SecurityFocus Newsletter #228
John Boletta <[email protected]> Mon, 22 Dec 2003 15:34:49 -0700 (MST)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #228
------------------------------
SecurityFocus.com would like to take this opportunity to express our
gratitude for your continued support. In the upcoming year we will improve
and grow so we can continue to provide you with all your essential
security resources.
We would also like to wish you all a great Holiday Season, and a
prosperous New Year.
-The staff at SecurityFocus.com
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Nessus, Part 2: Scanning
2. Securing Apache: Step-by-Step
3. Low-Level Enumeration With TCP/IP
II. BUGTRAQ SUMMARY
1. Computer Associates Unicenter Remote Control and Control IT ...
2. Computer Associates Unicenter Remote Control Host Privilege ...
3. Computer Associates Unicenter Remote Control Host Unspecifie...
4. Multiple Vendor IKE Implementation Certificate Authenticity ...
5. Multiple Vendor IKE Insecure XAUTH Implementation Vulnerabil...
6. lftp Try_Netscape_Proxy Buffer Overflow Vulnerability
7. osCommerce SQL Injection Vulnerability
8. lftp Try_Squid_Eplf Buffer Overflow Vulnerability
9. DameWare Mini Remote Control Server Pre-Authentication Buffe...
10. Markus Triska CGINews and CGIForum Information Disclosure Vu...
11. XLight FTP Server Tilde Remote Denial Of Service Vulnerabili...
12. Microsoft Internet Explorer Unspecified Remote Compromise Vu...
13. X-Chat Remote Denial of Service Vulnerability
14. MVDSV Quake Server Download Buffer Overrun Vulnerability
15. XLight FTP Server Unspecified Remote Directory Traversal Vul...
16. Doro PDF Writer Local Privilege Escalation Vulnerability
17. Multiple Cisco PIX Remote Denial Of Service Vulnerabilities
18. Multiple Cisco FWSM Vulnerabilities
19. Elektropost EPIServer Multiple Vulnerabilities
20. SEH InterCon Smart PrintServer Access Validation Vulnerabili...
21. Sun Solaris LPStat Unspecified Local Privilege Escalation Vu...
22. W-Agora Multiple Remote Vulnerabilities
23. Cyrus IMSP Daemon Remote Buffer Overflow Vulnerability
24. MacOSX CD9660.Util Probe For Mounting Argument Local Buffer ...
25. Invision Power Top Site List Offset SQL Injection Vulnerabil...
26. J2EE/RI Pointbase Database Remote Command Execution Vulnerab...
27. Aardvark Topsites PHP Multiple Vulnerabilities
28. Invision Power Board Index.PHP SQL Injection Vulnerability
29. Dada Mail Blank List Password Authentication Bypass Weakness
30. Dada Mail Unauthorized Mailing List Subscription Vulnerabili...
31. Michael Dean Double Choco Latte Multiple Module Remote File ...
32. X Design sipd Remote Format String Vulnerability
33. Ipswitch WS_FTP Server Resource Consumption Remote Denial Of...
34. osCommerce osCsid Parameter Cross-Site Scripting Vulnerabili...
35. GoAhead Webserver ASP Script File Source Code Disclosure Vul...
36. Dizzy unix2tcp Unspecified Buffer Overflow Vulnerability
37. Advanced Research Security Auditor Research Assistant Servic...
38. Botan Es_Unix Privilege Escalation Vulnerability
39. IBM DB2 Insecure DMS Directory Permissions Vulnerability
40. ECW-Shop Cat Parameter Cross-Site Scripting Vulnerability
41. CyberGuard Firewall/VPN 5.1 Cross-Site Scripting Vulnerabili...
42. DUware DUportal Multiple Vulnerabilities
43. SOLMETRA SPAW Editor spaw_control.class.PHP Remote PHP File ...
44. Ethereal SMB Protocol Dissector Denial of Service Vulnerabil...
45. Ethereal Q.931 Protocol Dissector Denial of Service Vulnerab...
46. Multiple ASPapp Portal Vulnerabilities
47. Autorank PHP Multiple SQL Injection Vulnerabilities
48. laitcg Pop 3 Scan Renattach Malicious Attachment Scanning By...
III. SECURITYFOCUS NEWS ARTICLES
1. Chats led to Acxiom hacker bust
2. Secret Service airbrushes aerial photos
3. Will VoIP be wiretap-ready?
4. In Norway, DVD hacker acquitted, again, on charges of piracy
5. Fears, abuse accompany proliferation of Internet maps
6. Tests confirm Atheros' Super G degrades rival WLANs
IV. SECURITYFOCUS TOP 6 TOOLS
1. Stealth HTTP Security Scanner v2.0b47
2. pmacct v0.5.4
3. GNU Transport Layer Security Library v1.0.2
4. nload v0.6.0
5. pam_usb v0.2-rc2
6. Squid Analyzer v2.0
V. SECURITYJOBS LIST SUMMARY
1. Lists are now closed for the Holidays (Thread)
2. Have referrals for Security SE in DC (Thread)
3. Information Security Consultancy Manager vacancy (Thread)
4. Infosec Lab Engineer (Thread)
5. White Hat Hacking in Houston (Thread)
6. Western Region Sales Exec./IPSEC (Thread)
7. Happy Holidays & HIPAA, HIPAA, HIPAA (Thread)
8. Canada - looking for ITsec experts (Thread)
9. Germany Networking & Security Positions (Thread)
10. IT Security Analyst - Charlotte, NC (Thread)
11. Atlanta, Chicago, Cleveland, Dallas, Denver, Memphis... (Thread)
12. HIPPA-Boston (Thread)
13. 5 openings in Baltimore, MD/Washintgon, DC (Thread)
14. Product Marketing Manager Silicon Valley CA (Thread)
15. San Francisco Bay Area- (Consulting Engineer) (Thread)
16. Manager - Milwaukee, WI (Thread)
17. Sr. Product Manager - Network Security - Symantec - ... (Thread)
18. Security Management Positions (Thread)
19. HIRING SECURITY ENGINEERS IN NEW JERSEY (Thread)
20. Information Assurance positions, Iraq (Thread)
21. Government Sales Opportunity - MD, DC, VA (Thread)
22. HIRING SECURITY ENGINEERS IN NEW JERSEY (Thread)
23. Systems Analyst - Information Security Certified - C... (Thread)
24. FW: Network Security Analyst - South Coast , United ... (Thread)
25. Computer Security Specialist- Irvine CA (Thread)
26. Seeking QA/Support Secialist with Hands-on Database ... (Thread)
27. Security Practice / Director Level Position - Unite... (Thread)
28. Security Industry Health Insurance Plans (Thread)
29. Inside Sales Rep - Data Security - Silicon Valley (Thread)
30. Seeking a Information Technology Position in the W... (Thread)
31. Web-Based UI Developer - Silicon Valley (Thread)
32. Sought Security Product Marketing Management (Thread)
33. Systems Software Developer - Data Security - Silicon... (Thread)
VI. INCIDENTS LIST SUMMARY
1. Strange servicepack.exe file (not service.exe) found... (Thread)
2. Need two files for testing (Thread)
3. ICMP reply, but no stimulus (Thread)
4. Administrivia: Dead Thread - Strange servicepack.exe... (Thread)
5. SV: Strange servicepack.exe file (not service.exe) f... (Thread)
6. DS trojan opens ports fport does not detect? (Thread)
7. Fw: services.exe file (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. CanSecWest/core04 Really Really Last CFP (Thread)
2. Need two files for testing (Thread)
3. mac duplication (Thread)
4. IE Remote (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. TCP/IP Stack Hardening (Thread)
2. FW: TCP/IP Stack Hardening (Thread)
3. FW: Local Security Policy (Thread)
4. Local Security Policy (Thread)
5. Info on deploying ICF on XP sp2 in a managed environ... (Thread)
6. SecurityFocus Microsoft Newsletter #167 (Thread)
7. Blessed Windows Security Templates (Thread)
IX. SUN FOCUS LIST SUMMARY
1. Exploit or trojan (Thread)
X. LINUX FOCUS LIST SUMMARY
1. UNIX Authentication (Thread)
2. Static ARP table in Linux (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Nessus, Part 2: Scanning
By Harry Anderson
This article, the second in the series, provides direction through the
scanning process with Nessus, a powerful open source vulnerability
scanner.
http://www.securityfocus.com/infocus/1753
2. Securing Apache: Step-by-Step
By Artur Maj
Published May 14, 2003
This article shows in a step-by-step fashion, how to install and configure
the Apache 1.3.x Web server in order to mitigate or avoid successful
break-
in when new vulnerabilities in this software are found.
http://www.securityfocus.com/infocus/1694
3. Low-Level Enumeration With TCP/IP
by Randy Williams
This paper explains the theory and concept behind many of today's advanced
scanning techniques, shows you what is going on behind the scenes.
http://www.securityfocus.com/guest/24226
II. BUGTRAQ SUMMARY
-------------------
1. Computer Associates Unicenter Remote Control and Control IT ...
BugTraq ID: 9205
Remote: No
Date Published: Dec 12 2003
Relevant URL: http://www.securityfocus.com/bid/9205
Summary:
Computer Associates Unicenter Remote Control and Control IT are
applications for remotely controlling Windows systems.
