SecurityFocus Newsletter #232
Kelly Martin <[email protected]> Tue, 20 Jan 2004 14:45:23 -0700 (MST)
| Newsgroups | gmane.comp.security.news.general |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Newsletter #232
------------------------------
I. FRONT AND CENTER
1. Problems and Challenges with Honeypots
II. BUGTRAQ SUMMARY
1. Multiple Vendor bzip2 Antivirus Software Denial of Service V...
2. DansGuardian Webmin Module Edit.CGI Remote Directory Travers...
3. Andy's PHP Projects Man Page Lookup Script Information Discl...
4. VisualShapers EZContents Module.PHP Remote Command Execution...
5. Jitterbug CGI Remote Arbitrary Command Execution Vulnerabili...
6. LionMax Software WWW File Share Pro Remote Denial of Service...
7. Sun Microsystems Sun One Web Server Remote Buffer Overflow V...
8. Zope Multiple Vulnerabilities
9. Symantec LiveUpdate Local Privilege Escalation Vulnerability
10. Mabry Software FTPServer/X Controls Format String Vulnerabil...
11. Mabry Software FTPServer/X Controls Unspecified Buffer Overf...
12. Mod-Auth-Shadow Apache Module Expired User Credential Weakne...
13. BEA WebLogic Ant Tasks Administrative Password Exposure Vuln...
14. Multiple Vendor H.323 Protocol Implementation Vulnerabilitie...
15. Microsoft MDAC Function Broadcast Response Buffer Overrun Vu...
16. Microsoft ISA Server 2000 H.323 Filter Remote Buffer Overflo...
17. Microsoft Exchange Server 2003 Outlook Web Access Random Mai...
18. SuSE YaST SuSEconfig.gnome-filesystem Local Insecure File Cr...
19. Novell iChain Web Server Failed Login Page Cross-Site Script...
20. H+BEDV AntiVir Insecure Temporary File Creation Symbolic Lin...
21. HP Tru64 UNIX Unspecified Remote Buffer Overflow Vulnerabili...
22. Snort_Inline Rule 2077 Failure Vulnerability
23. KAME Racoon "Authentication" SA Deletion Vulnerability
24. KAME Racoon "Initial Contact" SA Deletion Vulnerability
25. Symantec Web Security Block Page Message Cross-Site Scriptin...
26. KDE Personal Information Management Suite VCF File Remote Bu...
27. HP SharedX Unspecified Local Insecure File Access Vulnerabil...
28. Real Networks Helix Server/Gateway Administration Service HT...
29. nCipher payShield SPP Library Bad Request Verification Vulne...
