SecurityFocus Microsoft Newsletter #171

SecurityFocus Microsoft Newsletter #171
------------------------------
This issue sponsored by: SolSoft

FREE Webinar: Better Management for Network Security

Looking for a better way to manage your IP security? See a live demo to
learn how Solsoft can help you:
- Ensure robust IP security through visual, policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
  networks
- Respond rapidly to network events from a central console
- Foster collaboration between network admins and security experts

Register for our FREE webinar at:
http://www.securityfocus.com/sponsor/Solsoft_sf-news_040112
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Digital Signatures And European Laws
     2. IIS Lockdown and Urlscan
     3. Locking your door in 2004
II. BUGTRAQ SUMMARY
     1. Microsoft Internet Explorer Malicious Shortcut Self-Executin...
     2. GoodTech Telnet Server Remote Denial Of Service Vulnerabilit...
     3. EasyDynamicPages config_page.php Remote PHP File Include Vul...
     4. YaSoft Switch Off Large Packet Remote Denial Of Service Vuln...
     5. YaSoft Switch Off swnet.dll Remote Buffer Overflow Vulnerabi...
     6. Microsoft Word Form Protection Password Removal Weakness
     7. VCard4J Toolkit HTML Injection Vulnerability
     8. Cherokee HTTP Post Remote Content Length Denial Of Service V...
     9. Surfnet Kiosk Filesystem Access Vulnerability
     10. Surfnet Unauthorized Account Depositing Vulnerability
     11. Surfnet CMD_CREDITCARD_CHARGE Denial Of Service Vulnerabilit...
     12. Athena Web Registration Remote Command Execution Vulnerabili...
     13. Net2Soft Flash FTP Server Remote Directory Traversal Vulnera...
     14. Webcam Corp Webcam Watchdog Web Server Buffer Overflow Vulne...
     15. XSOK XSOKDir Option Local Buffer Overrun Vulnerability
     16. Invision Power Board Calendar.PHP SQL Injection Vulnerabilit...
     17. ASPApp PortalAPP Remote User Database Access Vulnerability
     18. ASP-Nuke Remote User Database Access Vulnerability
     19. Linux Kernel do_mremap Function Boundary Condition Vulnerabi...
     20. HotNews Multiple PHP File Include Vulnerabilities
     21. FreznoShop Search Script Cross-Site Scripting Vulnerability
     22. vBulletin Calendar Script SQL Injection Vulnerability
     23. Phorum Multiple Cross-Site Scripting/HTML Injection Vulnerab...
     24. OpenBSD PF State Tracking Spoofed Packet Vulnerability
     25. Phorum Registration Script hide_email SQL Injection Vulnerab...
     26. mpg321 MP3 File Remote Format String Vulnerability
     27. nd Multiple Buffer Overrun Vulnerabilities
     28. Lotus Domino Initialization Files Weak Default Permissions V...
     29. ThWboard board.php Cross-Site Scripting Vulnerability
     30. PhpGedView Multiple PHP Remote File Include Vulnerabilities
     31. PhpGedView Search Script Cross-Site Scripting Vulnerability
     32. Open Text Corporation FirstClass Local File Reference Comman...
     33. PhpGedView PHPInfo Information Disclosure Weakness
     34. PostCalendar Search Function SQL Injection Vulnerability
     35. ZyXEL ZyWALL 10 Management Interface Cross-Site Scripting Vu...
     36. Edimax AR-6004 ADSL Router Management Interface Cross-Site S...
     37. SnapStream PVS Lite Cross-Site Scripting Vulnerability
     38. Jabber Server SSL Handling Denial of Service Vulnerability
     39. Debian FSP Vulnerabilities
     40. RealOne Player SMIL File Script Execution Variant Vulnerabil...
     41. Kroum Grigorov KpyM Telnet Server Remote Buffer Overflow Vul...
     42. Sysbotz SimpleData Unspecified Authentication Bypass Vulnera...
     43. VBox3 For ISDN4Linux Local Privilege Escalation Vulnerabilit...
     44. ISC INN Control Message Handling Buffer Overrun Vulnerabilit...
     45. Yahoo! Messenger File Transfer Buffer Overrun Variant Vulner...
     46. Cisco Personal Assistant Web Interface User Password Bypass ...
     47. HD Soft Windows FTP Server Username Format String Vulnerabil...
III. SECURITYFOCUS NEWS ARTICLES
     1. Lamo Pleads Guilty to Times Hack
     2. Defenses lacking at social network sites
     3. Online crime up in 2003
     4. 'Serial ID thieves' banned from auction sites
     5. Bring me the head of trojan Xombe
     6. VeriSign dead cert causes net instability
IV. SECURITYFOCUS TOP 6 TOOLS
     1. Linux Security Auditing Tool v0.9.0
     2. Wolverine Firewall and VPN Server v1.3
     3. Qingy Is Not Getty v0.3.0
     4. Wipe v2.2.0
     5. Nettle library v1.8
     6. J2SSH v0.2.7
V. SECURITYJOBS LIST SUMMARY
     1. Kansas City MO - Assessment Opportunity (Thread)
     2. Security Software Arch. / Lead Dev  Dallas, TX  $110... (Thread)
     3. Jr. Level Application Analyst (Thread)
     4. Searching for Information Security Position (Thread)
     5. ELITE SECURITY SPECIALIST - working with select clie... (Thread)
     6. Corp. Security and Network Manager - 90K - East of L... (Thread)
     7. Symantec Canada is hiring. (Thread)
     8. Symantec Looking for Technical Account Manager in De... (Thread)
     9. Network Security Engineer seeks opportunity (Thread)
     10. Full Time Opportunity (Thread)
     11. Senior Director of Customer Support - GA (Thread)
     12. Seeking a Security Position in the Washington, DC Ar... (Thread)
     13. Software Engineer - Symantec - Redwood City, CA - Ne... (Thread)
     14. 2 new Positions, F/T, northern NJ-Sec Eng and Sec Ar... (Thread)
     15. Corp. Security Consultant - Newport Beach, CA   $90-... (Thread)
     16. CAREER OPEN HOUSE ? AT&T GOVERNMENT SOLUTIONS (Thread)
     17. Raleigh NC -- InfoSec Sales/Business Development (Thread)
     18. Seeking new career opportunity. (Thread)
     19. West Coast Sales Executive (Thread)
     20. Dedicated Pen Testers Needed - NYC  - $70K t0 $10K b... (Thread)
     21. Austin, TX - Senior R&D Security Engineer (Thread)
     22. IBM z800, z900 Systems Security Engineer Position Op... (Thread)
     23. Security Pre Sales Engineers Needed in the Washingto... (Thread)
     24. PwC - Security Architect needed - San Jose, CA (Thread)
     25. PwC - West Coast Threat & Vulnerability Management S... (Thread)
     26. PwC - NYC -Threat & Vulnerability Management practic... (Thread)
     27. Full time, Northern NJ, Application Security Analyst... (Thread)
     28. PreSales Engineer California (Thread)
     29. Lists are now open (Thread)
VI. INCIDENTS LIST SUMMARY
     1. new ftp worm (Thread)
     2. vulnerability in glocation.cgi? (Thread)
     3. Timed http requests hitting metacritic.com? (Thread)
     4. Reverse http traffic (Thread)
     5. netpay.tv connections (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
     1. Kernel module for file protection ideas (Thread)
     2. Thwarting /bin/bash, an anti-overflow concept ? (Thread)
     3. Buffer UNDERFLOWS: What do you know about it? (Thread)
     4. Re: ??: Re: aix __ bos.rte.printers __ format string... (Thread)
     5. aix __ bos.rte.printers __ format string vulnerabili... (Thread)
     6. Any takers? Revisiting mremap() (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
     1. Active Directory Question (Thread)
     2. Accessing eventlogs remotely on W2K3 Server (Thread)
     3. Article Announcement: IIS Lockdown and Urlscan (Thread)
     4. SecurityFocus Microsoft Newsletter #170 (Thread)
IX. SUN FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2004-01-05 to 2004-01-12.
X. LINUX FOCUS LIST SUMMARY
     1. LDAP problem (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Digital Signatures And European Laws
By Mirella Mazzeo