A vulnerability has been specified in the applications that may allow a
local attacker to gain unauthorized access to a system account. This
problem is due to an attacker gaining escalated privileges.
Due to a lack of details, further information about this issue is not
available at the moment. This BID will be updated as more information
becomes available.
2. Computer Associates Unicenter Remote Control Host Privilege ...
BugTraq ID: 9206
Remote: No
Date Published: Dec 12 2003
Relevant URL: http://www.securityfocus.com/bid/9206
Summary:
Computer Associates Unicenter Remote Control application is used to
remotely control Windows systems.
A vulnerability has been specified in the software that may allow a local
attacker to gain unauthorized access to a system account. This problem is
due to an attacker gaining escalated privileges. It has been reported that
the Unicenter Remote Control Host's help interface could be used to
exploit system rights and gain unauthorized access to a local system
account.
Due to a lack of details, further information about this issue is not
available at the moment. This BID will be updated as more information
becomes available.
3. Computer Associates Unicenter Remote Control Host Unspecifie...
BugTraq ID: 9207
Remote: Yes
Date Published: Dec 12 2003
Relevant URL: http://www.securityfocus.com/bid/9207
Summary:
Computer Associates Unicenter Remote Control application is used to
remotely control Windows systems.
An unspecified denial of service vulnerability has been reported to be
present in the software. It has been reported that this issue may cause
the service to consume increased CPU cycles. Successful exploitation of
this issue may allow an attacker to cause the service to crash or hang.
Although unconfirmed this issue is probably remote in nature.
Unicenter Remote Control Host 6.0 has been reported to be prone to this
issue.
Due to a lack of details, further information about this issue is not
available at the moment. This BID will be updated as more information
becomes available.
4. Multiple Vendor IKE Implementation Certificate Authenticity ...
BugTraq ID: 9208
Remote: Yes
Date Published: Dec 12 2003
Relevant URL: http://www.securityfocus.com/bid/9208
Summary:
IKE is the Internet Key Exchange protocol. It is used for the negotiation
of authentication and encryption methods and keys during VPN session
initiation.
It has been reported that some default IKE implementations may carry out
insufficient certificate authenticity verification.
The vulnerability lies in the fact that some implementations fail to
thoroughly verify the authenticity of client/server certificates.
Specifically, a client or server will verify the authenticity of a
certificate by ensuring that the Certificate Authority (CA) that signed
it, is the same CA that signed their own certificate. No attempt is made
to verify that the owner of the certificate is trusted.
Exploitation of this issue may be carried out in a number of ways,
depending on the specific IKE implementations. An attacker may impersonate
a client and transmit a certificate subsequent to an IKE and
authentication session being established between the legitimate client and
server. If this were to occur, the impersonated clients certificate would
be erroneously trusted, and IKE would be renegotiated with the attacker,
potentially granting an attacker access to the entire session. The
attacker may also carry out a man-in-the-middle attack by impersonating a
server and initiating an IKE session with a client. Other attacks are also
possible.
It should be noted that the researcher specifically mentioned that certain
vendor VPN clients as being vulnerable, however it was also mentioned that
only some devices/products are vulnerable under some configurations. At
the time of writing, no confirmation has been made by Symantec regarding
which products/devices are directly affected. At this time all vendor VPN
clients have been added as potentially vulnerable. These details will be
modified and/or clarified as further information is made available.
The researcher has explicitly stated that Windows 2000 SP2 and later, as
well as Windows XP are vulnerable to such an implementation. Moreover, it
is said that this implementation may not be modified to allow a differing
CA to sign server and client certificates, potentially making attacks
unavoidable.
The researcher has indirectly stated that the following other vendors may
be affected: Cisco, Nortel, FreeS\WAN and Certicom. It should be noted
that other vendors/products may be affected as well, and specific products
listed as vulnerable may not be explicitly affected.
5. Multiple Vendor IKE Insecure XAUTH Implementation Vulnerabil...
BugTraq ID: 9209
Remote: Yes
Date Published: Dec 11 2003
Relevant URL: http://www.securityfocus.com/bid/9209
Summary:
IKE is the Internet Key Exchange protocol. It is used for the negotiation
of authentication and encryption methods and keys during VPN session
initiation.
IKE, when implemented with 'XAUTH' extensions, has been reported prone to
sensitive information disclosure.
The vulnerability has been reported to result from a weaknesses in XAUTH
when used as an extension of IKE. For example, when IKE is configured to
use a 'group-password' and then transmit a second authenticator employing
XAUTH. Specifically, the server does not have to be authorized to the
client in an XAUTH based IKE negotiation. This issue may provide for a
circumstance, where an attacker with a malicious IKE server implementing
XAUTH, may be authorized with a client and the client may pass sensitive
data to the malicious server, without suspecting that the malicious server
is not in fact a legitimate server for this transaction.
This could potentially be exploited by an attacker to carry out a session
to a legitimate server, as the client who leaked the sensitive
information. Other attacks would also be possible.
IETF has not recommended the use of XAUTH as an extension of IKE.
It should be noted that the researcher specifically mentioned that certain
vendor VPN clients as being vulnerable, however it was also mentioned that
only some devices/products are vulnerable under specific configurations.
At the time of writing, no confirmation has been made by Symantec
regarding which products/devices are directly affected. At this time all
vendor VPN clients have been added as potentially vulnerable. These
details will be modified and/or clarified, as further information is made
available.
Although specific vendor product versions affected by this issue are not
currently known, the researcher has stated that the following vendors are
or may be affected: Cisco, Nortel, MovianVPN, SafeNet, Certicom, and Funk
AdmitOne. It should be noted that other vendors/products may be affected
as well.
6. lftp Try_Netscape_Proxy Buffer Overflow Vulnerability
BugTraq ID: 9210
Remote: Yes
Date Published: Dec 12 2003
Relevant URL: http://www.securityfocus.com/bid/9210
Summary:
lftp is a command-line file transfer client supporting FTP and HTTP.
It has been reported that the lftp file transfer client is vulnerable to a
remotely exploitable buffer overflow condition. The vulnerability is
present when lftp is used to retrieve content from a remote HTTP server.
According to the report, the client does not properly handle special
directories that exist on the server.
The error that causes this condition is in the function
"try_netscape_proxy()" of the file "src/HttpDir.cc". The vulnerability is
reportedly due to an unbounded memory copy of data from the server into an
internal buffer of predefined length. It has been conjectured that the
issue is isolated to an erroneous sscanf() call where a member of a
structure (size_str), is copied into a buffer without sufficient
limitations enforced on the string size by its associated format
specifier. This however has not yet been confirmed.
The flaw is triggered when the user issues the "ls" and "rels" commands.
This vulnerability can be exploited by operators of web servers to execute
arbitrary instructions on the host running lftp. Any such code executed
would run with the privileges of the user who invoked lftp.
This issue is reported to affect all versions of lftp prior to version
2.6.10.
