SecurityFocus Newsletter #226

SecurityFocus Newsletter #226
------------------------------
This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_sf-news_031103 and use priority
code SF4.
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Home User Security: Personal Firewalls
     2. Debian's Response
     3. Simulating and optimising worm propagation algorithms (PDF)
     4. The Rise of the Spammers
II. BUGTRAQ SUMMARY
     1. OpenCA Signature Verification Vulnerabilities
     2. Applied Watch Command Center Authentication Bypass Vulnerabi...
     3. SuSE XScreenSaver Package Multiple Vulnerabilities
     4. PieterPost Unauthorized E-mail Account Access Vulnerability
     5. Apache mod_python Module Malformed Query Denial of Service V...
     6. CuteNews Debug Query Information Disclosure Weakness
     7. IlohaMail User Parameter Cross-Site Scripting Vulnerability
     8. Surfboard Web Server File Disclosure Vulnerability
     9. Virtual Programming VP-ASP shopsearch.asp SQL Injection Vuln...
     10. Virtual Programming VP-ASP shopdisplayproducts.asp SQL Injec...
     11. MoinMoin Unspecified Cross-Site Scripting Vulnerability
     12. Alabanza AlaCart Administration Authentication Bypass SQL In...
     13. Sun Cluster TCP Port Conflict Denial Of Service Vulnerabilit...
     14. Linux Kernel do_brk Function Boundary Condition Vulnerabilit...
     15. Jason Maloney's Guestbook Remote Command Execution Vulnerabi...
     16. IBM Directory Server Web Administration Interface Cross-Site...
     17. HP-UX Shar Utility Predictable Temporary File Creation Vulne...
     18. Cisco Aironet Access Point Wired Equivalent Privacy Key Disc...
     19. GnuPG External HKP Format String Vulnerability
     20. Yahoo! Messenger YAuto.DLL Open Buffer Overflow Vulnerabilit...
     21. Sun ONE/iPlanet Web Server Unspecified Denial of Service Vul...
     22. Sun Solaris XSun Direct Graphics Access Insecure Temporary F...
     23. Linux Kernel Concurrent Threaded Function Calls Local Denial...
     24. Websense Enterprise Blocked Sites Cross-Site Scripting Vulne...
     25. Multiple EZPhotoShare Memory Corruption Vulnerabilities
     26. XBoard PXBoard Script Insecure Temporary File Creation Vulne...
     27. Linksys WRT54G Router Blank HTTP GET Request Denial Of Servi...
     28. RSync Daemon Mode Undisclosed Remote Heap Overflow Vulnerabi...
     29. Linux Kernel 2.4 RTC Handling Routines Memory Disclosure Vul...
     30. Alan Ward A-Cart Register.ASP Script Injection Vulnerability
III. SECURITYFOCUS NEWS ARTICLES
     1. FTC investigates PetCo.com security hole
     2. Heckenkamp Challenges Computer Ban
     3. Nachi worm infected Diebold ATMs
     4. NatWest warns of dodgy email
     5. New computer virus variant floods Web sites of anti-spam act...
     6. Retail hacker sentenced to 1 1/2 years in prison
IV. SECURITYFOCUS TOP 6 TOOLS
     1. ThePacketMaster  v1.1.0
     2. CommNav Systems Navigator v4.2
     3. Firewall Builder v1.1.1
     4. JSch v0.1.11
     5. Yet Another antiVirus Recipe v1.8.3
     6. DansGuardian v2.7.6-3(unstable)
V. SECURITYJOBS LIST SUMMARY
     1. Security Engineer Wanted - Charleston, SC (Thread)
     2. Symantec Looking for Security Analysts for SOC - Ale... (Thread)
     3. IT Auditor w/Info-Sec Background -- Charlotte, NC --... (Thread)
     4. Probing for Security Job in Florida-CCSP/CCNP/high l... (Thread)
     5. Internal process controls in LA (Thread)
     6. Chief Security Architect, London, UK (Thread)
     7. Needed: Consulting Engineers (pre/post sales) in NYC... (Thread)
     8. Security Slot Open in Wash DC - Need Minimum of 4 Ye... (Thread)
     9. Senior Security Software Developer/Analyst South Flo... (Thread)
     10. Security Policy Consultant, London, UK (Thread)
     11. Update! (3) Security Remediation Analysts needed in ... (Thread)
     12. Update! (3) QA Remediation Analysts needed in Dallas... (Thread)
     13. No rust here (Thread)
     14. Do not read* (Thread)
     15. Network & Security Technologies Seeking Senior Secur... (Thread)
     16. Network Security Focused Technical Presentation Posi... (Thread)
     17. Junior-level position sought in Northern California (Thread)
     18. MSDN Developer Security Presenter: Microsoft Team (Thread)
     19. NEEDED - PRODUCT MARKETING PROFESSIONALS FOR IDS TEA... (Thread)
     20. Virus Analyst Position (1) (Thread)
     21. (3) Security QA remediation engineers NEEDED (Thread)
     22. Remediation Analysts needed for fast growing Securit... (Thread)
     23. CISSP available for senior level infosec engagements... (Thread)
     24. Junior- eng.-North America-Europe (Thread)
     25. IT Security Government Sales Manager for the North A... (Thread)
     26. IT Security Analyst - Security Vulnerability Identif... (Thread)
     27. Manager, Computer Security Incident Response Team, L... (Thread)
     28. Seeking Security or Admin  Position in the Washingto... (Thread)
     29. DC area, technical Presales SE with network security... (Thread)
     30. Senior Consultant (Thread)
     31. Corporate Account Manager (Thread)
     32. Wanted: Senior Network Security Professional (Thread)
     33. DC Area Senior Presales Consultant--Computer Assoica... (Thread)
     34. PRODUCT MANAGER - NJ (Thread)
     35. Looking for Entry Level - Threat, Vulnerability, & I... (Thread)
     36. Potential Senior Sales Person (Thread)
     37. Security Jobs - Multiple Openings in VA, CA, MD and ... (Thread)
     38. DC Metro - Sales - Security Software - Fed DOD (Thread)
     39. Resume: CISSP  with 6 year telecom/ISP background (Thread)
     40. Wanted: Technical Product Manager / Software -- Los ... (Thread)
     41. Sales Representative Opportunity at Core Security Te... (Thread)
     42. Information Security Policy Analyst - Washington DC (Thread)
     43. Government Sales DC (Thread)
VI. INCIDENTS LIST SUMMARY
     1. udp and dst port 1026 (Thread)
     2. FORCDOS.EXE (Thread)
     3. PopAdStop (was dst port 1026) (Thread)
     4. Flood of bad DNS queries (Thread)
     5. Anyone seen tgcmd.exe before? (Thread)
     6. Strange SNMP probes suddenly appearing (Thread)
     7. Same sequence... Resolved (Thread)
     8. Same sequence... (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
     1. Internet Explorer JavaScript insecure function (Thread)
     2. Black Hat Briefings Amsterdam Call for Papers (Thread)
     3. burneye, how i can defeat it? (Thread)
     4. [PenTest] Re: Win32 Shellcode question. (Thread)
     5. Win32 Shellcode question. (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
     1. ANNOUNCE: PatchManagement mailing list (Thread)
     2. Determining JetAdmin versions for vulnerability audi... (Thread)
     3. Comments on 5 IE vulnerabilities (Thread)
     4. FW: Comments on 5 IE vulnerabilities (Thread)
     5. Hiding MS SQL databases in Enterprise Manager (Thread)
     6. SecurityFocus Microsoft Newsletter #165 (Thread)
     7. Article Announcement: The Wells Fargo Example (Thread)
     8. local admin account password (Thread)
IX. SUN FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2003-12-01 to 2003-12-08.
X. LINUX FOCUS LIST SUMMARY
     1. Password Questions (Thread)
     2. FW: tripwire (Thread)
     3. tripwire (Thread)
     4. anti-ptrace (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Home User Security: Personal Firewalls
By Sarah Granger