This article discusses the security requirements for electronic
communications and commerce with European governments and many European-
based businesses. It will also give an overview of the current trends for
public key infrastructure in Europe, useful for any organization that does
business with the EU.

http://www.securityfocus.com/infocus/1756

2. IIS Lockdown and Urlscan
By Nishchal Bhalla and Rohyt Belani

This article discusses two important tools provided by Microsoft, IIS
Lockdown and Urlscan, that target significant security-related
configuration problems for IIS versions 6.0, 5.0, and earlier.

http://www.securityfocus.com/infocus/1755

3. Locking your door in 2004
By Tim Mullen

Teach your users to think as you do... and other resolutions for the new
year.

http://www.securityfocus.com/columnists/206


II. BUGTRAQ SUMMARY
-------------------
1. Microsoft Internet Explorer Malicious Shortcut Self-Executin...
BugTraq ID: 9335
Remote: Yes
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9335
Summary:
A vulnerability has been reported that may permit remote attackers to
execute arbitrary code on client systems running Microsoft Internet
Explorer.  A reliable source has created a proof-of-concept that causes a
malicious self-executing HTML file to install and run an executable on the
client system.  This issue may be exploited from within a malicious web
page.

The malicious self-executing HTML file includes embedded script code that
abuses Shell Helper objects to obtain a shortcut file (.lnk), change its
parameters, save it to disk and then execute the file pointed to by the
shortcut.  This will result in execution of arbitrary code.

In the proof-of-concept, a Shell Helper object is created and given the
following namespace:
"C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Accessories"

The ParseName method will then be called on a shortcut (.lnk) file and the
GetLink method is called on the shortcut with the link path pointing to
the 'mshta.exe' executable (which is the Windows program used to parse
HTML application files).  This executable is used to run an external HTA
file.  A hostile shortcut will then be saved and opened on the client
system.  This shortcut will point to a malicious executable.

Shell Helper objects and use of the HTML Application interpreter present
only one attack vector for exploitation of this issue.  There may be other
attack vectors, though none have been reported at this time.

This issue is similar to the vulnerability described in BID 8984.

Separate sources have reported conflicting details.  One source claims
that this issue only works if the self-executing file is run in the
context of the Local Zone.  The other source implies that this works from
a remote site on some Windows platforms but on Windows 2003 it will not
work remotely and would likely require another vulnerability to cause the
self-executing HTML file to be interpreted in the context of the Local
Zone.  If the vulnerability does require exploitation of another issue to
cause active content to be interpreted in the context of the Local Zone,
there is still a slightly lessened security risk associated with this
vulnerability.  This BID will be updated as further details are made
available.

2. GoodTech Telnet Server Remote Denial Of Service Vulnerabilit...
BugTraq ID: 9337
Remote: Yes
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9337
Summary:
GoodTech Telnet Server is a commercial telnet daemon implementation that
is available for Microsoft Windows operating systems.

GoodTech Telnet Server is reportedly prone to a denial of service
vulnerability.  This condition occurs prior to authentication when
excessive data is received by the server.  It is possible to reproduce
this condition by sending 8245 bytes of data to the server while logging
in.  This will cause a server crash, requiring a restart for normal
functionality to be restored.  Exploitation could result in memory
corruption, which could in turn be leveraged to execute arbitrary code,
though this has not been confirmed by Symantec.

This vulnerability appears similar in nature to BID 862, though the amount
of data required to trigger the issue is different.  If this issue is
indeed the same as BID 862, this BID will be retired and the earlier BID
will be updated accordingly.

3. EasyDynamicPages config_page.php Remote PHP File Include Vul...
BugTraq ID: 9338
Remote: Yes
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9338
Summary:
EasyDynamicPages is a content management system that is written in PHP.
It is available for Unix/Linux derivatives and Microsoft Windows operating
systems.

EasyDynamicPages is prone to a remote file include vulnerability.  The
source of this vulnerability is that the 'config_page.php' script includes
an external file ('admin/site_settings.php') in such a way that the
attacker may influence the include path of the file.  If the attacker
specifies an include path to a malicious PHP script on an
attacker-controlled server, this could result in execution of the
malicious script in the context of the web server hosting the vulnerable
software.

Exploitation will permit a remote attacker to gain interactive access to
the vulnerable system.

4. YaSoft Switch Off Large Packet Remote Denial Of Service Vuln...
BugTraq ID: 9339
Remote: Yes
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9339
Summary:
Switch Off is a freely available remote PC management suite.  It is
available for the Microsoft Windows platform.

A vulnerability has been identified in the YaSoft Switch Off software
package when handling large packets.  This may make it possible for a
remote user to deny service to legitimate users of the service.

The problem is in the handling of traffic on the management port.  The
software launches a service that binds to TCP port 8000, allowing remote
users to connect via a web browser.  However, when a request of 10240
bytes followed by two Carriage-Return and Line-Feed sequences (CRLF) is
sent to the service, the software enters a loop that stops only when the
process is terminated.  The issue reportedly exists in 'swnet.dll'.  A
manual restart of the service is required to resume normal functionality.

5. YaSoft Switch Off swnet.dll Remote Buffer Overflow Vulnerabi...
BugTraq ID: 9340
Remote: Yes
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9340
Summary:
Switch Off is a freely available remote PC management suite. It is
available for the Microsoft Windows platform.

A vulnerability has been identified in the YaSoft Switch Off software
package when handling message requests.  This may make it possible for a
remote user to execute arbitrary code through a vulnerable server.

Switch Off has a function for authenticated users that allows the user to
send a message.  The buffer overrun condition exists in the 'swnet.dll'
module of the software due to insufficient bounds checking performed by
the affected component.  The overflow may be caused by sending an
excessively long 'message' parameter to the application.  Because of this,
it is possible for a user to send a request to the service that overwrites
sensitive process memory, and could result in the execution of code with
SYSTEM privileges.

6. Microsoft Word Form Protection Password Removal Weakness
BugTraq ID: 9342
Remote: No
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9342
Summary:
A weakness in the handling of password protection of Microsoft Word
documents has been identified.  Because of this, the issue may make the
defeat of password protection on forms more likely.  This could create a
false sense of security since the feature is often mistakenly used to
protect documents from unauthorized modification.

When a Microsoft Word document has protection for forms turned on, the
password for the protection feature is stored in the Word document.  When
this document is saved into a HTML document, the password stored in the
Word document is placed in hash form in the w:UnprotectPassword header
field within the HTML document.