** This BID, originally entitled "LFTP Undisclosed HTML Parsing
Vulnerability" described an issue that was also covered in BID 9212 "lftp
Buffer Overflow Vulnerabilities". This BID has been revised with
information from one of the vulnerabilities originally described in BID
9212. BID 9212 has also been revised to describe the other issue.
7. osCommerce SQL Injection Vulnerability
BugTraq ID: 9211
Remote: Yes
Date Published: Dec 13 2003
Relevant URL: http://www.securityfocus.com/bid/9211
Summary:
osCommerce is an open-source PHP e-commerce suite.
It has been reported that one of the scripts included with osCommerce
fails to validate user-supplied input, rendering it vulnerable to a SQL
injection attack. The script in question is used to verify account
details during the new user registration process and has the filename
"create_account_process.php".
When a user is registering a new account, the details are submitted to
"create_account_process.php" for verification and processing. One of the
fields, "country", is not checked. It is possible to embed data in this
field such that the resulting SQL query to insert the data is corrupted.
It may be possible for attackers to manipulate the query to corrupt data
in the database or, possibly, gain access on the underlying host (through,
for example, stored procedures or vulnerabilities in the database server).
The web interface for submitting this information lists the allowable
countries in a pull-down list. The values eventually submitted, however,
are text strings. It is therefore trivial for an attacker to submit her
own string of choice outside of the "allowable" options.
It should be noted that this vulnerability is also reported to affect
account_edit_process.php, and any script that processes country data
fields.
8. lftp Try_Squid_Eplf Buffer Overflow Vulnerability
BugTraq ID: 9212
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9212
Summary:
lftp is a command-line file transfer client supporting FTP and HTTP.
It has been reported that the lftp file transfer client is vulnerable to a
remotely exploitable buffer overflow condition. The vulnerability is
present when lftp is used to retrieve content from a remote HTTP server.
According to the report, the client does not properly handle special
directories that exist on the server.
The error that causes this condition is in the function "try_squid_eplf()"
of the file "src/HttpDir.cc". The vulnerability is reportedly due to an
unbounded memory copy of data from the server into an internal buffer of
predefined length. It has been conjectured that the issue is isolated to
an erroneous sscanf() call where a member of a structure (size_str), is
copied into a buffer without sufficient limitations enforced on the string
size by its associated format specifier. This however has not yet been
confirmed.
The flaw is triggered when the user issues the "ls" and "rels" commands.
This vulnerability can be exploited by operators of web servers to execute
arbitrary instructions on the host running lftp. Any such code executed
would run with the privileges of the user who invoked lftp.
This issue is reported to affect all versions of lftp prior to version
2.6.10.
** This BID, originally entitled "lftp Buffer Overflow Vulnerabilities"
has been divided into two distinct issues. BID 9210 has also been revised
to cover one of the issues described in the initial version of this BID.
9. DameWare Mini Remote Control Server Pre-Authentication Buffe...
BugTraq ID: 9213
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9213
Summary:
DameWare Mini Remote Control Server is a remote administration tool
distributed and maintained by DameWare Development. It is available for
the Microsoft Windows platform.
A problem has been identified in the handling of pre-authentication
packets by DameWare Mini Remote Control Server. Because of this, it may
be possible for a remote attacker to gain unauthorized access to hosts
using the vulnerable software.
The problem is in the handling of packets containing the
pre-authentication information required by DameWare to authenticate remote
administrators. These packets are usually received through the program
listening port (default TCP 6129), and typically contain the following
information:
Local username
Remote username
Local NetBIOS name
Company Name
Registration Name
Registration Key
Date
Time
Lower case NetBIOS name
IP Address(s) of the client
Version of the remote client
The vulnerability exists when all this information is passed to a function
containing a vulnerable strcpy-like routine. By placing custom,
maliciously crafted data in these variables and sending them in a packet
to the remote host, it is possible to trigger a potentially exploitable
buffer overflow.
**December 21, 2003 - Increased scanning activity, which may be associated
with this issue, has been reported on TCP port 6129. This port is
associated with DameWare Mini Remote Control Server as the listening port.
Exploit code for this issue was released on December 19, 2003. It
contains offsets for many Windows 2000 service packs in English and French
as well as Windows XP SP3.
10. Markus Triska CGINews and CGIForum Information Disclosure Vu...
BugTraq ID: 9214
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9214
Summary:
CGINews is a web-based news posting software package written in Perl.
CGIForum is a discussion board software package written in Perl.
A vulnerability has been reported to exist in the software packages that
may allow an attacker to harvest usernames, e-mail addresses, and other
information such as files uploaded by a certain user. The issue presents
itself due to a flaw in the 'username.log' file that logs user activity.
It has been reported that the log files are viewable by any user.
Successful exploitation of this issue may allow an attacker to gain access
to sensitive information that could be used to launch further attacks
against a system.
CGINews versions 1.07 and CGIForum 1.09 are reported to be vulnerable to
this issue, however other versions could be affected as well.
11. XLight FTP Server Tilde Remote Denial Of Service Vulnerabili...
BugTraq ID: 9215
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9215
Summary:
XLight FTP Server is a commercially available FTP server. It is available
for the Microsoft Windows platform.
A problem has been identified in the XLight FTP Server when handling
certain characters on the commandline. An attacker could take advantage
of this issue to perform a denial of service on vulnerable hosts.
The problem is in the handling of tilde character. When a command for
change of directory (CD) is made to the server and a tilde (~) is supplied
as an argument to the command, the server becomes unstable. It has been
reported that this issue can be exploited to force the server to become
unstable and crash. Manual restart of the server is required to resume
normal operation.
12. Microsoft Internet Explorer Unspecified Remote Compromise Vu...
BugTraq ID: 9216
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9216
Summary:
A reliable source has publicized an Internet Explorer exploit, entitled
"1stCleanRc-Xp", which will reportedly allow for installation and
execution of a malicious executable on a vulnerable client system. This
exploit is reported to affect current versions of Internet Explorer, with
all patches applied, on Microsoft Windows 2000/XP.
The exploit appears to use a number of vulnerabilities to cause malicious
Active Content to be interpreted in the Local Zone, resulting in silent
installation and execution of malicious code. The exploit does not
require user interaction other than visiting a malicious web page.
Further technical details are not known at this time and it is likely that
other known issues are used in this exploit, such as those described in
BIDs 9105 and 9107. This BID will be updated when further information is
made available. If multiple new vulnerabilities are being exploited, the
BID will be divided into new individual BIDs for each issue. Existing
BIDs will also be updated appropriately.
It is currently not known if this affects version prior to 6.0.
13. X-Chat Remote Denial of Service Vulnerability
BugTraq ID: 9217
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9217
Summary:
X-Chat is a graphical client for IRC. It requires the GTK+ toolkit, and is
available for many Linux and Unix operating systems.
A vulnerability has been identified in X-Chat that may allow a remote
attacker to cause a denial of service condition in the software. The
condition is most likely present itself due to insufficient boundary
checks performed on 'DCC SEND' requests.
It has been reported that when received, a malicious 'DDC SEND' request
can trigger a fatal error and cause an affected X-Chat client to crash.
The 'DCC SEND' request may be sent to a channel or a specific targeted
user. Although unconfirmed, due to the nature of this vulnerability it has
been conjectured that a remote attacker may potentially lever this issue
to have arbitrary code executed in the context of the affected X-Chat
client.
X-Chat versions 2.0.5 and 2.0.6 running on a Linux platform have been
reported to be affected by this issue resulting in a crash. Although
unconfirmed, it is possible that other versions are affected as well.
This issue is similar to mIRC DCC SEND Buffer Overflow Vulnerability (BID
8818).
14. MVDSV Quake Server Download Buffer Overrun Vulnerability
BugTraq ID: 9218
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9218
Summary:
mvdsv is a Quake Server implementation for Linux.
mvdsv is prone to a remotely exploitable buffer overrun vulnerability.
The vendor has reported that this issue exists in the download function.
Due to insufficient bounds checking in this function, it is possible for
externally supplied data to overrun an internal buffer and corrupt
adjacent regions of memory. This could permit execution of arbitrary code
in the context of the server. A denial of service could also result from
exploitation attempts.