This article discusses personal firewall alternatives, including freeware
firewalls, firewalls included with current Microsoft and Apple OSes, and
various commercial offerings of interest to the home user.

http://www.securityfocus.com/infocus/1750

2. Debian's Response
By Scott Granneman

Debian's response to the recent compromise of four debian.org machines was
quick, open and honest, and they also engaged other Linux vendors.
Companies and organizations, as well as other OS vendors, should take
note.

http://www.securityfocus.com/columnists/202

3.Simulating and optimising worm propagation algorithms (PDF)
by Tom Vogt

This paper describes a series of simulations run to estimate various worm
growth patterns and their corresponding propagation algorithms. It also
tests and verifies the impact of various improvements, starting from a
trivial simulation of worm propagation and the underlying network
infrastructure to more re ned models, it attempts to determine the
theoretical maximum propagation speed of worms and how it can be achieved.
It also estimates the impact a malicious worm could have on the overall
infrastructure.

http://www.securityfocus.com/data/library/WormPropagation.pdf

4.The Rise of the Spammers
by David Barroso Berrueta

Spammers are becoming more intelligent and more difficult to detect, which
is a strange issue, just because in my opinion, an intelligent person is
smart enough for not bothering millions of people. So, why these people
keep on helping unethical companies and individuals that send out
unsolicited e-mails? The reason should be simple and common these days:
money.

http://www.securityfocus.com/guest/24043


II. BUGTRAQ SUMMARY
-------------------
1. OpenCA Signature Verification Vulnerabilities
BugTraq ID: 9123
Remote: Yes
Date Published: Nov 28 2003
Relevant URL: http://www.securityfocus.com/bid/9123
Summary:
Multiple flaws have been reported in OpenCA which cumulatively could cause
a revoked or expired certificate to be accepted.  This could present a
serious security risk in situations where digital signatures are used to
verify the authenticity of content or in access validation.

The following specific flaws have been reported by the vendor:

A function in the crypto-utils.lib that is used to determine the serial
for a PKCS#7 signature uses the interface of the OpenCA::PKCS7 module in
an incorrect manner.

The crypto-utils.lib library also uses all of the certificates which are
included in a signature to create a X.509 object for the signer's
certificate.  This reportedly results in an object that was created from
one of the certificates in the certificate chain.

The OpenCA::PKCS7 module uses an incorrect regular expression to detect
lines which are not associated with the parsing of the certificate chain.

OpenCA::PKCS7 also used an incorrect regular expression to parse the
serial in the certificate chain, causing uppercase letters like A, B, C,
D, E, and F to be ignored.

The result of these issues is that a malicious party in possession of a
revoked or expired certificate could possibly sign something that may
verify, which can be abused to establish a false sense of trust, leading
to a variety of other attacks.

2. Applied Watch Command Center Authentication Bypass Vulnerabi...
BugTraq ID: 9124
Remote: Yes
Date Published: Nov 28 2003
Relevant URL: http://www.securityfocus.com/bid/9124
Summary:
Applied Watch Command Center is an application used to command and control
Snort IDS.  The Command Center package is composed of an agent to grab
Snort logs, a server and a user console.

An access validation vulnerability has been identified in the system that
may allow an attacker to bypass authentication to add attacker supplied
IDS alerts and add user new accounts.

It has been reported that this flaw may allow a remote attacker on a
network running the vulnerable software to bypass authentication on
Applied Watch Command Center console in order to add new user accounts.
Another consequence of this issue allows an attacker to add IDS alerts to
all sensors on a vulnerable network.  This attack may allow a malicious
person to confuse an administrator by generating false negatives,
therefore subverting identification.