The attacker could circumvent this protection by locating the hash in the
saved HTML version of the document and then use a utility such as a hex
editor to locate and edit the stored password in the original Word
document.  Upon modifying the hash contained in the Word document to a
string of 0x00000000, resulting in the password for the document being set
to a blank string.

It should be noted that the vendor has stated that this feature is not
intended to provide document security but instead is implemented to aid in
collaborative situations where all parties are trusted.  However, this
issue still presents a security risk in scenarios where the feature is
mistakenly used as a measure to prevent documents from being modified.

7. VCard4J Toolkit HTML Injection Vulnerability
BugTraq ID: 9343
Remote: Yes
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9343
Summary:
VCard4J Toolkit is a Java-based toolkit for manipulating vCards.  It
includes various Java APIs for parsing vCard data.

VCard4J Toolkit is prone to a HTML injection vulnerability.  This issue
may be exploited through a malicious vCard.  Hostile HTML and script code
injected into the malicious vCard may be rendered at some point after the
application has processed the malicious vCard.  The consequences and
exploitability of this issue could vary depending on how components are
used in an implementation, but theoretically this could result in theft of
cookie-based authentication credentials if the toolkit were implemented on
a site that processed an untrusted vCard.  Other attacks are also
possible.

8. Cherokee HTTP Post Remote Content Length Denial Of Service V...
BugTraq ID: 9345
Remote: Yes
Date Published: Jan 01 2004
Relevant URL: http://www.securityfocus.com/bid/9345
Summary:
Cherokee is a freely available, open source web server software package.
It is available for the Unix and Linux platforms.

A problem has been identified in the handling of HTTP POST requests by
Cherokee.  Because of this, it may be possible for a remote attacker to
deny service to legitimate users of a vulnerable server.

The problem is in the handling of HTTP Content-Length header fields.  When
a POST request is made, Cherokee may react unpredictably when a
Content-Length header field is not supplied with the POST.  This has been
reported to result in a denial of service issue.  It is conjectured that
this issue may not be limited to just a denial of service, though
available information is insufficient it making a further determination.

This Bugtraq ID will be further updated if more information becomes
available.

9. Surfnet Kiosk Filesystem Access Vulnerability
BugTraq ID: 9346
Remote: No
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9346
Summary:
Surfnet is kiosk Internet access software.

Surfnet includes security features that are intended to isolate kiosk
users from the underlying operating system.  A vulnerability has been
discovered in the software that may allow kiosk users to circumvent these
security features.

Surfnet kiosk software may permit kiosk users to access the underlying
filesystem.  Users may access the local file system via a 'file://' URI.
This may be accomplished by submitting a request for such a URI in the
address bar of the Surfnet browser.  This will grant access to the Windows
Explorer shell, allowing the attacker to take further action to circument
kiosk security, such as killing the Surfnet process.  This violates the
security model of the software and could permit malicious individuals to
abuse the system hosting the software.

10. Surfnet Unauthorized Account Depositing Vulnerability
BugTraq ID: 9347
Remote: No
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9347
Summary:
Surfnet is kiosk Internet access software.

Surfnet kiosks are prone to a vulnerability that may permit kiosk users to
deposit extra time into kiosk accounts.  This reportedly occurs when a
user attempts to authenticate to the kiosk, causing their time to be
doubled for each attempt.  This can be exploited by submitting the
following request in the address bar of the kiosk web browser:

C:\Surfnet\WWWRoot\CMD_Existing_Account_Attempt:Login=Username:Password=Password

where Username equals the username of the user that the attacker wishes to
extend the time of.  It is not known if the attacker must also provide a
valid password.

This presents a security risk because it will permit the attacker to abuse
the kiosk.

11. Surfnet CMD_CREDITCARD_CHARGE Denial Of Service Vulnerabilit...
BugTraq ID: 9348
Remote: No
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9348
Summary:
Surfnet is kiosk Internet access software.

Surfnet is prone to a denial of service vulnerability via the
CMD_CREDITCARD_CHARGE command.  By issuing this command with malformed
arguments, it is possible to crash the software.  When the software
crashes, it will drop the kiosk user into the underlying operating system,
allowing for unauthorized access.  From this point the kiosk user may
perform actions on the system as the user that invoked the kiosk software.

This presents a security risk because the kiosk software is designed to
isolate kiosk users from the underlying system to prevent abuse of kiosk
facilities.

12. Athena Web Registration Remote Command Execution Vulnerabili...
BugTraq ID: 9349
Remote: Yes
Date Published: Jan 02 2004
Relevant URL: http://www.securityfocus.com/bid/9349
Summary:
Athena Web Registration is a freely available, open source web
registration suite for Athena game servers.

A problem has been reported in the handling of user-supplied input by the
Athena Web Registration scripts.  Because of this, it may be possible for
an attacker to gain unauthorized access to a vulnerable system.

The problem is in the handling of user-supplied input by the athenareg.php
script.  By passing escape characters to the script with arbitrary UNIX
commands, it is possible for a remote attacker to execute shell commands
in the underlying operating system.  An attacker could take advantage of
this issue to gain access to the vulnerable system with the privileges of
the web server process.

13. Net2Soft Flash FTP Server Remote Directory Traversal Vulnera...
BugTraq ID: 9350
Remote: Yes
Date Published: Jan 03 2004
Relevant URL: http://www.securityfocus.com/bid/9350
Summary:
Flash FTP Server is a commercially-available FTP server software package
for Microsoft Windows.  It is distributed and maintained by Net2Soft.

A problem in the handling of directory traversal sequences has been
discovered in Net2Soft Flash FTP Server.  This may make it possible for an
attacker to gain unauthorized access to sensitive information.

The problem is in the handling of slash-dot-dot (/..) sequences.  The FTP
server does not properly sanitize requests issued with commands.  Because
of this, an attacker has the ability to potentially execute commands
outside of the FTP root directory, including but not limited to file
access and file creation.

14. Webcam Corp Webcam Watchdog Web Server Buffer Overflow Vulne...
BugTraq ID: 9351
Remote: Yes
Date Published: Jan 04 2004
Relevant URL: http://www.securityfocus.com/bid/9351
Summary:
Webcam Watchdog is a commercially available webcam software package
distributed and maintained by Webcam Corp.

A problem has been identified in the handling of remote web requests by
the Webcam Watchdog software.  Because of this, it may be possible for a
remote attacker to gain unauthorized access to a vulnerable system.

The problem is in the handling of remote HTTP GET requests by the
software.  The software serves images via an HTTP server on port 80,
allowing remote users to retrieve images taken with the webcam.  However,
the service does not perform proper bounds checking, making it possible to
overwrite sensitive process memory with a custom request.  An attacker
could leverage this issue to gain unauthorized access to a system using
the vulnerable software with the privileges of the service.

15. XSOK XSOKDir Option Local Buffer Overrun Vulnerability
BugTraq ID: 9352
Remote: No
Date Published: Jan 04 2004
Relevant URL: http://www.securityfocus.com/bid/9352
Summary:
xsok is a freely available, open source single player game. It is
available for the Linux platform.

xsok is prone to a locally exploitable buffer overflow vulnerability.