15. XLight FTP Server Unspecified Remote Directory Traversal Vul...
BugTraq ID: 9219
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9219
Summary:
XLight FTP Server is a commercially available FTP server. It is available
for the Microsoft Windows platform.
A problem has been identified in the XLight FTP Server when handling
certain characters on the commandline. Because of this, an attacker could
potentially gain access to sensitive information on vulnerable hosts.
Specific details concerning this issue are not available. What is known
is that it is possible for attackers to gain access to files outside of
the FTP root directory. An attacker taking advantage of this issue could
gain access to files with the same permissions granted to the FTP server
software.
This Bugtraq ID will be further updated when additional information is
available.
16. Doro PDF Writer Local Privilege Escalation Vulnerability
BugTraq ID: 9220
Remote: No
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9220
Summary:
Doro PDF writer is a free PDF document creation utility available for
Microsoft Windows platforms.
Doro PDF writer has been reported prone to a vulnerability that may allow
a local user to elevate privileges. The issue presents itself because,
when installed, the Doro PDF writer registers a printer named 'Doro PDF
Writer'. When a document is printed to this handler the print spooler
calls the print filter 'doro.dll'. This DLL is invoked with system
privileges. The DLL library in turn invokes the next stage of execution
'doro.exe'. Doro.exe reportedly spawns a file requestor dialog, because
this dialog inherits SYSTEM privileges, an attacker may invoke any with
SYSTEM privileged access. The attacker may invoke cmd.exe to spawn a
privileged access command shell
A local attacker may exploit this condition to perform arbitrary
unauthorized administrative tasks on the vulnerable system.
It should be noted that although this vulnerability has been reported to
affect Doro PDF writer version 1.13, other versions might also be
affected.
17. Multiple Cisco PIX Remote Denial Of Service Vulnerabilities
BugTraq ID: 9221
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9221
Summary:
Cisco PIX is a firewall hardware appliance constructed and distributed by
Cisco Systems.
Cisco PIX has been reported prone to multiple remote denial of service
vulnerabilities.
The first issue has been reported to present itself when the affected PIX
firewall processes an SNMPv3 message, in certain circumstances.
Specifically, if the Cisco PIX is configured as an SNMP server
(snmp-server host [ip address]) and the device receives and processes an
SNMPv3 message, the PIX firewall will crash and reload, effectively
denying service while the appliance is cycling. It should be noted that
this issue occurs even though the Cisco PIX firewall does not support
SNMPv3.
The second issue that was reported by the vendor is that a remote attacker
may close established VPN sessions between a Cisco PIX appliance that is
configured as a VPN Client and a remote VPN server. This vulnerability
presents itself if an attacker uses an IPSec client to negotiate an IKE
Phase 1 connection to the outside interface of the Cisco PIX firewall that
is configured as a VPN Client.
18. Multiple Cisco FWSM Vulnerabilities
BugTraq ID: 9222
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9222
Summary:
Cisco has reported the following vulnerabilities in Cisco Firewall
Services Module (FWSM) for the Cisco Catalyst 6500 Series and Cisco 7600
Series:
Cisco FWSM is prone to a buffer overrun vulnerability when handling HTTP
Auth data. The request is reportedly initiated when a user connects via
the telnet, FTP or HTTP protocols. This information will then be verified
by a TACACS+ or RADIUS server. At some point during this transaction,
malformed or excessive HTTP Auth data may trigger an overrun. This would
most likely result in a denial of service but could also potentially allow
for arbitrary code execution (though this has not been confirmed).
Cisco FWSM has also been reported to be prone to denial of service attacks
via SNMPv3 messages. This may occur when snmp-server host <ip_addr> is
configured on the FWSM. This will cause a vulnerable device to reboot.
Both of these issues have been addressed in FWSM 1.1.3 and later for
affected devices.
19. Elektropost EPIServer Multiple Vulnerabilities
BugTraq ID: 9223
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9223
Summary:
Elektropost EPIServer is a content management system written in ASP.
Multiple vulnerabilities were reported in EPIServer that include directory
traversal, information disclosure, and denial of service. These issues
result from insufficient sanitization of user-supplied input.
The following specific issues were reported:
An information disclosure issue has been reported that may allow an
attacker to gain access to sensitive information. An attacker may be able
to exploit this issue by supplying an arbitrary value for the 'id'
parameter of Page.aspx script. An attacker may also be able to gain
unauthorized access to data by supplying an arbitrary value for the 'id'
parameter of news.asp script.
A directory traversal issue has been reported in the software that may
allow an attacker to gain access to sensitive server readable files
outside the server root directory. The problem is reported to exist due
to insufficient sanitization of user-supplied data through the 'root'
parameter of 'linkurl.asp' script.
A denial of service vulnerability has also been reported to exist in the
software. It has been reported that an attacker may be able to crash or
hang the vulnerable service by supplying large string values for 'user'
and 'password' fields.
Specific version information was not provided in the report. All versions
are assumed to be vulnerable until further information is made public.
These issues are currently undergoing further analysis. This cumulative
BID will be separated into individual entries when analysis is complete.
20. SEH InterCon Smart PrintServer Access Validation Vulnerabili...
BugTraq ID: 9224
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9224
Summary:
SEH InterCon Smart PrintServer is a high speed print server compliant with
IEEE 1284.
A vulnerability has been reported to exist in the software that may allow
an attacker to gain administrative access to a vulnerable system. It has
been reported that an attacker may be able to access and modify
configuration files reserved for administration without supplying proper
authentication credentials. It has been reported that the path of server
configuration files can be obtained via the server and by supplying the IP
address of the vulnerable server in a link to the configuration files, an
attacker may access the sensitive resources.
Successful exploitation of this issue may allow an attacker to gain access
to configuration files, which can then be modified to gain administrative
access to a vulnerable server. Other attacks may be possible as well.
Specific version information was not provided in the report. All versions
are assumed to be vulnerable until further information is made public.
21. Sun Solaris LPStat Unspecified Local Privilege Escalation Vu...
BugTraq ID: 9225
Remote: No
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9225
Summary:
Solaris is the UNIX Operating System distributed and maintained by Sun
Microsystems.
Problems have been identified in the Sun Solaris lpstat program. The
vendor has reported that these issues will allow a local user to create,
view or overwrite any file on the system. Because of these issues, it may
be possible for a local attacker to gain elevated privileges.
Specific details concerning these issues are not currently available. It
is implied by reports that several issues exist, though this has not yet
been confirmed. This Bugtraq ID will be updated when further information
becomes available.
22. W-Agora Multiple Remote Vulnerabilities
BugTraq ID: 9226
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9226
Summary:
W-Agora is a freely available, open source PHP forum software package. It
is available for Unix and Linux systems.
Multiple vulnerabilities have been reported to exist in the software that
include cross-site scripting and remote file include. These issues result
from insufficient sanitization of user-supplied input. The problems are
reported to exist in the include/auth.php3, editform.php3, modules.php3,
index.php3, insert.php3, update.php3, and browse.php3 modules. It has
been reported that some unspecified tags in htaccess could be exploited to
activate certain scripts.
Specific details concerning these issues are not available, however like
other cross-site scripting issues a remote attacker may exploit this
vulnerability to potentially execute HTML or script code in the security
context of the vulnerable site. The script code would be embedded in a
malicious link. The problem could potentially be exploited to steal
cookie authentication credentials, or perform other types of attacks.
The file include issue may allow an attacker to include malicious files
containing arbitrary code to be executed on a vulnerable system. The issue
exists due to improper validation of user-supplied data. Remote attackers
could potentially exploit this issue via a vulnerable variable to include
a remote malicious script, which will be executed in the context of the
web server hosting the vulnerable software.
W-Agora version 4.1.5 has been reported to be prone to this issue, however
other versions may be affected as well.
These issues are currently undergoing further analysis. This cumulative
BID will be separated into individual entries when analysis is complete.
23. Cyrus IMSP Daemon Remote Buffer Overflow Vulnerability
BugTraq ID: 9227
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9227
Summary:
The IMSP Daemon is an implementation of the Internet Message Support
Protocol by the Cyrus project. It is available for the Unix and Linux
operating systems.