Although it has not yet been confirmed, it has been speculated that the
problem lies in the protocol implementation. Specifically, a vulnerable
Command Center may erroneously assume that a remote host transmitting
specific protocol data has already been authenticated, and allow the host
to carry out various privileged actions.

Successful exploitation of these issues may allow an attacker to gain
unauthorized access to a vulnerable system or conceal intrusion attempts.
User accounts created by the attacker may be used to further compromise a
system.

Proof of concept exploits have been made available for this issue.

3. SuSE XScreenSaver Package Multiple Vulnerabilities
BugTraq ID: 9125
Remote: No
Date Published: Nov 28 2003
Relevant URL: http://www.securityfocus.com/bid/9125
Summary:
The xscreensaver program waits until the keyboard and mouse have been idle
for a configurable duration of time and then outputs graphics to the
screen. xscreensaver can be configured to lock the screen and will prompt
for authentication credentials to unlock the screen and peripherals.

SuSE have reported that xscreensaver packages shipped with SuSE Linux 9.0
are prone to multiple vulnerabilities. These issues include a crash when
xscreensaver is handling the verification of authentication credentials,
although unconfirmed it has been conjectured that this crash is likely due
to a memory corruption condition. SuSE has also reported that xscreensaver
is prone to several insecure temporary file creation vulnerabilities, an
attacker may exploit these issues to potentially elevate system
privileges.

SuSE fixes are pending for these issues and it is likely that more
technical information will be made available with the release of an
official advisory.  This BID will be updated appropriately at that time.

4. PieterPost Unauthorized E-mail Account Access Vulnerability
BugTraq ID: 9128
Remote: Yes
Date Published: Nov 29 2003
Relevant URL: http://www.securityfocus.com/bid/9128
Summary:
PieterPost is a web interface application designed to allow remote users
access to POP3 mailboxes. This interface can also be used to transmit
e-mails and is said to run on all systems that support PHP.

A vulnerability has been reported in PieterPost. The problem is said to
lie in the fact that no authentication is required when attempting to log
in as the 'virtual' user. This could potentially allow an unauthorized
person to make use of the interface for the purpose of sending "spoofed"
e-mails.

The affected login mechanism can allegedly be accessed by supplying the
'action=login' parameter to the pp.php script file.

This issue is said to affect PieterPost 0.10.6, however it is likely that
other versions are also vulnerable.

5. Apache mod_python Module Malformed Query Denial of Service V...
BugTraq ID: 9129
Remote: Yes
Date Published: Nov 29 2003
Relevant URL: http://www.securityfocus.com/bid/9129
Summary:
Apache's mod_python is a module which allows the web server to interpret
Python scripts. mod_python supports Apache 1.3.x and 2.x, and is available
for Windows, Linux and most Unix systems.

Apache has reported that some versions of mod_python may be prone to
denial of service attacks when handling malformed queries. The details
regarding this vulnerability are currently unknown, however the vendor has
stated that a remote user may be capable of crashing a vulnerable Apache
server.

This issue has been addressed in the 3.0.4 and 2.7.9 releases of the
module.

When further information regarding the technical details of this issue are
made available, this BID will be updated accordingly.

6. CuteNews Debug Query Information Disclosure Weakness
BugTraq ID: 9130
Remote: Yes
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9130
Summary:
CuteNews is a news management system implemented in PHP.

An information disclosure weakness has been reported in CuteNews 1.3, that
may expose sensitive server configuration data. The problem occurs due to
CuteNews' handling of debug queries.

Specifically, this issue can be triggered by passing the 'debug' parameter
to the index.php script file. The parameter will be handled by carrying
out a sequence of operations, which includes a call to phpinfo().

A malicious person could potentially use information harvested through the
exploitation this type of issue to launch future attacks against a target
system.

It should be noted that, it is not yet known whether this issue will occur
in all configurations of CuteNews, or only those in some form of debug
mode. These details will be clarified as further information is made
available.

Although this issue was reported for CuteNews 1.3, it is likely that other
versions are also affected.

7. IlohaMail User Parameter Cross-Site Scripting Vulnerability
BugTraq ID: 9131
Remote: Yes
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9131
Summary:
IlohaMail is a freely available, open source web e-mail package.  It is
available for the Unix and Linux platforms.

A problem in the handling of user-supplied parameters has been identified
in IlohaMail.  Because of this, it may be possible for an attacker to
execute malicious script code in the browser of target victims.

The problem is in the filtering of user-supplied input in the user
parameter.  An attacker could create a URI containing HTML or script in
this parameter that, when visited by the target victim, would result in
the execution of code in the security context of the site hosting the
vulnerable IlohaMail implementation.

8. Surfboard Web Server File Disclosure Vulnerability
BugTraq ID: 9132
Remote: Yes
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9132
Summary:
Surfboard is a freely available web server implementation for Unix/Linux
variants.

Surfboard is reported to be prone to directory traversal attacks.  By
submitting directory traversal sequences in a web request, it is possible
to break out of the server root directory and browse the file system.  A
remote attacker may exploit this vulnerability to gain access to sensitive
server-readable files on the system hosting the software.

Successful exploitation could allow an attacker to gain access to
sensitive information that may be useful when launching further attacks
against a system hosting the vulnerable software.

9. Virtual Programming VP-ASP shopsearch.asp SQL Injection Vuln...
BugTraq ID: 9133
Remote: Yes
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9133
Summary:
VP-ASP is a Web-based shopping cart system designed for online retailers.

A vulnerability has been reported to exist in the software that may allow
a remote user to inject malicious SQL syntax into database queries. The
problem is reported to exist due to insufficient sanitization of
user-supplied data in the 'shopsearch.asp' script. A remote attacker may
exploit this issue to influence SQL query logic to disclose sensitive
information that could be used to gain unauthorized access.