30. TCPDump ISAKMP Decoding Routines Multiple Remote Buffer Over...
31. PHPDig Config.PHP Include Remote Command Execution Vulnerabi...
32. LionMax Software WWW File Share Pro Multiple Remote Vulnerab...
33. FishNet FishCart Rounding Function Integer Wrapping Vulnerab...
34. Vicomsoft RapidCache Server Host Argument Denial of Service ...
35. Vicomsoft RapidCache Server Directory Traversal Vulnerabilit...
36. Linux Kernel 32 Bit Ptrace Emulation Full Kernel Rights Vuln...
37. ELM frm Command Remote Buffer Overflow Vulnerability
38. Whale Communications e-Gap Security Appliance Login Page Sou...
39. QMail-SMTPD Long SMTP Session Integer Overflow Denial of Ser...
40. Rit Research Labs The Bat! PGP Message Memory Writing Vulner...
41. SuSE 3Ddiag Insecure Temporary File Handling Symbolic Link V...
42. OpenCA Crypto-Utils.Lib Signature Verification Vulnerability
43. OpenBSD 3.4 Crypto Card Handlers File Descriptor Leak Vulner...
44. PHPShop Project Multiple Vulnerabilities
45. XtremeASP PhotoGallery Adminlogin.ASP SQL Injection Vulnerab...
III. SECURITYFOCUS NEWS ARTICLES
1. Feds seek input on spammer sentencing
2. No relief from Microsoft phishing bug
3. Lamo Pleads Guilty to Times Hack
4. Nigerian 419ers run dry
5. New Internet virus spreading fast
6. Beware the Habeas Joe Job
IV. SECURITYFOCUS TOP 6 TOOLS
1. File::Scan v0.79
2. Dropbear SSH Server v0.41
3. OSIRIS v3.0.0
4. mrtg v2.10.13
5. Yet Another antiVirus Recipe v1.8.6
6. m0n0wall vpb25r595
V. SECURITYJOBS LIST SUMMARY
1. Security Analysts/Engineers - Washington DC (Thread)
2. Federal Sales Executive - Tenable Network Security -... (Thread)
3. NYC - Manager - Threat & Vulnerability (Thread)
4. Senior Executive Sales DC (Thread)
5. Seeking Network Security Position (Thread)
6. Security position in San Diego (Thread)
7. Configuration Relaease Security Engineer (Thread)
8. Federal Agency Cyber Security Subject Matter Expert ... (Thread)
9. DC Security Opportunities (Thread)
10. International & Southeast US - Security Sales and Ma... (Thread)
11. IT Position Available in Wash. DC Metro Area (Thread)
12. Looking for OCONUS DOD work (Thread)
13. LA - PwC - IT Security with IT Audit skills needed -... (Thread)
14. Secure Software Inc. seeks Auditors, Developers, and... (Thread)
15. Technical IT Security Consultant - 6 months Contract... (Thread)
16. U.S. Citizen available for Immediate Relocation to D... (Thread)
17. DC Security Opportunity (Thread)
18. Telecom Security Consultant Middle East (Thread)
19. Sr. Manager (Indianapolis, IN) (Thread)
20. Contacts for positions in Iraq, Afghanistan or other... (Thread)
21. Security Analyst (Thread)
22. Seeking InfoSec Sales in Financial Services (Thread)
23. Federal Sales Director - Washington, DC area (Thread)
24. Sterling-Hoffman?s Mid-West Security Job Report - Ja... (Thread)
25. asia/pacific security jobs (Thread)
26. Cincinnati, Cleveland, and Columbus OH (Thread)
27. Sterling-Hoffman?s South East Security Job Report - ... (Thread)
28. IT/Security Audit in the Motor City (Thread)
29. Sterling-Hoffman?s Mid-Atlantic Security Job Report ... (Thread)
30. Sterling-Hoffman?s North East Security Job Report - ... (Thread)
31. Sterling-Hoffman?s West Coast Security Job Report - ... (Thread)
32. Contacts for positions in Iraq, Afghanistan or other... (Thread)
33. iBM z800/z900 Systems Security Engineer Opening (Kan... (Thread)
VI. INCIDENTS LIST SUMMARY
1. Issue of AIM; was -> UDP Port 5140 (Thread)
2. UDP Port 5140 (Thread)
3. new/old port 135 scans? (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. a method for bypassing cookie restrictions in web br... (Thread)
2. RES: Password Setup (Thread)
3. Password Setup (Thread)
4. get SP on Solaris (SPARC) with GCC 3.3.2 (Thread)
5. Buffer UNDERFLOWS: What do you know about it? (Thread)
6. Regarding a selection for mobile code/scripting lang... (Thread)
7. RUXCON Call For Papers (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. About MS-Networking security. (Thread)
2. Encrypt data - SQL Server 2000 (Thread)
3. USB - Devices (Thread)
4. MDAC security patch problem? (Thread)
5. Disable NTLM on W2k (Thread)
6. SMTP Service in private DMZ OK? (Thread)
7. Betr.: Active Directory Question (Thread)
8. Active Directory Question (Thread)
9. SecurityFocus Microsoft Newsletter #171 (Thread)
10. application whitelisting (was Active Directory Ques... (Thread)
11. [work] RE: Active Directory Question (Thread)
IX. SUN FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2004-01-13 to 2004-01-20.
X. LINUX FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK 2004-01-13 to 2004-01-20.
XI. UNSUBSCRIBE INSTRUCTIONS
I. FRONT AND CENTER
-------------------
1. Problems and Challenges with Honeypots
By Lance Spitzner Jan 14, 2004
In this paper we take a look at some of the many challenges and problems
facing honeypots, and possible approaches on how to solve them. By
identifying these problems now, we can hope to make honeypots a stronger
technology for the future.
http://www.securityfocus.com/infocus/1757
II. BUGTRAQ SUMMARY
-------------------
1. Multiple Vendor bzip2 Antivirus Software Denial of Service V...
BugTraq ID: 9393
Remote: Yes
Date Published: Jan 09 2004
Relevant URL: http://www.securityfocus.com/bid/9393
Summary:
Multiple vendor antivirus software applications have been reported to be
prone to a denial of service vulnerability. This issue presents itself
when an affected application attempts to decompress an excessively large
bzip2 archive. It has been reported that the antivirus applications
attempt to decompress a bzip2 archive and store it on the local file
system before scanning the files for malicious code. The applications may
fail to properly detect for anomalies such as the size of the archive.