A vulnerability has been identified in the Cyrus IMSP Daemon
implementation when handling certain types of requests. Because of this,
it may be possible for a remote attacker to gain unauthorized access to a
system using the vulnerable software.
The problem is in exploitable buffer overflow in the IMSP daemon. The
source of this issue is that an sprintf() operation is performed using
externally supplied data without sufficient bounds checking. This data
may be supplied remotely via several IMSP protocol messages. This issue
could be exploited by sending a maliciously crafted packet to a vulnerable
daemon, it is possible to overwrite sensitive process memory, potentially
executing arbitrary code with the privileges of the IMSP daemon process.
This process is usually run as root.
It should be noted that this issue permits attacks in the
pre-authentication phase, which could potentially result in anonymous
attacks.
24. MacOSX CD9660.Util Probe For Mounting Argument Local Buffer ...
BugTraq ID: 9228
Remote: No
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9228
Summary:
The MacOSX cd9660.util application is a tool that provides support for the
mounting, probing and unmounting of ISO 9660 file systems. The application
is installed with setuid root permissions by default.
The cd9660.util utility has been reported prone to a local buffer overrun
vulnerability. It has been conjectured that the issue presents itself due
to a lack of sufficient bounds checks performed by a call to strcat(). As
a result of this, excessive data (>=512 bytes) supplied as an argument for
the probe for mounting switch (-p), passed to the cd9660.util utility will
overrun the bounds of a reserved buffer in memory. Because memory adjacent
to this buffer has been reported to contain saved values that are crucial
to controlling cd9660.util execution flow, a local attacker may
potentially influence cd9660.util execution flow into attacker-supplied
instructions. Ultimately this may result in arbitrary instructions being
executed in the context of the vulnerable application.
It should be noted that by default this application is installed with
setuid root permissions.
It should be noted; it has been reported that due to an exit() call
subsequent to the vulnerable function returning, and prior to the use of a
controlled address, that this issue may not be exploitable to execute
arbitrary code. It has not been confirmed that this issue is not
exploitable.
Additionally it has been reported that in earlier versions of MAC OSX the
hfs.util application was vulnerable to the same issue as described above.
It should be noted however that hfs.util is no longer setuid in OSX 10.3.
25. Invision Power Top Site List Offset SQL Injection Vulnerabil...
BugTraq ID: 9229
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9229
Summary:
Invision Power Top Site List is a web application that is implemented in
PHP.
Invision Power Top Site List is prone to SQL injection attacks. The
vulnerability exists in the 'index.php' script. User-supplied input
supplied via the 'offset' URI parameter will be used in a database query
without sufficient sanitization. This may permit remote attackers to
influence the logic and structure of database queries. Exploitation could
permit for compromise of the software, disclosure of sensitive information
or other attacks. It should be noted that exploitation might be limited
due to the complexity of the queries affected.
26. J2EE/RI Pointbase Database Remote Command Execution Vulnerab...
BugTraq ID: 9230
Remote: Yes
Date Published: Dec 16 2003
Relevant URL: http://www.securityfocus.com/bid/9230
Summary:
J2EE/RI (Reference Implementation) includes the Java Pointbase database
implementation.
A vulnerability has been reported in the J2EE/RI Pointbase 4.6 database
that could permit remote attackers to execute arbitrary commands on a
system hosting the software. The source of this issue is reportedly
insecure security settings and library bugs in sun.* and org.apache.*
packages that are further complicated if Pointbase is not run with a
properly secured Security Manager policy.
This issue may reportedly be exploited through a malicious SQL statement
that will cause an executable on the host file system to be run. Denial
of service attacks and exposure of sensitive information may also be the
result of successful exploitation.
This vulnerability is similar in nature to the issue described in BID
8773. The vulnerability was reported for J2EE/RI 1.4 on Windows
platforms. Other versions and releases for different platforms are also
likely affected.
27. Aardvark Topsites PHP Multiple Vulnerabilities
BugTraq ID: 9231
Remote: Yes
Date Published: Dec 16 2003
Relevant URL: http://www.securityfocus.com/bid/9231
Summary:
Aardvark Topsites PHP is a web based application for web site maintenance
and administration.
Multiple vulnerabilities have been identified in the software that include
information disclosure, path disclosure, SQL injection, and a plaintext
password weakness.
The following specific issues were reported:
A plaintext password weakness has been reported to exist in the software
that may allow an attacker to gain access to user authentication
credentials. It has been reported that database passwords are stored in
plaintext and if an attacker can gain access to the login panel they may
harvest user passwords.
An information disclosure issue has been reported that may allow an
attacker to gain access to sensitive information. An attacker may gain
access to server information stored in phpinfo() via the
'/sources/info.php' directory.
A path disclosure issue has also been identified in the software. An
attacker may disclose the server path via the 'index.php' script and
supplying 'graph' as a value for parameter 'a' and a NULL value for
parameter 'type'. Successful exploitation of this attack may allow an
attacker to gain sensitive information about the file system that may aid
in launching more direct attacks against the system.
A SQL injection vulnerability has been reported to exist in the 'method'
parameter of 'display.php' script. A malicious user may influence
database queries in order to view or modify sensitive information
potentially compromising the software or the database.
Aardvark Topsites PHP version 4.1.0 has been reported to be prone to these
issue, however other versions may be affected as well.
These issues are currently undergoing further analysis. This cumulative
BID will be separated into individual entries when analysis is complete.
28. Invision Power Board Index.PHP SQL Injection Vulnerability
BugTraq ID: 9232
Remote: Yes
Date Published: Dec 16 2003
Relevant URL: http://www.securityfocus.com/bid/9232
Summary:
Inivision Power Board is a bulletin board system that is implemented in
PHP. It is available for Windows and Unix/Linux derivatives.
Invision Power Board is prone to SQL injection attacks. This
vulnerability exists in the 'index.php' script, which takes user-supplied
input from URI parameters and then includes this input in database queries
without adequate sanitization. In this instance, it is possible to supply
malicious SQL syntax via the 'sort_key' URI parameter. This issue will
permit a remote attacker to manipulate the logic and structure of database
queries, possibly resulting in bulletin board compromise, information
disclosure or other consequences.
29. Dada Mail Blank List Password Authentication Bypass Weakness
BugTraq ID: 9233
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9233
Summary:
Dada Mail is mailing list management software.
Dada Mail is prone to a weakness that may allow authentication bypass.
The issue is known to occur when the list password is blank. While it is
reported that during normal usage of the program, it is not likely that
list password would be null, some circumstances could cause this to happen
such as a software upgrade. If the list password is blank, it is possible
to successfully authenticate using any password. Under these
circumstances, it would be possible for a remote attacker to gain
unauthorized access to mailing list management facilities.
The vendor has changed the default behavior of Dada Mail so that the
software tries to determine if a list password is blank and then disallow
logins if this is the case.
30. Dada Mail Unauthorized Mailing List Subscription Vulnerabili...
BugTraq ID: 9234
Remote: Yes
Date Published: Dec 15 2003
Relevant URL: http://www.securityfocus.com/bid/9234
Summary:
Dada Mail is mailing list management software.
Dada Mail is prone to a vulnerability that may allow malicious parties to
subscribe arbitrary e-mail addresses to mailing lists. The source of this
issue is a flaw in how the software generates subscription confirmation
PINs. These PINs are generated using a simple formula based on the e-mail
address, but PINs are not unique to the Dada Mail installation or the
e-mail address domain. As a result, a malicious party could pregenerate a
list of PINs for specific e-mail addresses and subscribe users to mailing
lists without their knowledge or approval.
31. Michael Dean Double Choco Latte Multiple Module Remote File ...
BugTraq ID: 9235
Remote: Yes
Date Published: Dec 16 2003
Relevant URL: http://www.securityfocus.com/bid/9235
Summary:
Michael Dean Double Choco Latte is a web-based application for managing
software development such as bug tracking, changes and enhancements.
Double Choco Latte is written in PHP.