A malicious user may influence database queries in order to view or modify
sensitive information potentially compromising the software or the
database.

VP-ASP version and 4.50 and 5.0 have been reported to be prone to this
issue.

10. Virtual Programming VP-ASP shopdisplayproducts.asp SQL Injec...
BugTraq ID: 9134
Remote: Yes
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9134
Summary:
VP-ASP is a Web-based shopping cart system designed for online retailers.

A vulnerability has been reported to exist in the software that may allow
a remote user to inject malicious SQL syntax into database queries. The
problem is reported to exist due to insufficient sanitization of
user-supplied data in the 'shopdisplayproducts.asp' script. A remote
attacker may exploit this issue to influence SQL query logic to disclose
sensitive information that could be used to gain unauthorized access.

A malicious user may influence database queries in order to view or modify
sensitive information potentially compromising the software or the
database.

VP-ASP version and 4.50 and 5.0 have been reported to be prone to this
issue.

11. MoinMoin Unspecified Cross-Site Scripting Vulnerability
BugTraq ID: 9135
Remote: Yes
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9135
Summary:
MoinMoin is a Wiki-type program written in Python.  It is available for
the Unix and Linux platforms, and is freely-available and open source.

Problems have been identified in the handling of some types of input by
MoinMoin.  Because of this, an attacker may be able to execute code in the
browser of target victims.

Specific details concerning the issue are not available.  Like any
cross-site scripting attack, this issue is conjectured to require the
click of a malicious link by a target victim, which in turn executes
script code in the security context of the site hosting the vulnerable
software.  This Bugtraq ID will be updated if more information is made
available.

12. Alabanza AlaCart Administration Authentication Bypass SQL In...
BugTraq ID: 9136
Remote: Yes
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9136
Summary:
Alabanza AlaCart is a full-featured Shopping Cart software suite,
developed by Alabanza.

It has been reported that AlaCart Shopping Cart is prone to SQL injection
attacks. The problem occurs when handling user-supplied username and
password data supplied to authentication procedures. Specifically, AlaCart
fails to escape SQL content contained within a users username and password
before including it within an SQL statement.

To exploit this vulnerability, an attacker may inject the username and
password with specially formatted SQL code such as ('or') or ('='), and
effectively manipulate the logic of the statement. When the statement
execution is completed, the attacker will be successfully logged in as an
administrator.

The exploitation of this issue could ultimately allow an attacker to log
in as an administrator. This could potentially expose sensitive
information to the attacker, possibly including user credentials and
financial information.

13. Sun Cluster TCP Port Conflict Denial Of Service Vulnerabilit...
BugTraq ID: 9137
Remote: No
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9137
Summary:
Sun Cluster is the high-availability software package maintained and
distributed by Sun Microsystems.  It is available for the Unix platform.

A vulnerability has been discovered in the handling of some applications
on local systems in a Sun Cluster.  Because of this, it is possible for an
attacker to create a denial of service.

The problem is in the handling of ports by the Sun Cluster software, and
requires the OPS/RAC packages installed.  An attacker on a local system in
the cluster could execute an application that binds to a TCP port, limited
to use of ports as defined by standards.  If an application were bound to
a port used by DLM, a denial of service to systems in the cluster could
result.

14. Linux Kernel do_brk Function Boundary Condition Vulnerabilit...
BugTraq ID: 9138
Remote: No
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9138
Summary:
do_brk() is a function called indirectly by a number of kernel procedures,
including the brk() system call and the ELF and a.out loading mechanisms.
The do_brk() function is used to shrink and expand anonymous
(uninitialized) heap memory for a given process.

On Linux systems, each process is granted limited access to a specific
range of virtual memory, ranging from 0 to that defined by the TASK_SIZE
variable. This range is further subdivided into logical sections; these
sections may also be referred to as virtual memory areas. The contents of
memory outside of this range is deemed inaccessible to userland and is
used to store the kernel code and its various data structures, this region
of memory is protected with page protection mechanisms.

A flaw has been discovered in the do_brk() function when handling
user-supplied addresses. By passing a specially formatted address, it may
be possible to gain access to an anonymous map of memory exceeding the
TASK_SIZE limit and extending into a region of protected memory used by
the kernel. As a result, an attacker may be capable of ultimately reading
or writing to almost arbitrary kernel memory, allowing for reliable
attacks against vulnerable systems. It has been reported that it is also
possible to reliably exploit this issue on systems running memory
protection mechanisms such as grsecurity.

It should be noted that the impact of these type of vulnerabilities are
exaggerated by the fact that they can be coupled with less severe remote
vulnerabilities to allow for effective remote root exploits, including
chroot() breaking and other facilities.

This issue was addressed in release 2.4.23-pre7 and 2.6.0-test6 of the
Linux kernel. All prior versions are believed to be vulnerable.

15. Jason Maloney's Guestbook Remote Command Execution Vulnerabi...
BugTraq ID: 9139
Remote: Yes
Date Published: Dec 01 2003
Relevant URL: http://www.securityfocus.com/bid/9139
Summary:
Jason Maloney's Guestbook is a CGI web guestbook application.

A vulnerability has been reported in Jason Maloney's Guestbook that could
result in remote command execution with the privileges of the web server.
The problem occurs due to the application failing to sanitize sensitive
script variables after handling POST requests. Specifically, the
$mailprog, $entry, $allow, and $date_command are able to be influenced by
an attacker. The $mailprog and $date_command each point to system
executables and are used to execute commands.

An attacker who is capable of influencing the contents of these variables
may be capable of executing arbitrary system commands with the privileges
of the web server. This could ultimately lead to arbitrary code execution.

This issue is said to affect release 3.0, however earlier versions are
likely vulnerable as well.