The vulnerability exists in the xsokdir function. By supplying an argument
of excessive length to the xsokdir option, it is possible to corrupt
sensitive variables in memory. This could be exploited to execute
arbitrary code with elevated privileges. The program is usually installed
with Set-Group-ID games privileges.

16. Invision Power Board Calendar.PHP SQL Injection Vulnerabilit...
BugTraq ID: 9353
Remote: Yes
Date Published: Jan 04 2004
Relevant URL: http://www.securityfocus.com/bid/9353
Summary:
Invision Power Board is a bulletin board system that is implemented in
PHP. It is available for Windows and Unix/Linux derivatives.

Invision Power Board is prone to SQL injection attacks. This vulnerability
exists in the 'calendar.php' script, which takes user-supplied input from
URI parameters and then includes this input in database queries without
adequate sanitization. In this instance, it is possible to supply
malicious SQL syntax by manipulating the value supplied to the
$this->chosen_month variable of calendar.php. This issue will permit a
remote attacker to manipulate the logic and structure of database queries,
possibly resulting in bulletin board compromise, information disclosure or
other consequences.

17. ASPApp PortalAPP Remote User Database Access Vulnerability
BugTraq ID: 9354
Remote: Yes
Date Published: Jan 04 2004
Relevant URL: http://www.securityfocus.com/bid/9354
Summary:
PortalApp is a commercially available web application software package for
the Microsoft Windows platform.

A problem has been identified in ASPapp PortalApp when user credentials
are stored on a system.  Because of this, an attacker may be able to gain
unauthorized access to sensitive information.

The problem is in the handling of mdb files.  User credentials such as
usernames and passwords are stored in mdb files inside of the PortalApp
web hierarchy.  Insufficient default access control is placed on these
database files, making it possible for a remote user to gain unauthorized
access to user credentials.

18. ASP-Nuke Remote User Database Access Vulnerability
BugTraq ID: 9355
Remote: Yes
Date Published: Jan 04 2004
Relevant URL: http://www.securityfocus.com/bid/9355
Summary:
ASP-Nuke is a freely available web application software package for the
Microsoft Windows platform.

A problem has been identified in ASP-Nuke when user credentials are stored
on a system. Because of this, an attacker may be able to gain unauthorized
access to sensitive information.

The problem is in the handling of mdb files. User credentials such as
usernames and passwords are stored in mdb files inside of the ASP-Nuke web
hierarchy. Insufficient default access control is placed on these database
files, making it possible for a remote user to gain unauthorized access to
user credentials.

19. Linux Kernel do_mremap Function Boundary Condition Vulnerabi...
BugTraq ID: 9356
Remote: No
Date Published: Jan 05 2004
Relevant URL: http://www.securityfocus.com/bid/9356
Summary:
A vulnerability involving the do_mremap system function has been reported
in the Linux kernel, allowing for local privilege escalation.

The mremap(2) system call is used to resize and relocate Virtual Memory
Areas (VMA).  It calls the kernel do_mremap function internally.  Due to a
bounds checking issue within the function, it is possible for local
attackers to disrupt the operation of the kernel.  It is reported that
this flaw may be exploited to create a malicious VMA of zero bytes in
length.  The malicious VMA may disrupt other memory management operations
in the kernel, potentially causing system instability.  Attack vectors
also exist that may permit a local attacker to gain root privileges.

This type of vulnerability will permit a remote attacker who has already
gained limited privileges on a host to fully compromise the system.

Because the 2.2 kernel series does not support the affected MREMAP_FIXED
flag, it is not reported to be prone to this issue.

20. HotNews Multiple PHP File Include Vulnerabilities
BugTraq ID: 9357
Remote: Yes
Date Published: Jan 05 2004
Relevant URL: http://www.securityfocus.com/bid/9357
Summary:
HotNews is a web-based news system that is implemented in PHP.

HotNews is prone to multiple file include vulnerabilities.  The source of
the issue is that a number of scripts that ship with the software permit
remote users to influence include paths for various configuration and
template files.  The problems are known to exist in the
'hotnews-engine.inc.php3' and 'hnmain.inc.php3' scripts.  This will permit
remote attackers to cause malicious PHP scripts from attacker-controlled
servers to be included and subsequently executed in the context of the web
server hosting the vulnerable software.

Exploitation may allow an attacker to gain interactive access to the
system hosting the software.

21. FreznoShop Search Script Cross-Site Scripting Vulnerability
BugTraq ID: 9359
Remote: Yes
Date Published: Jan 04 2004
Relevant URL: http://www.securityfocus.com/bid/9359
Summary:
FreznoShop is a web-based shopping application that is implemented in PHP.

FreznoShop is prone to a cross-site scripting vulnerability.  The
vulnerability exists in the search script (search.php) included with the
software.  The cause of the vulnerability is that input supplied via the
'search' URI parameter is not sanitized of HTML and script code before
being included in web page output.  Remote attackers may create malicious
links to this script that include hostile HTML and script code.  If such a
link was followed by a victim user, the attacker-supplied code would be
rendered in the security context of the site hosting the software.

This could be exploited to steal cookie-based authentication credentials.
Other attacks are also possible since the attacker may influence how the
site is rendered to the victim user.

22. vBulletin Calendar Script SQL Injection Vulnerability
BugTraq ID: 9360
Remote: Yes
Date Published: Jan 05 2004
Relevant URL: http://www.securityfocus.com/bid/9360
Summary:
vBulletin is a message board system implemented in PHP.

vBulletin is prone to an SQL injection vulnerability.  The vulnerability
exists in the calendar script (calendar.php).  This script does not
adequately filter SQL syntax from user-supplied input before including it
in a database query.  As a result, remote attackers may influence the
logic and structure of database queries made by the software.  In
particular, data supplied via the 'eventid' URI parameter is not
sufficiently sanitized.

This vulnerability could potentially be exploited to compromise the
bulletin board installation, disclose sensitive information from within
the database or even to launch attacks against the database
implementation.  The impact may also depend on the capabilities of the
underlying database implementation, for example, if the database supports
sub-queries and stored procedures, then this type of issue will present a
greater risk.

23. Phorum Multiple Cross-Site Scripting/HTML Injection Vulnerab...
BugTraq ID: 9361
Remote: Yes
Date Published: Jan 05 2004
Relevant URL: http://www.securityfocus.com/bid/9361
Summary:
Phorum is prone to multiple cross-site scripting vulnerabilities.  The
vulnerabilities exist in the 'common.php', 'profile.php' and 'login.php'
scripts. The cause of the vulnerabilities is that input supplied via URI
parameters and form fields is not sanitized of HTML and script code before
being included in web page output.  The following specific issues were
reported:

The phorum_check_xss() function in 'common.php' allows for HTML injection
due to not filtering some variations of embedded script code.

The 'EditError' variable, supplied as input to 'profile.php', allows for
inclusion of HTML and script code.

The 'Error' variable, supplied as input to 'login.php', allows for
inclusion of HTML and script code.

Remote attackers may create malicious links to a vulnerable script that
includes hostile HTML and script code.  If such a link were followed by a
victim user, the attacker-supplied code would be rendered in the security
context of the site hosting the software.  Attackers may also persistently
inject hostile HTML and script code into the forum software, which would
be rendered when pages that include the malicious attacker-supplied
content are visited by web users.