A vulnerability has been reported to exist in the software that may allow
an attacker to include malicious files containing arbitrary code to be
executed on a vulnerable system. The issue exists due to improper
validation of user-supplied data. The problem exists in the 'login.php',
'logout.php', 'templates/static/frameset.php',
'templates/static/static.php', 'templates/tree/tree.php',
'templates/tree/frameset.php', 'setup/index.php',
'setup/default_records.inc.php', 'inc/config.php',
'inc/functions.inc.php', 'mssql.php', 'mysql.php', 'oracle8.php',
'pgsql.php', and 'sybase.php' scripts of the software.
Remote attackers could potentially exploit this issue via a vulnerable
variable to include a remote malicious script, which will be executed in
the context of the web server hosting the vulnerable software.
Double Choco Latte version 0.9.3 is reported to be vulnerable to this
issue, however other versions may be affected as well.
32. X Design sipd Remote Format String Vulnerability
BugTraq ID: 9236
Remote: Yes
Date Published: Dec 16 2003
Relevant URL: http://www.securityfocus.com/bid/9236
Summary:
sipd is a SIP (Session Initiation Protocol) proxy and location server.
sipd has been reported prone to a format string vulnerability that may be
triggered remotely. It has been reported that sip URI arguments passed to
the affected server as REGISTER data, are not sufficiently handled. An
attacker may place format specifiers in the URI and they will be handled
literally, potentially allowing the attacker to read from and write to
arbitrary memory.
Although unconfirmed, it has been conjectured that a remote attacker may
exploit this condition to execute arbitrary instructions in the context of
the affected sip daemon.
It should be noted that this issue has been reported to affect sipd
versions 0.1.4 and prior.
33. Ipswitch WS_FTP Server Resource Consumption Remote Denial Of...
BugTraq ID: 9237
Remote: Yes
Date Published: Dec 17 2003
Relevant URL: http://www.securityfocus.com/bid/9237
Summary:
Ipswitch WS_FTP Server is an FTP implementation that is available for
Microsoft Windows operating systems.
WS_FTP Server has been reported prone to a resource consumption issue that
may lead to a denial of service. It has been reported that a remote
attacker who has sufficient privileges to log into an affected server, may
trigger this vulnerability by passing a sequence of periods "." as an
argument of the "CWD" (Change Working Directory) FTP command. Subsequent
to this action, the attacker will need to create a directory using the FTP
"MKD" directive. This will reportedly cause the WS_FTP server to
exponentially consume system resources and behave in an unstable manner.
Ultimately a remote attacker may exploit this condition to deny service to
legitimate WS_FTP users.
It should be noted that while this vulnerability has been reported to
affect WS_FTP version 4.02, other versions might also be affected.
34. osCommerce osCsid Parameter Cross-Site Scripting Vulnerabili...
BugTraq ID: 9238
Remote: Yes
Date Published: Dec 17 2003
Relevant URL: http://www.securityfocus.com/bid/9238
Summary:
osCommerce is an open-source PHP e-commerce suite.
A vulnerability has been reported to exist in the software that may allow
a remote user to launch cross-site scripting attacks. The problem is
reported to exist due to improper sanitizing of user-supplied data in the
'osCsid' parameter. This vulnerability makes it possible for an attacker
to construct a malicious link containing HTML or script code that may be
rendered in a user's browser upon visiting that link. This attack would
occur in the security context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Other attacks are also possible.
Although unconfirmed, osCommerce versions 2.2 Milestone 1 and 2.2
Milestone 2 may be vulnerable to this issue.
35. GoAhead Webserver ASP Script File Source Code Disclosure Vul...
BugTraq ID: 9239
Remote: Yes
Date Published: Dec 17 2003
Relevant URL: http://www.securityfocus.com/bid/9239
Summary:
GoAhead WebServer is an Open Source embedded web server which supports
Active Server Pages, embedded javascript, and SSL authentication and
encryption. It is available for a variety of platforms including Microsoft
Windows and Linux variant operating systems.
A vulnerability has been reported in GoAhead webserver that may result in
the disclosure of ASP script files' source code. The vulnerability exists
due to insufficient sanitization of HTTP requests to the affected server.
A malicious attacker can append '%00', '%2f', '%5c', '/' and '\'
characters to the end of a HTTP request for a specific ASP file. This will
result in GoAhead webserver divulging the contents of the requested ASP
script file to the attacker.
Information obtained in this manner may be used by the attacker to launch
further attacks against the vulnerable system.
GoAhead webserver versions up to and including 2.1.7 are reported
vulnerable to this issue.
36. Dizzy unix2tcp Unspecified Buffer Overflow Vulnerability
BugTraq ID: 9240
Remote: No
Date Published: Dec 17 2003
Relevant URL: http://www.securityfocus.com/bid/9240
Summary:
Dizzy unix2tcp is a connection forwarding application that listens on
local Unix sockets and forwards traffic to a remote IP address or port.
A vulnerability has been reported to exist in the 'unix2tcp.c' module of
the software that may allow a local attacker to execute arbitrary code on
a vulnerable system in order to gain unauthorized access. The condition is
present due to insufficient boundary checking.
An attacker may leverage the issue by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing an
affected procedure to return to an address of their choice. Successful
exploitation of this issue may allow an attacker to execute arbitrary code
in the context of the vulnerable software in order to gain unauthorized
access.
unix2tcp versions 0.7.2 and prior may be vulnerable to this issue. This
BID will be updated as more information becomes available.
37. Advanced Research Security Auditor Research Assistant Servic...
BugTraq ID: 9241
Remote: Yes
Date Published: Dec 17 2003
Relevant URL: http://www.securityfocus.com/bid/9241
Summary:
Advanced Research Security Auditor Research Assistant (SARA) is the third
generation of security auditing software based off the original SATAN
scanner. SARA employs a HTTP server to allow the end user to interact with
the software, using a web browser. SARA software is used to scan remote
systems for security vulnerabilities and a dynamic report is generated
from findings.
SARA has been reported prone to a HTML injection vulnerability. The issue
has been reported to exist due to a lack of sufficient sanitization
performed on banner data enumerated from remote services. It has been
reported that in interactive mode, HTML code received as a banner from a
server responding to a SARA scan will be incorporated into dynamic content
and rendered in the browser of the user who is monitoring the SARA scan.
Successful exploitation of this issue may allow a remote attacker to steal
cookie-based authentication credentials. Other attacks are possible as
well. The impact of this issue may be exaggerated because the affected
software invokes the web browser, and the software must be run as the root
user. HTML form variables are also assigned to global variables in PERL
scripts.
It should be noted that this vulnerability has been reported to affect
SARA version 4.2.7 and all prior versions.
**Additional reports indicate that this issue may also affect SATAN
version 1.1.1 and previous versions, as SARA is derived from the SATAN
engine. It has been reported that SATAN does not strip "<" and ">"
characters from HTML code.
38. Botan Es_Unix Privilege Escalation Vulnerability
BugTraq ID: 9242
Remote: No
Date Published: Dec 12 2003
Relevant URL: http://www.securityfocus.com/bid/9242
Summary:
Botan is a library of cryptographic algorithms for various Linux/Unix
derivatives.
Botan is prone to a privilege escalation vulnerability in the es_unix
module on Unix systems that do not support /dev/random. This module
provides a generic entropy source and works by gathering entropy from
external programs. The source of this vulnerability is that external
programs may be called using popen() without fully qualifying the path to
the file. A local user could effectively change their PATH environment
variable so that a malicious program is called instead of the intended
program. In some situations, this could be leveraged to elevate
privileges.
This issue was reported by the vendor to exist in the 1.3.x development
series of the software.
39. IBM DB2 Insecure DMS Directory Permissions Vulnerability
BugTraq ID: 9243
Remote: No
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9243
Summary:
IBM DB2 creates DMS (Database Managed Space) directories with
world-writeable permissions (mode 777). The vulnerability is known to
occur when new directories need to be created prior to the creation of a
DMS tablespace. Malicious local users could take advantage of this issue
to delete or tamper with files in these directories.
This issue was reported to exist on AIX releases of the software.
40. ECW-Shop Cat Parameter Cross-Site Scripting Vulnerability
BugTraq ID: 9244
Remote: Yes
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9244
Summary:
ECW-Shop is web-based e-commerce software for Microsoft Windows operating
systems.
