themes and much more.
It is curses based but has a possibility of adding various other frontends
to it. The Irssi-SILC client's user interface is based on the Irssi client
(see Irssi project).

4. CleanPOP v1.0
By: Gary Gurevich <[email protected]>
Relevant URL: http://cleanpop.sourceforge.net/
Platforms: Os Independent
Summary:

CleanPOP logs into a POP3 server and deletes messages which have had a
local (or remote) spam header added to them, as well as messages that have
been on the server for longer than a user-configurable amount of time. It
helps you keep your POP3 mailbox clean, so you can use Webmail or download
messages from your POP3 server to other machines without having to deal
with spam. It correlates messages from your local mbox file with messages
on the POP3 server, which means that you can use local antispam solutions
to clean your remote inbox, and it never deletes an unfetched message,
unlike other mail expiration scripts.

5. ThePacketMaster Linux Security Server v1.0.1
By: thepacketmaster
Relevant URL: http://www.thepacketmaster.com/
Platforms: Linux
Summary:

ThePacketMaster Linux Security Server is a CD- based security auditing
tool that boots and runs penetration testing and forensic analysis tools.
It is handy for security auditors. Some tools included are nessus,
ethereal, The Coroner's Toolkit, chntpw, and minicom. It includes modules
for any Linux 2.4.20 SCSI driver.

6. Fast Logging Project for Snort v1.0
By: DG  <[email protected]>
Relevant URL: http://www.geschke-online.de/FLoP
Platforms: Linux, Solaris, SunOS
Summary:

FLoP is designed to gather alerts with a payload from distributed Snort
sensors at a central server, and to store them in a database (PostgreSQL
and MySQL are supported). On the sensor, the output is written via a Unix
domain socket to a process called sockserv. This process is threaded; one
receives and buffers the alert packets, and the other thread forwards them
to a central server. With this approach, the output is decoupled from
Snort, which can proceed in sniffing instead of waiting for the output
plugins. At the central server, a process called servsock gathers all
alerts from the remote sensors and feeds them via a Unix domain socket to
the database. All alerts are buffered to avoid blocking due to a hanging
database access (or a slow network on the senor side). A short description
of alerts with high priority together with the database ID can be sent via
email to a list of recipients.


V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Looking for a position in Australia (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345906

2. Baltimore, MD - Security, Vulnerability, Networking (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345903

3. Incident Response Software- Federal Account Executiv... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345899

4. US ARMY Account Executive- Security Management-  VA/... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345898

5. Security Analysts, DC Metro Area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345801

6. List closure for the holidays (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345774

7. Information Security Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345748

8. Threat/Incident Analyst, Calgary AB, Symantec (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345741

9. Position: Security Consultant (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345740

10. Software Engineer - Calgary AB Canada, Symantec (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345731

11. VP of Sales Need - Security background required / Sa... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345688

12. Manager of Security Monitoring and Compliance positi... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345687

13. DC Area Senior Presales Consultant--Computer Assoica... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345639

14. Seeking Entry-Level Position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345547

15. Technical Evangelist Needed for Network Associates (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345546

16. IT Security Government Sales Manager required for EM... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345545

17. Security Software Direct Sales Job opening - midwest (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345544

18. Direct Sales position available- midwest region (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345543

19. Harrah's Entertainment (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345542

20. Incident Response Team Lead,   Silver Spring, MD   $... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345541

21. Security Specialists required for Auckland (New Zeal... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345486

22. Cryptography and INFOSEC Positions (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/345480


VI. INCIDENTS LIST SUMMARY
--------------------------
1. Chunked encoding worm on tcp/80 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/345701

2. Strange SNMP probes suddenly appearing (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/345638


VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Win32 Shellcode question. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/345976

2. Applied Watch Response to Bugtraq.org post - Was: Mu... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/345956

3. Multiple Remote Issues in Applied Watch IDS Suite(ad... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/345955

4. Multiple Remote Issues in Applied Watch IDS Suite (a... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/345927

5. Can you exploit this XSS? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/345720

6. win32 bof question (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/345509


VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. are my binaries being exposed on my ASP.NET website? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345894

2. local admin account password (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345893

3. how do I force secure ASP.NET session cookies? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345782

4. Strange behaviour of MS SQL 2000 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345550

5. IIS traffic (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345549

6. SecurityFocus Microsoft Newsletter #164 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345505

7. Administrivia: Article Announcements (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345503

8. TS group policy / hide notification area (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345489

9. Article Announcement: Busting the Worm Writers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345487

10. Betr.: Strange behaviour of MS SQL 2000 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/345444


IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Administrivia:  Your Responses (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/345797

2. New SecurityFocus Articles (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/345795

3. Sunscreen cluster: "You must log in before using the... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/92/345682


X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Administrivia:  Your responses (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/345796

2. New SecurityFocus articles (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/345794


XI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Tenable Security

Tenable provides security software which enables enterprises to
distribute, manage, and communicate vulnerability and intrusion detection
information across the entire organization.  Tenable's breakthrough
Lightning(tm) technology elegantly simplifies the complex nature of
network security by offering detailed useable reports for network and
security administrators and high-level organizational reports for CxOs.
In addition, Tenable offers both active (NeWT) and passive (NeVO)
vulnerability detection solutions to further enhance your network
vulnerability identification. For more information, Tenable can be
reached at 410-872-0555 or on the Internet at
http://www.securityfocus.com/sponsor/TenableSecurity_sf-news_031201
------------------------------------------------------------------------