This could be exploited to steal cookie-based authentication credentials.
Other attacks are also possible since the attacker may influence how the
site is rendered to the victim user.

24. OpenBSD PF State Tracking Spoofed Packet Vulnerability
BugTraq ID: 9362
Remote: Yes
Date Published: Jan 05 2004
Relevant URL: http://www.securityfocus.com/bid/9362
Summary:
PF is the Packet Filter distributed with OpenBSD.  It is maintained and
distributed by the OpenBSD project, and available for the Unix operating
system.

A problem in the handling of packets has been reported when stateful
inspection is activated.  Because of this, it may be possible for an
attacker to circumvent traffic filtering by PF.

The problem is in the handling of packets that match the firewall's
current state sessions.  An attacker sending custom packets with data
crafted to match known current states could bypass firewall rules,
resulting in communication with restricted hosts.  The problem affects all
interfaces on which the firewall operates and has stateful filtering
enabled.

25. Phorum Registration Script hide_email SQL Injection Vulnerab...
BugTraq ID: 9363
Remote: Yes
Date Published: Jan 05 2004
Relevant URL: http://www.securityfocus.com/bid/9363
Summary:
Phorum is prone to an SQL injection vulnerability.  The vulnerability
exists in the registration script (register.php).  This script does not
adequately filter SQL syntax from user-supplied input before including it
in a database query.  As a result, remote attackers may influence the
logic and structure of database queries made by the software.  In
particular, the 'hide_email' parameter is not sanitized.

This vulnerability could potentially be exploited to compromise the
bulletin board installation, disclose sensitive information from within
the database or even to launch attacks against the database
implementation.  The impact may also depend on the capabilities of the
underlying database implementation, for example, if the database supports
sub-queries and stored procedures, then this type of issue will present a
greater risk.

26. mpg321 MP3 File Remote Format String Vulnerability
BugTraq ID: 9364
Remote: Yes
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9364
Summary:
mpg321 is a command-line media player for Unix/Linux variants.

A remotely exploitable format string vulnerability is present in mpg321.
The source of the problem is incorrect usage of printf() functions,
allowing format specifiers to be supplied directly to the vulnerable
functions from external data.  This issue is likely exposed when the media
player handles MP3 meta data such as information included in ID3 tags,
though this has not been confirmed.

This issue could be exploited if a malicious MP3 file is played by a user,
either by opening the file manually or by streaming the malicious file.
Format string vulnerabilities permit attackers to overwrite arbitrary
locations in memory with attacker-specified data, giving the attacker a
means of controlling execution flow of the vulnerable program.  This will
permit for execution of arbitrary code in the context of the user invoking
the media player.

27. nd Multiple Buffer Overrun Vulnerabilities
BugTraq ID: 9365
Remote: Yes
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9365
Summary:
nd is a command-line WebDAV interface for Unix/Linux platforms.

Multiple buffer overrun vulnerabilities were reported in nd.  The source
of the vulnerabilities appears to be multiple instances where sprintf()
operations are performed on server-supplied data without proper bounds
checking.

These issues may be exploited by a malicious WebDAV server.  If the server
supplies malicious data to the software that is sufficient in length to
trigger one of the conditions, then it will be possible to overrun
adjacent regions of memory with the superfluous data.  If a sensitive
variable in memory, such as a return address, can be overwritten then it
will be possible to control the execution flow of the program.  This will
result in execution of arbitrary code.

28. Lotus Domino Initialization Files Weak Default Permissions V...
BugTraq ID: 9366
Remote: No
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9366
Summary:
Domino is the e-mail server distributed by Lotus.  It is available for the
Unix, Linux, and Microsoft operating systems.

A vulnerability has been identified in Lotus Domino for the Linux
operating system.  Due to an issue with installation permissions, it may
be possible to modify sensitive configuration files.

The problem is in the default permissions of initialization files.  By
default, the /local/notesdata/notes.ini and /opt/lotus/LPSilent.ini
initialization files are installed with world read-write UNIX file
permissions.  Because of this, an attacker can modify these files to force
Domino to perform potentially dangerous actions.

29. ThWboard board.php Cross-Site Scripting Vulnerability
BugTraq ID: 9367
Remote: Yes
Date Published: Jan 04 2004
Relevant URL: http://www.securityfocus.com/bid/9367
Summary:
ThWBoard is bulletin board software that is implemented in PHP.

ThWBoard is prone to a cross-site scripting vulnerability.  The
vulnerability exists in the 'board.php' script and is due to insufficient
input validation of user-supplied input, that will be included in web
pages that are generated by the software.

An attacker will likely exploit this issue by enticing a victim user to
follow a malicious link to a site hosting the software that contains
embedded HTML and script code.  The embedded code may be rendered in the
web browser of the victim user in the security context of the site hosting
the vulnerable software.

This could be exploited to steal cookie-based authentication credentials
from legitimate users.  Other attacks are also possible since the attacker
can influence how the site will be rendered to the victim user.

30. PhpGedView Multiple PHP Remote File Include Vulnerabilities
BugTraq ID: 9368
Remote: Yes
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9368
Summary:
PhpGedView is web-based geneology software that is implemented in PHP.

PhpGedView is prone to multiple file include vulnerabilities. The source
of the issue is that a number of scripts that ship with the software
permit remote users to influence require() paths for various external
files.  These issues are known to exist in the 'authentication_index.php',
'functions.php' and 'config_gedcom.php' scripts.  This will permit remote
attackers to cause malicious PHP scripts from attacker-controlled servers
to be included and subsequently executed in the context of the web server
hosting the vulnerable software.

Exploitation may allow an attacker to gain interactive access to the
system hosting the software.

These issues are reported to affect PhpGedView 2.61.  Other versions are
also likely affected.

31. PhpGedView Search Script Cross-Site Scripting Vulnerability
BugTraq ID: 9369
Remote: Yes
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9369
Summary:
PhpGedView is web-based geneology software that is implemented in PHP.

PhpGedView is prone to a cross-site scripting vulnerability.  The
vulnerability exists in the search script (search.php) included with the
software.  The cause of the vulnerability is that input supplied via the
'firstname' URI parameter is not sanitized of HTML and script code before
being included in web page output.  Remote attackers may create malicious
links to this script that include hostile HTML and script code.  If such a
link was followed by a victim user, the attacker-supplied code would be
rendered in the security context of the site hosting the software.

This could be exploited to steal cookie-based authentication credentials.
Other attacks are also possible since the attacker may influence how the
site is rendered to the victim user.

This issue is reported to affect PhpGedView 2.61.  Other versions are also
likely affected.

32. Open Text Corporation FirstClass Local File Reference Comman...
BugTraq ID: 9370
Remote: Yes
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9370
Summary:
FirstClass is a mail user agent distributed and maintained by the Open
Text Corporation.  It is available for the Microsoft Windows platform.

A vulnerability has been identified in the handling of URIs that reference
local content by Open Text Corporation FirstClass software.  An attacker
can create a HTML link using one of these URIs (such as file://) that when
clicked on by a target user results in the execution of system commands.
Commands executed through this means would be carried out with the
privileges of the user logged into the system.

This vulnerability can be exploited by sending a malicious e-mail with the
hostile link to a victim user.

33. PhpGedView PHPInfo Information Disclosure Weakness
BugTraq ID: 9371
Remote: Yes
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9371
Summary:
PhpGedView is web-based geneology software that is implemented in PHP.