ECW-Shop is prone to cross-site scripting attacks. It is reported that
this issue is exploitable via the 'cat' URI parameter of one of the
scripts. The source of the problem is that input is not adequately
sanitized when passed through this parameter, and this input will be
included in dynamically generated web pages. An attacker could exploit
this issue by constructing a malicious link with hostile HTML and script
code embedded in URI parameters. This code may be rendered in the browser
of a user who visits the malicious link. Exploitation could allow for
theft of cookie-based authentication credentials or other attacks.
41. CyberGuard Firewall/VPN 5.1 Cross-Site Scripting Vulnerabili...
BugTraq ID: 9245
Remote: Yes
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9245
Summary:
CyberGuard is a Firewall/VPN application suite.
A vulnerability has been reported to exist in the software's web interface
that may allow a remote user to launch cross-site scripting attacks. The
problem is reported to exist due to improper sanitizing of user-supplied
data. This vulnerability makes it possible for an attacker to construct a
malicious link containing HTML or script code that may be rendered in a
user's browser upon visiting that link. This attack would occur in the
security context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Other attacks are also possible.
CyberGuard Firewall/VPN 5.1 has been reported to be prone to this issue,
however other versions could be affected as well.
42. DUware DUportal Multiple Vulnerabilities
BugTraq ID: 9246
Remote: Yes
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9246
Summary:
DUware DUportal is a web based portal application.
Multiple vulnerabilities have been identified in the software that include
file include, cross-site scripting, and unauthorized access via changing
the user and administrative passwords.
The following specific issues were reported:
A file include issue has been identified in the software that may allow an
attacker to include malicious files containing arbitrary code to be
executed on a vulnerable system. The issue exists due to improper
validation of user-supplied data. Remote attackers could potentially
exploit this issue via a vulnerable variable to include a remote malicious
script, which will be executed in the context of the web server hosting
the vulnerable software.
A cross-site scripting issue has been reported to exist in various
parameters including 'username'. This vulnerability makes it possible for
an attacker to construct a malicious link containing HTML or script code
that may be rendered in a user's browser upon visiting that link. This
attack would occur in the security context of the site.
It has been reported that an attacker may be able to gain unauthorized
access to a vulnerable system by accessing and changing user and
administrative passwords. The software relies on hidden fields for
password verification. The attacker may change the 'U_ACCESS' parameter
that also relies on hidden fields to gain administrative access.
It has been reported that multiple other issue resulting from insufficient
sanitization of user-supplied data also exist in the software. The issues
span various scripts that may be accessible by a remote attacker.
These vulnerabilities have been reported to be present in DUWare DUportal
3.0, DUportal 3.0 SQL, DUportal Pro 3.2, and DUportal Pro 3.2 SQL.
These issues are currently undergoing further analysis. This cumulative
BID will be separated into individual entries when analysis is complete.
43. SOLMETRA SPAW Editor spaw_control.class.PHP Remote PHP File ...
BugTraq ID: 9247
Remote: Yes
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9247
Summary:
SOLMETRA SPAW Editor is a web based editor control implemented in PHP.
A new version of SPAW Editor has been released, addressing a vulnerability
that may allow a remote attacker to execute arbitrary code. The problem
occurs due to insufficient input validation carried out on the
user-supplied '$spaw_root' URI parameter. This issue is present within the
spaw_control.class.php script file.
As a result, an attacker may be capable of causing a malicious PHP header
file to be interpreted by a target system. Depending on the payload, this
could potentially allow an attacker to gain unauthorized remote access to
a vulnerable system.
44. Ethereal SMB Protocol Dissector Denial of Service Vulnerabil...
BugTraq ID: 9248
Remote: Yes
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9248
Summary:
Ethereal SMB protocol dissector is prone to remotely exploitable denial of
service vulnerability. This issue has been addressed with the release of
Ethereal 0.10.0.
It has been reported that a malformed SMB packet could cause a
segmentation fault in Ethereal. This occurs when "Match->Selected" or
"Prepare->Selected" is selected for the packet.
This issue may be exploited by causing Ethereal to process a malformed
packet. Successful exploitation will cause a denial of service condition
in the Ethereal application. Although unconfirmed, this issue may allow
an attacker to cause a buffer overflow in the application leading to
arbitrary code execution.
Ethereal versions 0.9.16 and prior have been reported to be prone to this
issue.
45. Ethereal Q.931 Protocol Dissector Denial of Service Vulnerab...
BugTraq ID: 9249
Remote: Yes
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9249
Summary:
Ethereal Q.931 protocol dissector is prone to remotely exploitable denial
of service vulnerability. This issue has been addressed with the release
of Ethereal 0.10.0.
It has been reported that when reading a malformed packet the Q.931
dissector dereferences a null pointer.
The issue may be exploited by causing Ethereal to process a malformed
packet. Successful exploitation will cause a denial of service condition
in the Ethereal application. Although unconfirmed, this issue may allow
an attacker to cause a buffer overflow in the application leading to
arbitrary code execution.
Ethereal versions 0.9.16 and prior have been reported to be prone to this
issue. This issue has been reported to affect Tethereal as well.
46. Multiple ASPapp Portal Vulnerabilities
BugTraq ID: 9250
Remote: Yes
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9250
Summary:
ASPapp PortalApp, IntranetApp and ProjectApp are web portal systems
implemented in ASP.
ASPapp PortalApp, IntranetApp and ProjectApp have been reported prone to
multiple vulnerabilities.
The first issue reported may be exploited by an attacker to elevate
privileges when registering a user account. The issue presents itself due
to a hidden form field value 'accesslevel', being harnessed to control the
registered user access level. An attacker may modify this value and
register a user who ultimately has admin privileges.
The second issue again results from the use of a hidden form field value
'user_id'. This vulnerability may be exploited by the attacker to hijack
accounts for which the user id is known.
The third issue results from a lack of sufficient sanitization performed
on user supplied data that is later incorporated into dynamic content. An
attacker may reportedly inject HTML code into ASPapp portal pages by
employing scripts supplied to support forum posting and profile management
(forums.asp, submit.asp, upd_user.asp). An attacker may exploit this
vulnerability to potentially have arbitrary HTML or script code executed
in the browser of an unsuspecting user when a vulnerable region of the
site is viewed.
The fourth vulnerability, also results from a lack of sufficient
sanitization performed on 'msg' URI parameter data. It has been reported
that an attacker may craft a link to any of the vulnerable ASPapp product
pages, passing script code and HTML content as the value of the 'msg' URI
parameter. This malicious code will be executed in the browser of a user
who follows the link, in the context of the vulnerable site.
Finally a vulnerability in the methods used to store session cookies has
been reported. The issue presents itself due to the username and password
associated with the current session being stored in plaintext format.
47. Autorank PHP Multiple SQL Injection Vulnerabilities
BugTraq ID: 9251
Remote: Yes
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9251
Summary:
AutoRank PHP is a web-based application for maintaining top lists.
AutoRank PHP is prone to multiple SQL injection vulnerabilities, which are
exposed via various form-based input fields. In particular, this issue is
exposed via the username/password fields in the account editing form, the
e-mail field when requesting a lost password and the username field in the
account registration form. All of these functions are reportedly included
in the 'accounts.php' script. Input supplied via these fields is not
adequately sanitized before being included in a database query. As a
result, it is possible to modify query structure and logic.
Remote attackers may potentially exploit this issue to compromise security
properties of the software, gain access to sensitive information or
possibly even launch attacks against the underlying database
implementation.
This issue was reported in version 2.0.4 of the software. Other versions
may also be affected.
48. laitcg Pop 3 Scan Renattach Malicious Attachment Scanning By...
BugTraq ID: 9252
Remote: Yes
Date Published: Dec 18 2003
Relevant URL: http://www.securityfocus.com/bid/9252
Summary:
laitcg Pop 3 Scan is a proxy server used by POP3 clients. Pop 3 Scan
scans incoming email messages for viruses, worms, trojans, spam, and
harmful attachments.