Therefore, it is possible for an attacker to create an excessively large
bzip2 archive (containing 2GB of 0x31 characters), which may cause a
denial of service condition in the antivirus application upon
decompression.
Successful exploitation of this issue may allow an attacker to cause a
denial of service condition in the antivirus software due to resource
exhaustion, leading to a crash or hang. A successful attack could also
leave a system vulnerable to malicious code threats.
Kaspersky AntiVirus for Linux 5.0.1.0, Trend Micro InterScan VirusWall 3.8
Build 1130, and McAfee Virus Scan for Linux v4.16.0 have been reported to
be prone to this issue, however, it is likely that other products are
affected as well.
2. DansGuardian Webmin Module Edit.CGI Remote Directory Travers...
BugTraq ID: 9394
Remote: Yes
Date Published: Jan 10 2004
Relevant URL: http://www.securityfocus.com/bid/9394
Summary:
DansGuardian Webmin Module an adaptation of the DansGuardian script for
Webmin. It is available for the Unix and Linux platforms.
A problem has been identified in the handling of input by scripts packaged
with the DansGuardian Webmin Module. Because of this, it is possible for
a remote to gain access to potentially sensitive information.
The problem is in the handling of input by the edit.cgi script. A remote
user may supply strings to the file parameter of the edit.cgi script to
view a file outside of the DansGuardian root directory. An attacker may
view files readable by with the privileges of the web server process
hosting Webmin.
3. Andy's PHP Projects Man Page Lookup Script Information Discl...
BugTraq ID: 9395
Remote: Yes
Date Published: Jan 10 2004
Relevant URL: http://www.securityfocus.com/bid/9395
Summary:
Man Page Lookup script is a PHP script distributed and maintained by
Andy's PHP Projects. It is available for the Unix and Linux platforms.
A problem in the handling of user-supplied input by Andy's PHP Projects
Man Page Lookup script has been reported. Because of this, it is possible
for an attacker to gain unauthorized access to sensitive information on a
system.
The problem is in the checking of the command variable passed to the
index.php script. An attacker can place a maliciously crafted value in
this field to escape the web root directory and view the contents of any
file on the system. This issue is limited only by the read privileges of
the web server process.
4. VisualShapers EZContents Module.PHP Remote Command Execution...
BugTraq ID: 9396
Remote: Yes
Date Published: Jan 10 2004
Relevant URL: http://www.securityfocus.com/bid/9396
Summary:
ezContents is a freely available, open source content management system.
It is distributed and maintained by VisualShapers, and available for the
Unix and Linux platforms.
A problem in handling of specific types of input passed to the module.php
script in VisualShapers ezContents has been discovered. Because of this,
an attacker may be able to gain unauthorized access to vulnerable systems.
The problem is in the handling of input supplied in to the link variable
in the module.php script. An attacker can supply a link to a malicious
web site with arbitrary system contains containing in the URI. Due to
insufficient sanitizing of input, these commands are passed directly to
the shell, where they are executed on the system with the privileges of
the web server process.
5. Jitterbug CGI Remote Arbitrary Command Execution Vulnerabili...
BugTraq ID: 9397
Remote: Yes
Date Published: Jan 12 2004
Relevant URL: http://www.securityfocus.com/bid/9397
Summary:
Jitterbug is a freely available, open source bug tracking system written
in CGI. It is available for the Linux platform.
A vulnerability has been identified in the handling of input by Jitterbug.
Because of this, an attacker may be able to gain unauthorized access to
vulnerable systems.
Due to the nature of this bug and the fact that it is hosted by a web
server process, it is likely that exploitation of this issue results in
command execution with the privileges of the web server process. However,
specific details about this issue are not currently available. This
vulnerability will be further updated as additional information becomes
available.
6. LionMax Software WWW File Share Pro Remote Denial of Service...
BugTraq ID: 9398
Remote: Yes
Date Published: Jan 12 2004
Relevant URL: http://www.securityfocus.com/bid/9398
Summary:
LionMax Software WWW File Share Pro is a HTTP server that runs on
Microsoft Windows platforms.
A denial of service vulnerability has been reported to exist in WWW File
Share Pro that may allow a remote attacker to cause the server to crash or
hang. The problem reportedly occurs during the handling of HTTP GET
requests. An attacker may crash the server process by sending an
excessively long HTTP GET request causing a denial of service condition.