PhpGedView allows remote users to access information displayed by the
phpinfo() function.  This issue exists in the 'admin.php' script, which
permits unauthenticated remote users to specify 'phpinfo' as a script
action, which will call the phpinfo() function.  This may disclose
sensitive information about the environment the software runs in.

Information disclosed by this weakness may aid an attacker in gaining
intelligence about a target server.

This issue is reported to affect PhpGedView 2.61.  Other versions are also
likely affected.

34. PostCalendar Search Function SQL Injection Vulnerability
BugTraq ID: 9372
Remote: Yes
Date Published: Jan 03 2004
Relevant URL: http://www.securityfocus.com/bid/9372
Summary:
PostCalendar is a web-based calendaring application that includes support
for PostNuke.  It is implemented in PHP.

PostCalendar is prone to an SQL injection vulnerability.  The search
function included with the software does not adequately filter SQL syntax
from user-supplied input before including it in a database query.  As a
result, remote attackers may influence the logic and structure of database
queries made by the software.

This vulnerability could potentially be exploited to compromise the
bulletin board installation, disclose sensitive information from within
the database or even to launch attacks against the database
implementation.  The impact may also depend on the capabilities of the
underlying database implementation, for example, if the database supports
sub-queries and stored procedures, then this type of issue will present a
greater risk.

35. ZyXEL ZyWALL 10 Management Interface Cross-Site Scripting Vu...
BugTraq ID: 9373
Remote: Yes
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9373
Summary:
ZyWALL 10 firewalls are prone to cross-site scripting attacks via the web
management interface of affected devices.  This is due to insufficient
input validation of user-supplied input, that will be included in web
pages that are generated by the software.  The specific issue is in the
'rpAuth_1' program included in the management interface.

An attacker will likely exploit this issue by enticing a victim user to
follow a malicious link to a site hosting the software that contains
embedded HTML and script code. The embedded code may be rendered in the
web browser of the victim user.

This could potentially be exploited to steal cookie-based authentication
credentials from legitimate users. Other attacks are also possible since
the attacker can influence how the management pages will be rendered to
the victim user.

36. Edimax AR-6004 ADSL Router Management Interface Cross-Site S...
BugTraq ID: 9374
Remote: Yes
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9374
Summary:
Edimax AR-6004 ADSL Routers are prone to cross-site scripting attacks via
the web management interface of affected devices.  This is due to
insufficient input validation of user-supplied input, that will be
included in web pages that are generated by the software.

An attacker will likely exploit this issue by enticing a victim user to
follow a malicious link to a site hosting the software that contains
embedded HTML and script code. The embedded code may be rendered in the
web browser of the victim user.

This could potentially be exploited to steal cookie-based authentication
credentials from legitimate users. Other attacks are also possible since
the attacker can influence how management pages will be rendered to the
victim user.

37. SnapStream PVS Lite Cross-Site Scripting Vulnerability
BugTraq ID: 9375
Remote: Yes
Date Published: Jan 06 2004
Relevant URL: http://www.securityfocus.com/bid/9375
Summary:
SnapStream Personal Video Station (PVS) Lite is multimedia software for
Microsoft Windows platforms.

SnapStream PVS Lite is prone to a cross-site scripting vulnerability. The
vulnerability is due to insufficient input validation of user-supplied
input, that will be included in web pages that are generated by the
software.  In particular, certain variations of embedded HTML tags are not
filtered.

An attacker could exploit this issue by enticing a victim user to follow a
malicious link to a system hosting the software that contains embedded
HTML and script code. The embedded code may be rendered in the web browser
of the victim user.

This could be exploited to steal cookie-based authentication credentials
from legitimate users. Other attacks are also possible since the attacker
can influence how the site will be rendered to the victim user.

38. Jabber Server SSL Handling Denial of Service Vulnerability
BugTraq ID: 9376
Remote: Yes
Date Published: Jan 07 2004
Relevant URL: http://www.securityfocus.com/bid/9376
Summary:
Jabber is a set of streaming XML protocols most commonly implemented for
instant-messaging.  The Jabber server is maintained by the Jabber Software
Foundation.

It has been reported that the Jabber server is vulnerable to a remotely
exploitable denial of service condition.  The flaw that can trigger the
condition is allegedly due to a failure to handle certain types of SSL
connections.  Remote attackers may exploit this vulnerability to cause the
server to crash, resulting in a denial of service.  Further technical
details are not known at this time.

39. Debian FSP Vulnerabilities
BugTraq ID: 9377
Remote: Yes
Date Published: Jan 07 2004
Relevant URL: http://www.securityfocus.com/bid/9377
Summary:
The File Service Protocol (FSP) is a file transfer protocol that is an
alternative to FTP.  A set of FSP client and server tools is included with
Debian Linux.  It has been reported that there are two vulnerabilities
present in the implementation of FSP included with Debian Linux.

The first vulnerability is an access validation error that can allow for a
client to access parts of the filesystem outside of the FSP root
directory.  Exploitation may result in a disclosure of sensitive
information to malicious users.

The second vulnerability is a buffer overflow condition that can be
exploited by clients to execute instructions on the target server.  This
may result in a full compromise of the underlying host.

At this time, further technical details are not known.

40. RealOne Player SMIL File Script Execution Variant Vulnerabil...
BugTraq ID: 9378
Remote: Yes
Date Published: Jan 07 2004
Relevant URL: http://www.securityfocus.com/bid/9378
Summary:
RealOne Player is a media player that is available for a number of
platforms including Microsoft Windows and MacOS systems.

RealOne Player includes support for Synchronized Multimedia Integration
Language (SMIL) presentations.

A vulnerability has been reported in RealOne Player. Script embedded in
SMIL presentations may be executed in the context of a domain that is
specified by an attacker. In particular, if a URI is opened from within a
SMIL file, embedded script code may access the properties of the URI's
domain.

This could allow for theft of cookie-based authentication credentials, but
more seriously, could also cause embedded script code to be executed in
the context of the My Computer Zone.  Given the ability to execute script
code in the My Computer Zone, it is possible to exploit other security
flaws to cause malicious executables to be installed and executed on
client systems.

This issue is a variant of the vulnerability described in BID 8453.  The
syntax used to embed script code is different than the previous
vulnerability, and this new issue affects fixed versions of the player.
This vulnerability may be exploited with "file:javascript:" syntax, where
the previous issue just used a plain "javascript:" URI.  Some other
limitations are placed on the syntax that may be used in the embedded
code, but it has been demonstrated that these restrictions may be bypassed
by converting restricted characters to unicode.

As with the previous issue, there is also a likelihood that malicious
script code could be embedded into other file types that are handled by
the player.

41. Kroum Grigorov KpyM Telnet Server Remote Buffer Overflow Vul...
BugTraq ID: 9379
Remote: Yes
Date Published: Jan 07 2004
Relevant URL: http://www.securityfocus.com/bid/9379
Summary:
Kroum Grigorov KpyM (KTS) is a telnet server that runs on Microsoft
Windows platforms.

KpyM Telnet Server has been reported to be prone to a remote buffer
overflow vulnerability.  Because of this, it may be possible for a remote
attacker to gain unauthorized access to a system running the vulnerable
software. The condition is present due to insufficient boundary checking.