A vulnerability has been identified in the software. It has been reported
that when Pop 3 Scan is used with renattach, the software may not identify
malicious attachments and therefore allow malicious code to pass through
undetected. This issue is reported to present itself when a Pop 3 Scan
user has also enabled renattach. renattach is an open source Unix stream
filter used to rename or delete potentially malicious e-mail attachments.
This vulnerability could allow malicious attachments to pass through the
proxy. This could also cause users to assume that the attachment is safe,
which would create a false sense of security.
laitcg Pop 3 Scan version 1.0-rc5 has been reported to be vulnerable to
this issue.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Chats led to Acxiom hacker bust
By: Kevin Poulsen
An IRC log on another hacker's computer led police to "Epitaph," a
Cincinnati man who downloaded records on millions of consumers.
http://www.securityfocus.com/news/7697
2. Secret Service airbrushes aerial photos
By: Kevin Poulsen
The White House and other government buildings get the Photoshop treatment
when the agency tinkers with publicly-funded overhead images of Washington
D.C.
http://www.securityfocus.com/news/7671
3. Will VoIP be wiretap-ready?
By: Kevin Poulsen
Widespread consumer Internet telephony could come with an easy-to-use
government surveillance capability.
http://www.securityfocus.com/news/7650
4. In Norway, DVD hacker acquitted, again, on charges of piracy
By: William Stoichevski, The Associated Press
http://www.securityfocus.com/news/7703
5. Fears, abuse accompany proliferation of Internet maps
By: May Wong, The Associated Press
http://www.securityfocus.com/news/7693
6. Tests confirm Atheros' Super G degrades rival WLANs
By: Tony Smith, The Register
http://www.securityfocus.com/news/7681
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Stealth HTTP Security Scanner v2.0b47
By: qw erty <[email protected] >
Relevant URL: http://www.devhood.com/tools/tool_details.aspx?tool_id=353
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Summary:
Stealth 1.0 scans for 2883 HTTP vulnerabilities. This tool is designed
especially for the system administrators, security consultants and IT
professionals to check the possible security holes and to confirm any
present security vulnerabilities that hackers can exploit. Totally free
for commercial and non-commercial use.
2. pmacct v0.5.4
By: Paolo Lucente
Relevant URL: http://www.ba.cnr.it/~paolo/pmacct/
Platforms: Linux, OpenBSD
Summary:
pmacct is a network tool to gather IP traffic information (source address,
bytes counter, and number of packets). Data is stored in an in-memory
table whose content could be retrieved by a client program via a local
stream-oriented connection. Gathering packets off the wire is done using
the pcap library and one or more network interfaces in promiscuous mode.
3. GNU Transport Layer Security Library v1.0.2
By: Nikos Mavroyanopoulos <[email protected]>
Relevant URL: http://www.gnutls.org
Platforms: FreeBSD, NetBSD, OpenBSD, Solaris, UNIX
Summary:
GNU Transport Layer Security Library is a library which implements a
secure layer over a reliable transport layer such as TCP/IP. It implements
the TLS 1.0 and SSL 3.0 protocols. GnuTLS is available for beta testing.
4. nload v0.6.0
By: Roland Riegel
Relevant URL: http://www.roland-riegel.de/nload/index_en.html
Platforms: FreeBSD, Linux, NetBSD, OpenBSD, Solaris, SunOS
Summary:
nload is a console application which monitors network traffic and
bandwidth usage in real time. It visualizes the in- and outgoing traffic
using two graphs. It also provides additional information, such as the
total amount of transfered data and the min/max network usage.
5. pam_usb v0.2-rc2
By: Andrea Luzzardi <[email protected]>
Relevant URL: http://www.sig11.org/~al/pam_usb/
Platforms: Linux, POSIX
Summary:
pam_usb is a PAM module that enables authentication using a USB storage
device (such as a USB pen) through DSA private/public keys. It can be set
up to work with any application using PAM, such as your system login
(login), your X login (XDM/KDM/GDM), your screensaver (e.g. xscreensaver),
and many others. It supports multiple users for the same device, multiple
hostnames for the same user, a serial number access list, and private key
encryption. It includes usbadm, a tool which helps managing users and
keys. In short, you will be able to login by simply plugging in the USB
pen and entering your login name.
6. Squid Analyzer v2.0
By: Gilles DAROLD
Relevant URL: http://www.samse.fr/GPL/SquidAnalyzer/
Platforms: POSIX
Summary:
Squid Analyzer parses the native access log format of the Squid proxy and
reports general statistics about hits, bytes, users, networks, top URLs,
and top second level domains. Statistic reports are oriented toward user
and bandwidth control; this is not a pure cache statistics generator.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Lists are now closed for the Holidays (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348134
2. Have referrals for Security SE in DC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348133
3. Information Security Consultancy Manager vacancy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348132
4. Infosec Lab Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348131
5. White Hat Hacking in Houston (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348130
6. Western Region Sales Exec./IPSEC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348079
7. Happy Holidays & HIPAA, HIPAA, HIPAA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348077
8. Canada - looking for ITsec experts (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348076
9. Germany Networking & Security Positions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348006
10. IT Security Analyst - Charlotte, NC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348005
11. Atlanta, Chicago, Cleveland, Dallas, Denver, Memphis... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/348004
12. HIPPA-Boston (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347998
13. 5 openings in Baltimore, MD/Washintgon, DC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347997
14. Product Marketing Manager Silicon Valley CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347920
15. San Francisco Bay Area- (Consulting Engineer) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347884
16. Manager - Milwaukee, WI (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347878
17. Sr. Product Manager - Network Security - Symantec - ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347877
18. Security Management Positions (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347857
19. HIRING SECURITY ENGINEERS IN NEW JERSEY (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347724
20. Information Assurance positions, Iraq (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347723
21. Government Sales Opportunity - MD, DC, VA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347722
22. HIRING SECURITY ENGINEERS IN NEW JERSEY (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347721
23. Systems Analyst - Information Security Certified - C... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347719
24. FW: Network Security Analyst - South Coast , United ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347718
25. Computer Security Specialist- Irvine CA (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347717
26. Seeking QA/Support Secialist with Hands-on Database ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347716
27. Security Practice / Director Level Position - Unite... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347715
28. Security Industry Health Insurance Plans (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347714
29. Inside Sales Rep - Data Security - Silicon Valley (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347646
30. Seeking a Information Technology Position in the W... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347645
31. Web-Based UI Developer - Silicon Valley (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347644
32. Sought Security Product Marketing Management (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347643
33. Systems Software Developer - Data Security - Silicon... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/347642
VI. INCIDENTS LIST SUMMARY
--------------------------
1. Strange servicepack.exe file (not service.exe) found... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/348114
2. Need two files for testing (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/348107
3. ICMP reply, but no stimulus (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/348043
4. Administrivia: Dead Thread - Strange servicepack.exe... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/348040
5. SV: Strange servicepack.exe file (not service.exe) f... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347794
6. DS trojan opens ports fport does not detect? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347730
7. Fw: services.exe file (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/347530
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. CanSecWest/core04 Really Really Last CFP (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/347900
2. Need two files for testing (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/347782
3. mac duplication (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/347637
4. IE Remote (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/347558
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. TCP/IP Stack Hardening (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/348203
2. FW: TCP/IP Stack Hardening (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/348201
3. FW: Local Security Policy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/348199
4. Local Security Policy (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/348053
5. Info on deploying ICF on XP sp2 in a managed environ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/347963
6. SecurityFocus Microsoft Newsletter #167 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/347663
7. Blessed Windows Security Templates (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/347509
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. Exploit or trojan (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/348213
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. UNIX Authentication (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/348212
2. Static ARP table in Linux (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/348018
XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
[email protected] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer.
Alternatively you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.
If your email address has changed email [email protected] and
ask to be manually removed.
XII. SPONSOR INFORMATION
-----------------------
SecurityFocus.com would like to take this opportunity to express our
gratitude for your continued support. In the upcoming year we will improve
and grow so we can continue to provide you with all your essential
security resources.
We would also like to wish you all a great Holiday Season, and a
prosperous New Year.
-The staff at SecurityFocus.com
------------------------------------------------------------------------