Successful exploitation of this vulnerability may allow a remote attacker
to cause the vulnerable server to crash or hang, affectively denying
service to legitimate users. Although unconfirmed, exploitation could
result in memory corruption, which could in turn be leveraged to execute
arbitrary code.
WWW File Share Pro versions 2.46 and prior may be prone to this issue.
7. Sun Microsystems Sun One Web Server Remote Buffer Overflow V...
BugTraq ID: 9399
Remote: Yes
Date Published: Jan 12 2004
Relevant URL: http://www.securityfocus.com/bid/9399
Summary:
Sun ONE is the enterprise web server package distributed and maintained by
Sun Microsystems. It is available for the Unix and Microsoft Windows
platforms.
Sun Microsystems Sun ONE has been reported to be vulnerable to a remote
buffer overflow vulnerability. Because of this, it is possible for a
remote attacker to deny service to legitimate users of an affected web
server. This problem is known to affect Sun ONE on the HP-UX platform
only.
Specific details of the impact and affected component are not currently
available. However, it is theorized that due to the nature of the
problem, a boundary condition error, it may also be possible to execute
arbitrary code with the privileges of the web server process. This theory
has not been confirmed by Symantec or Sun Microsystems.
The technical description of this vulnerability will be further updated as
additional information on the scope of this issue becomes available.
8. Zope Multiple Vulnerabilities
BugTraq ID: 9400
Remote: Yes
Date Published: Jan 12 2004
Relevant URL: http://www.securityfocus.com/bid/9400
Summary:
Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.
Multiple vulnerabilities have been reported to exist in the software that
may allow an attacker to carry out attacks resulting from improper input
validation, access validation, information disclosure, and various
improper security checks on a vulnerable system. Successful exploitation
of these issues may lead to cross-site scripting attacks, denial of
service conditions, and other attacks.
The following specific issues have been identified:
The ZSearch interface has been reported to be prone to a cross-site
scripting vulnerability. Successful exploitation of this issue may allow
a remote attacker to carry out cross-site scripting attacks by enticing a
victim user to follow a malicious link to a site hosting the software that
contains embedded HTML and script code. The embedded code may be rendered
in the web browser of the victim user in the security context of the site
hosting the vulnerable software.
A denial of service vulnerability has been identified in
'ZTUtils.SimpleTree' that may allow an attacker to cause a denial of
service condition the software. This condition results from improper
state handling.
An access validation issue has been reported to exist in the admin "find"
functions. This issue may lead to an attacker gaining access to sensitive
information without proper authentication.
An unspecified access validation issue has been identified in the
PropertyManager 'lines' and 'tokens' properties. It has been reported
that some property types are stored in a mutable data type (list) and may
allow untrusted code to effect changes on the properties without proper
security validation.
An unspecified access validation issue may exist in the DTMLDocument
objects. This issue could allow an attacker to gain access to sensitive
information.
Another access validation issue has been identified in DTMLMethods. It
has been reported that DTMLMethods proxy rights may be incorrectly
inherited when traversing to a parent object.
A denial of service vulnerability has been identified in DTML tag
'dtml-tree' that may allow an attacker to cause a denial of service
condition the software.
An information disclosure vulnerability is reported to exist in the
software. This issue may allow an attacker to disclose certain attributes
via XML-RPC marshalling of class instances.
An access validation issue has been reported to exist in the software that
may allow unauthorized access to certain variables. This issue occurs due
to improper initialization of PythonScript class security.
A denial of service vulnerability exists in RESPONSE.write() that may
allow an attacker to pass malicious unicode values resulting in Zserver
main loop to terminate resulting in a crash or hang.
An access validation issue may exist in the software due to Unpacking via
function calls, variable assignment, exception variables without
sufficient security check. This issue may allow an attacker to gain
access to sensitive data.
Another access validation issue may allow an attacker to execute a
malicious script on a vulnerable system in order to gain unauthorized
access to certain objects. This issue results from improper verification
of variables bound to page templates and Python scripts such as 'context'
and 'container'.
An unspecified error has been reported to exist due to the use of min,
max, enumerate, iter, and sum in untrusted code.
An issue has been identified in the use of 'import as' in Python scripts
that may allow an attacker to bypass security checks.
Another access validation issue has been identified in the list and
dictionary instance methods that may allow an attacker to gain
unauthorized access to certain objects. A similar issue has also been
identified in for loops, list comprehensions, and other iterations of
untrusted code.
Further analysis of these issues is currently underway. This BID will be
separated into individual BIDs upon completion of analysis.