Conflicting reports have been received alleging that this issue is not in
fact a vulnerability and that it is not possible to influence the
reportedly vulnerable variables.

16. IBM Directory Server Web Administration Interface Cross-Site...
BugTraq ID: 9140
Remote: Yes
Date Published: Dec 02 2003
Relevant URL: http://www.securityfocus.com/bid/9140
Summary:
IBM Directory Server is an LDAP server that is available for numerous
platforms including HP-UX, Microsoft Windows and Linux.

IBM Directory Server is prone to cross-site scripting attacks.  It is
possible to embed hostile HTML and script code in a malicious link to the
server, which when followed will be rendered in the victim user's browser.
This vulnerability is known to exist in the web administrative interface
(ldacgi.exe), which does not sanitize HTML and script code that is
supplied via the 'Action' URI parameter.  Exploitation would occur in the
context of the server.

This could permit for theft of administrative cookie-based authentication
credentials or other attacks.  Exploitation could potentially compromise
the LDAP server.

This issue was reported in Directory Server 4.1.  Other versions may also
be affected.

17. HP-UX Shar Utility Predictable Temporary File Creation Vulne...
BugTraq ID: 9141
Remote: No
Date Published: Dec 02 2003
Relevant URL: http://www.securityfocus.com/bid/9141
Summary:
HP-UX is the UNIX operating system distributed and maintained by
Hewlett-Packard.

A problem has been identified in the shar utility distributed with HP-UX.
Because of this, it may be possible for a local attacker to launch
symbolic link attacks.

The problem is in the creation of temporary files.  When shar is executed,
it creates predictable, insecure files in the /tmp directory.
Additionally, the program does perform sufficient sanity checks to
determine whether or not files or symbolic links already exist in the
directory.  This could lead to the destruction of files on a local system,
and potentially privilege escalation.

18. Cisco Aironet Access Point Wired Equivalent Privacy Key Disc...
BugTraq ID: 9143
Remote: Yes
Date Published: Dec 02 2003
Relevant URL: http://www.securityfocus.com/bid/9143
Summary:
The Cisco Aironet appliance is a wireless LAN solution.

Cisco Aironet Access Points that are running Cisco IOS have been reported
prone to an information disclosure vulnerability that could lead to the
disclosure of wired equivalent privacy (WEP) keys.

The issue has been reported to exist if the 'snmp-server enable traps
wlan-wep' command has been set. The issue presents itself because when
this functionality is enabled the Cisco Aironet Access Point will send the
WEP key in a plain text format to the simple network management protocol
(SNMP) server. This will occur every time a WEP key is modified or the
Aironet Access Point is rebooted.

An attacker may exploit this issue by intercepting and disclosing wired
equivalent privacy keys that are in transit to the SNMP server.

It should be noted that dynamically configured WEP keys are not reported
to be affected by this vulnerability. The vendor has reported that a WEP
key is defined as dynamically configured if one of the supported
extensible authentication protocols(EAP) is used.

19. GnuPG External HKP Format String Vulnerability
BugTraq ID: 9144
Remote: Yes
Date Published: Dec 03 2003
Relevant URL: http://www.securityfocus.com/bid/9144
Summary:
GnuPG is prone to a remotely exploitable format string vulnerability in
the external HKP interface.  This is due to incorrect usage of fprintf()
in the gpgkeys_hkp.c, allowing format specifiers to be supplied by an
external source.  Format string vulnerabilities typically allow
attacker-supplied data to be written to an arbitrary location in memory,
allowing for execution of arbitrary code.  This issue could be exploited
by a malicious HKP keyserver while the software is retrieving a key.

It should be noted that the external HKP interface is not enabled by
default in the GnuPG 1.2 stable branch but has been enabled in the 1.3
development branch.

20. Yahoo! Messenger YAuto.DLL Open Buffer Overflow Vulnerabilit...
BugTraq ID: 9145
Remote: Yes
Date Published: Dec 03 2003
Relevant URL: http://www.securityfocus.com/bid/9145
Summary:
Yahoo! Messenger is a freely available chat client distributed and
maintained by Yahoo!  It is available for the Microsoft Windows platform.

A problem has been identified in the handling of some types of requests by
ActiveX controls installed with Yahoo! Messenger.  Because of this, it may
be possible for an attacker to execute arbitrary code on a vulnerable
host.

The problem is in the handling of strings by the Open() function.  Open()
is implemented in YAUTO.DLL with insufficient bounds checking.  By
supplying a string of arbitrary length to the function, it is possible to
force the overwriting of sensitive process memory with attacker-supplied
values.

A web page containing the CLSID of the vulnerable ActiveX control and an
exploitable string could potentially exploit this issue to execute code
with the privileges of the browser user.

21. Sun ONE/iPlanet Web Server Unspecified Denial of Service Vul...
BugTraq ID: 9146
Remote: Yes
Date Published: Dec 02 2003
Relevant URL: http://www.securityfocus.com/bid/9146
Summary:
Sun ONE Web Server is a web server implementation that is maintained by
Sun Microsystems. It has been rebranded from iPlanet.

Sun has reported the Sun ONE and iPlanet Web Servers running on the
Windows platform are prone to a remotely exploitable denial of service
vulnerability. Exploitation of this issue will cause the server to crash.
This could be exploited to deny the availability of services to legitimate
users of an affected server.

This issue affects Sun ONE/iPlanet Web Server 4.1 Service Pack 12 and
earlier, as well as 6.0 Service Pack 5 and earlier.

Sun has not released further technical details about this issue. If
additional details are made available, this BID will be updated
accordingly.

22. Sun Solaris XSun Direct Graphics Access Insecure Temporary F...
BugTraq ID: 9147
Remote: No
Date Published: Dec 03 2003
Relevant URL: http://www.securityfocus.com/bid/9147
Summary:
Solaris is the freely available UNIX operating system implementation
distributed and maintained by Sun Microsystems.