The issue presents itself when an attacker sends request with more than
10000 characters to the server. Immediate consequences of an attack may
result in a denial of service condition.

An attacker may leverage the issue by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing an
affected procedure to return to an address of their choice. Successful
exploitation of this issue may allow an attacker to execute arbitrary code
in the context of the vulnerable software in order to gain unauthorized
access, however, this has not been confirmed at the moment.

KpyM versions 1.05 and prior have been reported to be prone to this issue.

42. Sysbotz SimpleData Unspecified Authentication Bypass Vulnera...
BugTraq ID: 9380
Remote: Yes
Date Published: Jan 07 2004
Relevant URL: http://www.securityfocus.com/bid/9380
Summary:
Sysbotz SimpleData is a web application written in PHP.

An unspecified vulnerability has been reported to exist in the software
that may allow a remote attacker to bypass authentication and gain
unauthorized access to a vulnerable site.

It has been reported that SimpleData may be prone to an access validation
issue.  The vulnerability may present itself when an attacker submits a
specially crafted  URI.

Further details about this issue are not available at the moment.  This
BID will be updated as more information becomes available.

SimpleData versions 4.0.1 and prior may be prone to this issue.

43. VBox3 For ISDN4Linux Local Privilege Escalation Vulnerabilit...
BugTraq ID: 9381
Remote: No
Date Published: Jan 07 2004
Relevant URL: http://www.securityfocus.com/bid/9381
Summary:
isdn4linux is a freely available, open source package of Linux kernel
module ISDN compatibility tools. It is available for Linux operating
systems. vbox3 is a voice response system for isdn4linux.

vbox3 has been reported prone to a local privilege escalation
vulnerability. The issue is reported to occur because the vbox3 software
does not lower execution privilege before accepting and interpreting a
user-supplied TCL script. A local user may potentially exploit this
condition to have arbitrary TCL code executed with elevated privileges.
Potentially this vulnerability may provide for unfettered access to a
vulnerable system for local users.

44. ISC INN Control Message Handling Buffer Overrun Vulnerabilit...
BugTraq ID: 9382
Remote: Yes
Date Published: Jan 08 2004
Relevant URL: http://www.securityfocus.com/bid/9382
Summary:
ISC INN is a Usenet/NNTP implementation that is available for Unix and
Linux platforms.

ISC has reported a remotely exploitable buffer overrun in INN.  This issue
exists in the control message handling code that was introduced into
version 2.4.0.  This code is responsible for special filing of control
messages into per-type newsgroups.

The issue exists in the 'art.c' source file and is due to an operation
where externally supplied data is copied into a static buffer without
sufficient bounds checking.  This could cause adjacent regions of memory
to be overrun with attacker-specified data, allowing remote attackers to
overwrite sensitive variables in memory to control the execution flow of
the program.  It may possible to exploit this issue to execute arbitrary
code in the context of the innd process.  It should be noted that innd is
designed to drop privileges after binding to port 119, so successful
exploitation would typically only yield the privileges of the news user.

45. Yahoo! Messenger File Transfer Buffer Overrun Variant Vulner...
BugTraq ID: 9383
Remote: Yes
Date Published: Jan 08 2004
Relevant URL: http://www.securityfocus.com/bid/9383
Summary:
Yahoo! Messenger is the instant message client distributed and maintained
by Yahoo!.  It is available for the Microsoft Windows operating system.

Yahoo! Messenger is vulnerable to a remotely exploitable buffer overrun
issue. This vulnerability is due to insufficient bounds checking during
user-initiated file transfer requests.

An attacker may trigger this condition by initiating file transfer using a
file name of specific constructs, which the victim user must then accept.
The file name must be in excess of 218 bytes. This will reportedly result
in an exploitable buffer overflow condition.  The condition exists in the
ft.dll component, which handles file transfers for the client.

An attacker may theoretically exploit this condition to execute arbitrary
code on a client system.  Code executed on the target system would be with
the privileges of the Yahoo! Messenger client.

46. Cisco Personal Assistant Web Interface User Password Bypass ...
BugTraq ID: 9384
Remote: Yes
Date Published: Jan 08 2004
Relevant URL: http://www.securityfocus.com/bid/9384
Summary:
Cisco Personal Assistant is telephony software that allows individual
users to manage personal calls, including the ability to forward calls to
specific numbers.

A vulnerability was reported in Cisco Personal Assistant that may permit
remote attackers to bypass authentication via the web interface, allowing
for unauthorized access to individual user configuration facilities.
Given the ability to change user settings, it will be possible to take
abusive actions on the behalf of the user, such as redirecting calls and
forwarding the user's number to a toll number.  This condition only exists
if the "Allow Only Cisco CallManager Users" setting is enabled and the
Personal Assistant Corporate Directory settings refer to the same
directory service that is used by Cisco CallManager.

The web interface is located at http://x.x.x.x/pauseradmin (where x.x.x.x
is the IP address).

It should be noted that Cisco Personal Assistant versions 1.3(x) and
earlier are not affected.

47. HD Soft Windows FTP Server Username Format String Vulnerabil...
BugTraq ID: 9385
Remote: Yes
Date Published: Jan 08 2004
Relevant URL: http://www.securityfocus.com/bid/9385
Summary:
HD Soft Windows FTP Server is a FTP server application for Microsoft
Windows platforms.

Windows FTP Server has been reported to be prone to a remote format string
vulnerability when processing a malicious request from a client.

The vulnerability presents itself when the server receives a malicious
request containing embedded format string specifiers from a remote client
when supplying a username during FTP authentication.  The source of the
problem is incorrect use of a formatted printing function, which processes
data supplied during FTP server authentication.  As a result, format
specifiers supplied in this manner will be interpreted literally and may
result in attacker-specified memory being corrupted or disclosed.

Although it has been demonstrated that this could crash the server, the
vulnerability could also theoretically allow for execution of arbitrary
code on the system hosting the server.  This would occur in the security
context of the server process.

Windows FTP Server versions 1.6 and prior are reported to be prone to this
issue.


III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Lamo Pleads Guilty to Times Hack
By: Kevin Poulsen

The hacker became a convicted felon Thursday, and now faces six to twelve
months in custody.
http://www.securityfocus.com/news/7771

2. Defenses lacking at social network sites
By: Annalee Newitz

Sites like LiveJournal and Tribe are poised to be the next big thing on
the Web in 2004, but their security and privacy practices are more like
1997.

http://www.securityfocus.com/news/7739

3. Online crime up in 2003
By: Kevin Poulsen

Complaints logged by a federal clearinghouse rose sixty percent over last
year.
http://www.securityfocus.com/news/7714

4. 'Serial ID thieves' banned from auction sites
By: John Leyden, The Register

http://www.securityfocus.com/news/7792

5. Bring me the head of trojan Xombe
By: John Leyden, The Register

http://www.securityfocus.com/news/7791

6. VeriSign dead cert causes net instability
By: John Leyden, The Register

http://www.securityfocus.com/news/7790


IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Linux Security Auditing Tool v0.9.0
By: Triode
Relevant URL: http://usat.sourceforge.net/
Platforms: Linux, POSIX
Summary:

Linux Security Auditing Tool (LSAT) is a post install security auditing
tool. It is modular in design, so new features can be added quickly. It
checks inetd entries and scans for unneeded RPM packages. It is being
expanded to work with Linux distributions other than Red Hat, and checks
for kernel versions.