These issues have been reported to exist in Zope versions 2.6.2 and prior
and development releases 2.7.0 beta3. Other versions could be affected as
well.
9. Symantec LiveUpdate Local Privilege Escalation Vulnerability
BugTraq ID: 9401
Remote: No
Date Published: Jan 12 2004
Relevant URL: http://www.securityfocus.com/bid/9401
Summary:
Symantec products contain a feature called LiveUpdate. LiveUpdate is a
process that checks for new virus definitions and product updates over the
Internet. If updates are available it downloads and installs them from a
Symantec site. This process can either be scheduled or performed manually.
Symantec LiveUpdate has been reported prone to a local privilege
escalation vulnerability when configured to update automatically
(AutoUpdate) with end user notifications. When LiveUpdate is configured in
this manner, if an update is available over the LiveUpdate service, an
icon will appear in the Windows system taskbar. A local non-privileged
user may reportedly employ this icon when it is available to launch an
interactive LiveUpdate session.
The vulnerability exists because LiveUpdate is initially started with
SYSTEM privileges. The privileges of the LiveUpdate interactive process
however, if different from the user, are not lowered. This may allow a
local attacker to manipulate the GUI of the vulnerable LiveUpdate
interactive session to spawn arbitrary processes with the privileges of
the LiveUpdate process.
An attacker with local interactive system access may exploit this
condition to gain SYSTEM privileges.
The "AutoUpdate" feature of LiveUpdate, is only shipped with retail
versions of Symantec products. Consequently this vulnerability does not
affect any of the Symantec corporate edition products
10. Mabry Software FTPServer/X Controls Format String Vulnerabil...
BugTraq ID: 9402
Remote: Yes
Date Published: Jan 12 2004
Relevant URL: http://www.securityfocus.com/bid/9402
Summary:
Mabry Software FTPServer/X is an ActiveX Control and COM Object, designed
to be incorporated into FTP server software for Microsoft Windows
platforms.
FTPServer/X has been reported to be prone to a remote format string
vulnerability when processing a malicious request from a client.
The vulnerability presents itself when the server receives a malicious
request containing embedded format string specifiers from a remote client
when supplying a username during FTP authentication. The source of the
problem is incorrect use of a formatted printing function, which processes
data supplied during FTP server authentication. As a result, format
specifiers supplied in this manner will be interpreted literally and may
result in attacker-specified memory being corrupted or disclosed.
Although it has been demonstrated that this could crash the server, the
vulnerability could also theoretically allow for execution of arbitrary
code on the system hosting the server. This would occur in the security
context of the server process.
FTPServer/X COM Object version 1.00.050 has been reported to be
vulnerable to this issue, however, other versions could be affected as
well. It should be noted that any software that implements the Mabry
Software FTPServer/X control, is likely affected by this vulnerability. It
has been confirmed that this control is in use by Mollensoft(Hyperion) FTP
Server.
11. Mabry Software FTPServer/X Controls Unspecified Buffer Overf...
BugTraq ID: 9403
Remote: Yes
Date Published: Jan 12 2004
Relevant URL: http://www.securityfocus.com/bid/9403
Summary:
Mabry Software FTPServer/X is an ActiveX Control and COM Object, designed
to be incorporated into FTP server software for Microsoft Windows
platforms.
FTPServer/X has been reported to be prone to an unspecified remote buffer
overflow vulnerability. Because of this, it may be possible for a remote
attacker to gain unauthorized access to a system running the vulnerable
software. The condition is present due to insufficient boundary checking.
The issue may be related to the 'mkdir' command. An attacker may send a
malformed 'mkdir' command containing excessive data to a vulnerable
server. Immediate consequences of an attack may result in a denial of
service condition.
An attacker may leverage the issue by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing an
affected procedure to return to an address of their choice. Successful
exploitation of this issue may allow an attacker to execute arbitrary code
in the context of the vulnerable software in order to gain unauthorized
access, however, this has not been confirmed.
FTPServer/X COM Object version 1.00.050 has been reported to be vulnerable
to this issue, however, other versions could be affected as well. It
should be noted that any software that implements the Mabry Software
FTPServer/X control, is likely affected by this vulnerability. It has been
confirmed that this control is in use by Mollensoft(Hyperion) FTP Server.
12. Mod-Auth-Shadow Apache Module Expired User Credential Weakne...
BugTraq ID: 9404
Remote: Yes
Date Published: Jan 12 2004
Relevant URL: http://www.securityfocus.com/bid/9404
Summary:
Mod-Auth-Shadow is a module for the Apache server that authenticates users
against the /etc/shadow file on Unix and Linux platforms.