A vulnerability has been identified in the Sun Solaris Xsun server when
using Direct Graphics Access functions.  This may make it possible for an
attacker to overwrite sensitive files.

The problem is in the insecure creation of temporary files.  Checking for
the existence of temporary files and symbolic links is inadequate, making
it possible for an attacker to create a file, or potentially destroy a
target system file.

It should be noted that the Xsun process is executed as root during the
course of dtlogin execution, making it possible to exploit this issue to
overwrite administrative files.  This could potentially allow for
privilege escalation, though this has not been confirmed.

23. Linux Kernel Concurrent Threaded Function Calls Local Denial...
BugTraq ID: 9148
Remote: No
Date Published: Dec 02 2003
Relevant URL: http://www.securityfocus.com/bid/9148
Summary:
A local denial of service vulnerability has been discovered in the Linux
kernel. The problem is said to occur due to an incorrect error return if a
fork() operation was carried out concurrently with a threaded exit() call.
Although unconfirmed, it is likely that the erroneous error value returned
might cause the kernel to believe that no error actually occurred and
subsequently carry out some operation that would cause it to panic.

Successful exploitation of this issue could result in a malicious
unprivileged userland application crashing a vulnerable system,
effectively denying service to all other users.

The precise technical details regarding this issue are currently unknown,
however this BID will be updated has further analysis is carried out on
the problem.

The affected version information regarding this issue has not yet been
confirmed. Please see the Solutions information for further details.

24. Websense Enterprise Blocked Sites Cross-Site Scripting Vulne...
BugTraq ID: 9149
Remote: Yes
Date Published: Dec 03 2003
Relevant URL: http://www.securityfocus.com/bid/9149
Summary:
Websense Enterprise is a filtering software that allows access to be
restricted to web sites, instant messaging and peer-to-peer networks.

When a blocked site is visited through Websense, the software will display
an error page that includes the URI of the blocked site that the user
attempted to access.  HTML and script code are not sufficiently sanitized
from the URI before it is displayed in the error page, making the software
prone to cross-site scripting attacks.  An attacker could exploit this
issue by enticing a user to follow a malicious link to a site that has
been blocked by Websense.

This could allow for theft of cookie-based authentication credentials.
Since an attacker can control how the page will be rendered to the user
visiting the link, other attacks are also possible.  Considering the
nature of the software, an attacker could exploit this issue to redirect
the user to a site that is posing as a blocked site as well, since an
attack could easily be engineered which could cause the user to believe
they are visiting a site that has been blocked by the software.

25. Multiple EZPhotoShare Memory Corruption Vulnerabilities
BugTraq ID: 9150
Remote: Yes
Date Published: Dec 03 2003
Relevant URL: http://www.securityfocus.com/bid/9150
Summary:
eZphotoshare, is software that is designed to provide for sharing digital
photos across a network.

eZphotoshare has been reported prone to multiple remote memory corruption
vulnerabilities. The issues present themselves in the routines employed by
eZphotoshare to handle network based communications. It has been reported
that a remote attacker may overrun the bounds of a reserved buffer in
eZphotoshare process memory by transmitting a number of malicious packets
or alternatively a packet containing excessive data, to port 10101 on host
that is running eZphotoshare.

This activity will ultimately result in the corruption of variables that
are saved adjacent to the affected buffer. These variables are crucial to
the operation of the vulnerable software. It has been reported that an
attacker may leverage these conditions to remotely execute arbitrary code
on the affected host, code execution would occur in the context of the
eZphotoshare software.

These issues have been reported to affect all versions of eZphotoshare.

26. XBoard PXBoard Script Insecure Temporary File Creation Vulne...
BugTraq ID: 9151
Remote: No
Date Published: Dec 03 2003
Relevant URL: http://www.securityfocus.com/bid/9151
Summary:
XBoard is a graphical user interfaces for chess. XBoard ships with a
script 'pxboard', this script is designed to save its standard input to a
temporary file, so as to allow a user to load a previous game or perform
other actions.

It has been reported that the pxboard script utility may be prone to
symlink attacks due to insecure temporary file creation. The problem
occurs due to the affected script placing a file within the world
accessible /tmp directory, and using a predictable naming convention.

As a result, an attacker may be capable of placing a symbolic link in the
/tmp directory, likely pointing to a critical system file. This will
effectively cause the script to carry out an operation on the file pointed
to by the link, rather than the expected file. The implications of
exploitation depend on the operation carried out on the file and the
privileges of the user invoking the pxboard script, however it may be
possible for an attacker to gain elevated privileges.

It should be noted that due to the nature of this issue, a successful
attack may be dependant on the time between the creation of, and the
operation carried subsequently carried out on, the temporary file.

This vulnerability has been reported to affect XBoard version 4.2.6 and
all previous versions.

27. Linksys WRT54G Router Blank HTTP GET Request Denial Of Servi...
BugTraq ID: 9152
Remote: Yes
Date Published: Dec 03 2003
Relevant URL: http://www.securityfocus.com/bid/9152
Summary:
The Linksys WRT54G, is a wireless router appliance, developed to meet
upcoming 54Mbps wireless networking standards. The router provides a web
server that is normally used to manage the router.

The Linksys WRT54G router has been reported prone to a denial of service
vulnerability while handling blank HTTP GET requests received on either
port 80 or port 8080. It has been reported that when the affected
appliance handles a request of this type the embedded web server will
halt, requiring the appliance to be power cycled in order to regain normal
functionality.

An attacker may exploit this condition to deny service to the affected
router.

It should be noted that while this vulnerability has been reported to
affect Linksys WRT54G appliances with firmware version 1.42.3 installed,
other firmware versions might also be affected.