2. Wolverine Firewall and VPN Server v1.3
By: Joshua Jackson
Relevant URL: http://www.coyotelinux.com
Platforms: Linux, POSIX
Summary:

Wolverine is a firewall and VPN server that is based on the Embedded
Coyote Linux distribution of Linux. This product is intended as an
alternative to commercial devices such as the Cisco PIX, the FireBox, etc.
Wolverine features a hardened Linux 2.4-based stateful firewall along with
IPSEC and PPTP VPN services. As it is intended to be an embedded solution,
the overall installation size is roughly 8Mb.

3. Qingy Is Not Getty v0.3.0
By: Noberasco
Relevant URL: http://qingy.sourceforge.net/
Platforms: Linux, POSIX
Summary:

qingy is a replacement for getty. It uses DirectFB to provide a fast, nice
GUI without the overhead of the X Windows System. It allows the user to
log in and start the session of his choice (text console, GNOME, KDE,
wmaker, etc.).

4. Wipe v2.2.0
By: linux
Relevant URL: http://sourceforge.net/projects/wipe
Platforms: AIX, Linux, SunOS
Summary:

Recovery of supposedly erased data from magnetic media is easier than what
many people would like to believe. A technique called Magnetic Force
Microscopy (MFM) allows any moderately funded opponent recover the last
two or three layers of data written to disk. Wipe repeadetly overwrites
special patterns to the files to be destroyed, using the fsync() call
and/or the O_SYNC bit to force disk access.

5. Nettle library v1.8
By: Niels Möller
Relevant URL: http://www.lysator.liu.se/~nisse/nettle
Platforms:
Summary:

Nettle is a cryptographic library that is designed to fit easily in more
or less any context: in crypto toolkits for object-oriented languages
(C++, Python, Pike, etc.), in applications like LSH or GNUPG, or even in
kernel space. In most contexts, you need more than the basic cryptographic
algorithms; you also need some way to keep track of available algorithms
and their properties and variants. You often have some algorithm selection
process, often dictated by a protocol you want to implement. And as the
requirements of applications differ in subtle and not so subtle ways, an
API that fits one application well can be a pain to use in a different
context, which is why there are so many different cryptographic libraries
around. Nettle tries to avoid this problem by doing one thing, the
low-level crypto stuff, and providing a @emph{simple} but general
interface to it. In particular, Nettle doesn't do algorithm selection. It
doesn't do memory allocation. It doesn't do any I/O. The idea is that one
can build several application- and context-specific interfaces on top of
Nettle and share the code, testcases, benchmarks, documentation, etc. For
this first version, the only application using Nettle is LSH, and it uses
an object-oriented abstraction on top of the library.

6. J2SSH v0.2.7
By: Richard Pernavas
Relevant URL: http://www.sshtools.com
Platforms: Os Independent
Summary:

J2SSH is an object-orientated Java implementation of the SSH version 2
protocol. It provides a rich, powerful, and extensible SSH API that
enables developers to gain access to SSH servers and to develop entire SSH
client/server frameworks. The API library provides a fully-featured SSH2
implementation specifically designed for cross-platform development.
Higher level components, representing both the standard SSH client and SSH
servers, are provided which implement the protocol specification for user
sessions and port forwarding. The specification currently supports public
key and password authentication and a full implementation of the SFTP
protocol.


V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Kansas City MO - Assessment Opportunity (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349409

2. Security Software Arch. / Lead Dev  Dallas, TX  $110... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349389

3. Jr. Level Application Analyst (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349378

4. Searching for Information Security Position (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349352

5. ELITE SECURITY SPECIALIST - working with select clie... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349306

6. Corp. Security and Network Manager - 90K - East of L... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349304

7. Symantec Canada is hiring. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349291

8. Symantec Looking for Technical Account Manager in De... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349281

9. Network Security Engineer seeks opportunity (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349279

10. Full Time Opportunity (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349230

11. Senior Director of Customer Support - GA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349217

12. Seeking a Security Position in the Washington, DC Ar... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349207

13. Software Engineer - Symantec - Redwood City, CA - Ne... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349188

14. 2 new Positions, F/T, northern NJ-Sec Eng and Sec Ar... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349098

15. Corp. Security Consultant - Newport Beach, CA   $90-... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349038

16. CAREER OPEN HOUSE ? AT&T GOVERNMENT SOLUTIONS (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349037

17. Raleigh NC -- InfoSec Sales/Business Development (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349036

18. Seeking new career opportunity. (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349035

19. West Coast Sales Executive (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/349034

20. Dedicated Pen Testers Needed - NYC  - $70K t0 $10K b... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348983

21. Austin, TX - Senior R&D Security Engineer (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348952

22. IBM z800, z900 Systems Security Engineer Position Op... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348949

23. Security Pre Sales Engineers Needed in the Washingto... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348905

24. PwC - Security Architect needed - San Jose, CA (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348892

25. PwC - West Coast Threat & Vulnerability Management S... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348889

26. PwC - NYC -Threat & Vulnerability Management practic... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348882

27. Full time, Northern NJ, Application Security Analyst... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348869

28. PreSales Engineer California (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348865

29. Lists are now open (Thread)
Relevant URL:

http://www.securityfocus.com/archive/77/348850


VI. INCIDENTS LIST SUMMARY
--------------------------
1. new ftp worm (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/349404

2. vulnerability in glocation.cgi? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/349401

3. Timed http requests hitting metacritic.com? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/349288

4. Reverse http traffic (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/348861

5. netpay.tv connections (Thread)
Relevant URL:

http://www.securityfocus.com/archive/75/348858


VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Kernel module for file protection ideas (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/349330

2. Thwarting /bin/bash, an anti-overflow concept ? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/349320

3. Buffer UNDERFLOWS: What do you know about it? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/349319

4. Re: ??: Re: aix __ bos.rte.printers __ format string... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/349257

5. aix __ bos.rte.printers __ format string vulnerabili... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/349147

6. Any takers? Revisiting mremap() (Thread)
Relevant URL:

http://www.securityfocus.com/archive/82/349013


VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Active Directory Question (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/349380

2. Accessing eventlogs remotely on W2K3 Server (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/349292

3. Article Announcement: IIS Lockdown and Urlscan (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/349218

4. SecurityFocus Microsoft Newsletter #170 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/348921


IX. SUN FOCUS LIST SUMMARY
--------------------------
NO NEW POSTS FOR THE WEEK 2004-01-05 to 2004-01-12.


X. LINUX FOCUS LIST SUMMARY
---------------------------
1. LDAP problem (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/349280


XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
[email protected] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer.
Alternatively you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.

If your email address has changed email [email protected] and
ask to be manually removed.


XII. SPONSOR INFORMATION
-----------------------
This issue sponsored by: SolSoft

FREE Webinar: Better Management for Network Security

Looking for a better way to manage your IP security? See a live demo to
learn how Solsoft can help you:
- Ensure robust IP security through visual, policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Respond rapidly to network events from a central console
- Foster collaboration between network admins and security experts

Register for our FREE webinar at:
http://www.securityfocus.com/sponsor/Solsoft_sf-news_040112
------------------------------------------------------------------------