A problem has been identified in mod-auth-shadow that may permit a user to
gain access to a system after the expiration of their credentials. This
weakness may result in users gaining access to the web site outside of the
period of validity for their credentials.
The problem is in the handling of expiration data entered into the
/etc/shadow file. Specific details of this weakness are not available.
This vulnerability entry will be updated when further information becomes
available.
13. BEA WebLogic Ant Tasks Administrative Password Exposure Vuln...
BugTraq ID: 9405
Remote: No
Date Published: Jan 12 2004
Relevant URL: http://www.securityfocus.com/bid/9405
Summary:
WebLogic Server and WebLogic Express are enterprise application server
products distributed by BEA Systems.
It has been reported that WebLogic Server and WebLogic Express may expose
the administrator account password in plain text.
The issue occurs when the administrator is using the "wldeploy",
"wlserver" or "wlconfig" Ant tasks. These tasks may echo the
administrator account password to the screen, allowing it to potentially
be seen by an attacker. Additionally, the password would be in any log
files generated from the output of Ant tasks, also in plain text.
14. Multiple Vendor H.323 Protocol Implementation Vulnerabilitie...
BugTraq ID: 9406
Remote: Yes
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9406
Summary:
The H.323 protocol is used in various telephony and multimedia products in
IP networks. It may be used in hardware products supporting multimedia
conferencing as well as various operating systems.
The H.225 subcomponent of the H.323 protocol was found to have multiple
vulnerabilities in various vendor implementations of the protocol. H.225
is most commonly used as a component of Voice over IP (VoIP). These
vulnerabilities may range from a denial of service to potential arbitrary
code execution.
For a complete listing of vulnerable vendors and products, see the
referenced advisory.
Not all vendor advisories are currently available. Once more information
becomes available on specific vulnerabilities contained in affected
products, this BID will be split into separate records.
Cisco has reported that Cisco IOS 11.3T and all later Cisco IOS versions
might be affected if the software supports voice or multimedia
applications.
15. Microsoft MDAC Function Broadcast Response Buffer Overrun Vu...
BugTraq ID: 9407
Remote: Yes
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9407
Summary:
Microsoft Data Access Components (MDAC) provide components for database
access, including functionality for querying local and remote databases of
various formats.
Microsoft has released an advisory reporting a buffer overrun
vulnerability in an MDAC function. This issue is exposed when an
application makes a broadcast request to query for SQL Servers on the
network and malformed data is returned in the broadcast response. The
source of the issue is insufficient bounds checking of reply data,
allowing for process memory to be corrupted and execution flow to be
influenced by remote attackers, resulting in execution of malicious code.
An attacker could exploit this by simulating an SQL Server to return a
malicious UDP packet to a client that initiated the broadcast.
Successful exploitation will allow for code execution in the context of
the application using the vulnerable MDAC function. If the application is
run with system-level privileges, this could completely compromise a
vulnerable system. Exploitation attempts may also result in a denial of
service in client applications.
Microsoft has reported that this would only result in a denial of service
with MDAC 2.8.
16. Microsoft ISA Server 2000 H.323 Filter Remote Buffer Overflo...
BugTraq ID: 9408
Remote: Yes
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9408
Summary:
The H.323 filter is used by Microsoft ISA Server 2000 to monitor and
filter traffic using H.323 and T.120 protocols. The H.323 and T.120
protocols are used by IP Telephony applications. The H.323 filter is
reported to be enabled by default on ISA Server 2000.
A buffer overflow vulnerability has been reported to exist in the H.323
filter that may allow a remote attacker to execute arbitrary code on a
vulnerable system. The issue presents itself when an attacker sends
malformed H.323 traffic to a vulnerable system. The condition exists due
to insufficient boundary checking. Because of this, it may be possible
for a remote attacker to gain unauthorized access to a system running the
vulnerable software.
Successful exploitation of this vulnerability may allow a remote attacker
to execute arbitrary code in the context of Microsoft Firewall Service on
ISA Server 2000. This may lead to complete control of the vulnerable
system.
This issue was originally described as part of BID 9406. It is now being
assigned a separate BID and the original record will be retired.
17. Microsoft Exchange Server 2003 Outlook Web Access Random Mai...
BugTraq ID: 9409
Remote: Yes
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9409
Summary:
Microsoft Exchange Server 2003 is an e-mail and directory server offered
by Microsoft. Outlook Web Access (OWA) is a service provided by Exchange
server that allows users to access their Exchange mailbox via the web.