28. RSync Daemon Mode Undisclosed Remote Heap Overflow Vulnerabi...
BugTraq ID: 9153
Remote: Yes
Date Published: Dec 04 2003
Relevant URL: http://www.securityfocus.com/bid/9153
Summary:
The rsync program is used to synchronize files and directory structures
across a network. It is commonly used to maintain mirrors of ftp sites,
often through anonymous access to the rsync server. It is available for
Linux and other Unix operating systems.

rsync has been reported prone to an undisclosed heap overflow
vulnerability when running in daemon mode. The issue has been reported to
be remotely exploitable and will provide for an execution of arbitrary
code. It has been reported that exploitation of this issue is made easier
if the "use chroot = no" option is set in the rsyncd.conf configuration
file.

There have been reports that this issue is being exploited in conjunction
with the Linux Kernel do_brk function boundary condition vulnerability
described in BID 9138. Customers are advised to apply fixes that address
the issue described in BID 9138.

This BID will be updated as further information regarding this
vulnerability is disclosed.

This vulnerability has been reported to affect rsync version 2.5.6 and
earlier versions.

29. Linux Kernel 2.4 RTC Handling Routines Memory Disclosure Vul...
BugTraq ID: 9154
Remote: No
Date Published: Dec 04 2003
Relevant URL: http://www.securityfocus.com/bid/9154
Summary:
The Linux kernel 2.4 tree has been reported prone to a memory disclosure
vulnerability. The issue is reported to present itself in kernel real time
clock interface procedures, and may result in kernel memory stack data
being leaked into userland when the RTC is read.  It is likely that this
data will be random.

An attacker may exploit this condition to disclose potentially sensitive
data such as credentials that may aid in further attacks against the
affected system.

Few details regarding this vulnerability are currently known. This BID
will be updated as further details are disclosed.

It should be noted that although this vulnerability has been reported to
affect the 2.4 kernel tree, other versions might also be affected.

30. Alan Ward A-Cart Register.ASP Script Injection Vulnerability
BugTraq ID: 9155
Remote: Yes
Date Published: Dec 04 2003
Relevant URL: http://www.securityfocus.com/bid/9155
Summary:
Alan Ward's A-Cart is a web based shopping cart application. It is
implemented in ASP, and designed for use with Microsoft Access under
Microsoft Windows based servers.

A problem has been identified in the handling of form input by Alan Ward's
A-Cart.  Because of this, it may be possible to inject HTML and script
into a vulnerable site.

The problem is in the checking of input in form fields.  When data is
entered into the fields of the register.asp script, the script does not
sufficiently validate input and sanitize potentially dangerous data.  An
attacker could exploit this problem to insert code directly into the
database, allowing the attacker to render code in the browser of victims
in the security context of the A-Cart site.


III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. FTC investigates PetCo.com security hole
By: Kevin Poulsen

A young programmer's discovery of a massive vulnerability at an e-commerce
site leads to a federal consumer privacy probe... again.

http://www.securityfocus.com/news/7581

2. Heckenkamp Challenges Computer Ban
By: Kevin Poulsen

Accused eBay hacker has been banned from the Internet for years without
being convicted of a crime.

http://www.securityfocus.com/news/7576

3. Nachi worm infected Diebold ATMs
By: Kevin Poulsen

Windows-based cash machines suffer from the same security holes as servers
and desktops.

http://www.securityfocus.com/news/7517

4. NatWest warns of dodgy email
By: Tim Richardson, The Register

http://www.securityfocus.com/news/7582

5. New computer virus variant floods Web sites of anti-spam act...
By: Anick Jesdanun, The Associated Press

http://www.securityfocus.com/news/7575

6. Retail hacker sentenced to 1 1/2 years in prison
By: , The Associated Press

http://www.securityfocus.com/news/7567


IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. ThePacketMaster  v1.1.0
By: thepacketmaster
Relevant URL: http://www.thepacketmaster.com/
Platforms: Linux
Summary:

ThePacketMaster Linux Security Server is a CD-based security auditing tool
that boots and runs penetration testing and forensic analysis tools. It is
handy for security auditors. Some tools included are nessus, ethereal, The
Coroner's Toolkit, chntpw, and minicom. It includes modules for any Linux
2.4.20 SCSI driver.

2. CommNav Systems Navigator v4.2
By: CommNav Inc    <[email protected]>
Relevant URL: http://www.commnav.com/products/systems_navigator.php
Platforms: IRIX, Linux, Solaris, SunOS
Summary:

Based on CommNav's Navigator portal architecture, Systems Navigator lets
you administer your entire network via a secure Web interface. It helps
protect your infrastructure with a set of monitoring and metric trending
tools including Big Brother, Orca, Nessus, Integrit, and Larrd. The portal
utilizes LDAP to store site-specific preferences for SysNav components.
These preferences are templated and then used by SysNav's middle layer to
generate Cfengine and component configuration files.

3. Firewall Builder v1.1.1
By: Vadim Kurland
Relevant URL: http://www.fwbuilder.org/
Platforms: FreeBSD, Linux, Solaris
Summary:

Firewall Builder consists of a GUI and set of policy compilers for various
firewall platforms. It helps users maintain a database of objects and
allows policy editing using simple drag-and-drop operations. The GUI and
policy compilers are completely independent, and support for a new
firewall platform can be added to the GUI without any changes to the
program (only a new policy compiler is needed). This provides for a
consistent abstract model and the same GUI for different firewall
platforms. It currently supports iptables, ipfilter, and OpenBSD pf.

4. JSch v0.1.11
By: ymnk <[email protected]>
Relevant URL: http://www.jcraft.com/jsch/
Platforms: Os Independent
Summary:

JSch is a pure Java implementation of SSH2. It allows you to connect to an
sshd server and use port forwarding, X11 forwarding, file transfer, etc.
You can integrate its functionality into your own Java programs.