A vulnerability exists that could allow an authenticated OWA user to
connect to another OWA user's mailbox. Only mailboxes recently accessed
through OWA on the same Exchange server could be accessed in this way. An
attacker could not choose which mailbox to connect to; the connection
would be random.
The vulnerability only exists when the back-end Exchange server hosting
the OWA mailboxes is configured not to use Kerberos authentication with
the front-end Exchange server running on the IIS server. In this case,
authentication would fall back to NTLM authentication. The only method
for exposing the vulnerability in this way without intervention by an
administrator would be through the weakness described in BID 9118.
When these circumstances occur, the front-end Exchange server will
periodically attempt to authenticate with the back-end server using
Kerberos authentication. On these requests, IIS 6 will ignore the
Kerberos authentication and allow access to the open connections that were
already authenticated with NTLM.
Successful exploitation of this vulnerability could allow a remote
attacker to access sensitive information in another user's mailbox or send
email as that user.
18. SuSE YaST SuSEconfig.gnome-filesystem Local Insecure File Cr...
BugTraq ID: 9411
Remote: No
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9411
Summary:
YaST helps configure and reconfigure SuSE Linux systems. The
SuSEConfig.gnome-filesystem script is designed to set up the GNOME
environment.
SuSEconfig.gnome-filesystem has been reported prone to an insecure file
creation vulnerability that may be exploited to corrupt arbitrary files.
The issue has been reported to present itself because the
SuSEconfig.gnome-filesystem script will follow symbolic links (symlinks)
when writing certain specific files.
Ultimately a local user may exploit this condition by creating a symlink
in the place of the vulnerable SuSEconfig.gnome-filesystem file. The
malicious symlink will point to an arbitrary file on the system. When an
unsuspecting user invokes SuSEconfig.gnome-filesystem, potentially via the
YaST software, the file linked by the symlink will be corrupted, the file
corruption will occur only if the user invoking
SuSEconfig.gnome-filesystem has sufficient privileges to write to the
target file. A local user may leverage this condition to corrupt arbitrary
files triggering a system wide denial of service or potentially elevating
their system privileges.
SuSE Linux 9.0 has been reported to be prone to this issue, however, other
versions could be affected as well.
19. Novell iChain Web Server Failed Login Page Cross-Site Script...
BugTraq ID: 9412
Remote: Yes
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9412
Summary:
Novell iChain Server is a web-based security product designed to implement
and maintain various network-based access controls. iChain implements a
web server with limited functionality.
A vulnerability has been reported to exist in the software that may allow
a remote user to launch cross-site scripting attacks. The problem is
reported to exist due to improper sanitizing of user-supplied data in the
'url=' parameter passed to the failed login page. This vulnerability makes
it possible for an attacker to construct a malicious link containing HTML
or script code that may be rendered in a user's browser upon visiting that
link. This attack would occur in the security context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Other attacks are also possible.
20. H+BEDV AntiVir Insecure Temporary File Creation Symbolic Lin...
BugTraq ID: 9413
Remote: No
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9413
Summary:
AntiVir is an anti-virus software package distributed by H+BEDV. It is
available for Linux and Windows platforms.
An error in the handling of temporary file creation may allow local
destruction of data.
It has been reported that AntiVir does not securely create temporary files
when the process is executed. Due to this issue a local attacker may be
able to launch a symbolic link attack against system files.
This issue is due to the software failing to properly determine if a
temporary file exists before attempting to create it. When the
application begins execution, the temporary file /tmp/.pid_antivir_X is
created, where 'X' represents the process ID of the application. In
typical configurations, this file is created by the root user, and is not
removed until the computer is rebooted.
A local attacker could exploit this issue by successfully guessing the
name of a future temporary file and creating a symbolic link to a target
system file. Upon reboot, the AntiVir software will then write to the
guessed symbolic link. When the AntiVir software writes to the symbolic
link file it may destroy sensitive data, which could result in denial of
service.
This vulnerability is only known to affect the version of the software for
the Linux platform.
21. HP Tru64 UNIX Unspecified Remote Buffer Overflow Vulnerabili...
BugTraq ID: 9414
Remote: Yes
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9414
Summary:
HP has reported multiple local and remote buffer overflow vulnerabilities
Tru64 UNIX. The conditions are reported to exist in Tru64 UNIX running
IPsec and SSH software.
The vulnerabilities may potentially be exploited by an attacker to execute
arbitrary code or to cause a denial of service condition. The nature of
these issues may allow an attacker to corrupt memory with
attacker-supplied values, which may potentially result in execution of
arbitrary code.