5. Yet Another antiVirus Recipe v1.8.3
By: nikant
Relevant URL: http://agriroot.aua.gr/~nikant/nkvir/
Platforms: N/A
Summary:

Yet Another antiVirus Recipe is a procmail that helps to filter out a lot
of the most common e-mail worms. It detects worms with base-64 signatures
(such as Klez, Hybris, and BugBear), HTML IFRAME exploits, CLSID hidden
extension exploits, -XML code base exploits, executable extensions (bat,
pif, vbs, vba, scr, lnk, com, and exe), and macros for doc, dot, xls, and
xla files. It also detects most Nigerian scam e-mails.

6. DansGuardian v2.7.6-3(unstable)
By: Daniel Barron
Relevant URL: http://dansguardian.org/
Platforms: Linux
Summary:

DansGuardian is a Web content filtering proxy that uses Squid to do all
the fetching. It filters using multiple methods including, but not limited
to, phrase matching, file extension matching, MIME type matching, PICS
filtering, and URL/domain blocking. It has the ability to switch off
filtering by certain criteria including username, domain name, source IP,
etc. The configurable logging produces a log in an easy to read format. It
has the option to only log text-based pages, thus significantly reducing
redundant information (such as every image on a page).


V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Security Engineer Wanted - Charleston, SC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346717

2. Symantec Looking for Security Analysts for SOC - Ale... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346716

3. IT Auditor w/Info-Sec Background -- Charlotte, NC --... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346715

4. Probing for Security Job in Florida-CCSP/CCNP/high l... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346713

5. Internal process controls in LA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346711

6. Chief Security Architect, London, UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346710

7. Needed: Consulting Engineers (pre/post sales) in NYC... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346709

8. Security Slot Open in Wash DC - Need Minimum of 4 Ye... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346708

9. Senior Security Software Developer/Analyst South Flo... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346705

10. Security Policy Consultant, London, UK (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346704

11. Update! (3) Security Remediation Analysts needed in ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346519

12. Update! (3) QA Remediation Analysts needed in Dallas... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346515

13. No rust here (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346508

14. Do not read* (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346506

15. Network & Security Technologies Seeking Senior Secur... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346504

16. Network Security Focused Technical Presentation Posi... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346453

17. Junior-level position sought in Northern California (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346448

18. MSDN Developer Security Presenter: Microsoft Team (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346447

19. NEEDED - PRODUCT MARKETING PROFESSIONALS FOR IDS TEA... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346446

20. Virus Analyst Position (1) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346445

21. (3) Security QA remediation engineers NEEDED (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346444

22. Remediation Analysts needed for fast growing Securit... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346443

23. CISSP available for senior level infosec engagements... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346379

24. Junior- eng.-North America-Europe (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346377

25. IT Security Government Sales Manager for the North A... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346294

26. IT Security Analyst - Security Vulnerability Identif... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346292

27. Manager, Computer Security Incident Response Team, L... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346291

28. Seeking Security or Admin  Position in the Washingto... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346290

29. DC area, technical Presales SE with network security... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346289

30. Senior Consultant (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346288

31. Corporate Account Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346287

32. Wanted: Senior Network Security Professional (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346286

33. DC Area Senior Presales Consultant--Computer Assoica... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346285

34. PRODUCT MANAGER - NJ (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346284

35. Looking for Entry Level - Threat, Vulnerability, & I... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346283

36. Potential Senior Sales Person (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346282

37. Security Jobs - Multiple Openings in VA, CA, MD and ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346281

38. DC Metro - Sales - Security Software - Fed DOD (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346280

39. Resume: CISSP  with 6 year telecom/ISP background (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346082

40. Wanted: Technical Product Manager / Software -- Los ... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346078

41. Sales Representative Opportunity at Core Security Te... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346063

42. Information Security Policy Analyst - Washington DC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346061

43. Government Sales DC (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/346058


VI. INCIDENTS LIST SUMMARY
--------------------------
1. udp and dst port 1026 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/346757

2. FORCDOS.EXE (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/346756

3. PopAdStop (was dst port 1026) (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/346573

4. Flood of bad DNS queries (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/346567

5. Anyone seen tgcmd.exe before? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/346419

6. Strange SNMP probes suddenly appearing (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/346309

7. Same sequence... Resolved (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/346227

8. Same sequence... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/346214


VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Internet Explorer JavaScript insecure function (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/346824

2. Black Hat Briefings Amsterdam Call for Papers (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/346591

3. burneye, how i can defeat it? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/346207

4. [PenTest] Re: Win32 Shellcode question. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/346111

5. Win32 Shellcode question. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/346016


VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. ANNOUNCE: PatchManagement mailing list (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/346592

2. Determining JetAdmin versions for vulnerability audi... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/346338

3. Comments on 5 IE vulnerabilities (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/346266

4. FW: Comments on 5 IE vulnerabilities (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/346223

5. Hiding MS SQL databases in Enterprise Manager (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/346196

6. SecurityFocus Microsoft Newsletter #165 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/346120

7. Article Announcement: The Wells Fargo Example (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/346107

8. local admin account password (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/346048


IX. SUN FOCUS LIST SUMMARY
--------------------------
NO NEW POSTS FOR THE WEEK 2003-12-01 to 2003-12-08.

X. LINUX FOCUS LIST SUMMARY
---------------------------
1. Password Questions (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/346589

2. FW: tripwire (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/346470

3. tripwire (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/346205

4. anti-ptrace (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/346202


XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
[email protected] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer.
Alternatively you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.

If your email address has changed email [email protected] and
ask to be manually removed.


XII. SPONSOR INFORMATION
-----------------------
This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_sf-news_031103 and use priority
code SF4.
------------------------------------------------------------------------