In the instance of the local buffer overflows, exploitation of some of
these issues may not yield any extra privileges for the attacker, if the
packages are not installed setuid/setgid. With remote buffer overflows,
successful exploitation may allow an attacker to execute arbitrary code
with the privileges of the user running the utility or server.
HP Tru64 UNIX versions 5.1B PK2 (BL22), PK3 (BL24) and V5.1A running IPsec
and SSH software kits prior to IPsec 2.1.1 and SSH 3.2.2 have been
reported to be prone to these issues.
This vulnerability record will be divided into multiple Bugtraq IDs when
analysis of the individual issues is complete. Some of these issues may
already be known. Where it is appropriate, existing Bugtraq IDs will also
be updated to reflect the information in the advisory. Although
unconfirmed, it is likely that these issues are related to OpenSSL SSLv2
Client_Master_Key Remote Denial Of Service Vulnerability (BID 8746),
OpenSSL ASN.1 Parsing Vulnerabilities (BID 8732), and OpenSSL ASN.1 Large
Recursion Remote Denial Of Service Vulnerability (BID 8970).
22. Snort_Inline Rule 2077 Failure Vulnerability
BugTraq ID: 9415
Remote: Yes
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9415
Summary:
snort_inline is a modified version of Snort. snort-inline is designed to
accept packets from iptables, it then instructs iptables as to whether the
packet should be dropped based on a snort rule set.
snort_inline has been reported prone to a vulnerability. The issue is said
to occur when snort_inline is configured so that the action for rule 2077
(Rule to flag for BID 6572 Mambo Site Server Arbitrary File Upload
Vulnerability) is to drop the packets. It has been reported that
regardless of this rule, after a period of time has elapsed snort_inline
will permit the attackers requests, even though this traffic is supposedly
categorically denied.
This may lead a network administrator into a false sense of security,
believing that communications based on the vulnerable rule set are
blocked, when in fact they are not.
23. KAME Racoon "Authentication" SA Deletion Vulnerability
BugTraq ID: 9416
Remote: Yes
Date Published: Jan 13 2004
Relevant URL: http://www.securityfocus.com/bid/9416
Summary:
KAME Racoon is an IPSec key management daemon developed for BSD Unix
platforms that is used for negotiating and configuring security
associations in authenticated or encrypted network traffic.
It has been reported that it may be possible for attackers to remotely
delete security associations (SAs) in hosts running the KAME IKE daemon
Racoon.
The issue presents itself when the Racoon daemon receives and handles a
specially crafted delete message. The delete message will consist of an
Initiator-Cookie of a Main/Aggressive/Base mode that has not yet setup a
security association for ISAKMP. Racoon erroneously fulfills the malicious
request provided that the malicious message includes a dummy hash payload
and originates from the correct IP address, which can be easily spoofed.
To exploit this vulnerability an attacker would carry out a two-step
process after first creating an IPsec tunnel to the server using a spoofed
IP address. The attacker will then craft a malicious message in a manner
that is sufficient to trigger the vulnerability. Ultimately, if successful
the attacker may delete security associations, resulting in a disruption
of service.
24. KAME Racoon "Initial Contact" SA Deletion Vulnerability
BugTraq ID: 9417
Remote: Yes
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9417
Summary:
KAME Racoon is an IPSec key management daemon developed for BSD Unix
platforms that is used for negotiating and configuring security
associations in authenticated or encrypted network traffic.
It has been reported that it may be possible for attackers to remotely
delete security associations (SAs) in hosts running the KAME IKE daemon
Racoon.
The issue presents itself when the Racoon daemon receives and handles a
specially crafted delete message. An attacker would exploit this issue by
initializing an IPsec session with the vulnerable server and proceeding to
inject a malicious ISAKMP message into the phase one communication.
Racoon will simply execute the message, which may cause the deletion of
all security associations (SAs) "relative to the destination address"
This vulnerability is reportedly much easier to exploit and much more
effective than the issue described as Bugtraq ID 9416.
Exploitation of this vulnerability may result in a disruption of service.
25. Symantec Web Security Block Page Message Cross-Site Scriptin...
BugTraq ID: 9418
Remote: Yes
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9418
Summary:
A vulnerability has been reported to exist in Symantec Web Security that
may allow a remote user to launch cross-site scripting attacks.
The issue is reported to exist due to improper sanitizing of user-supplied
data. It has been reported that HTML and script code may be parsed via
URI parameters included in an error or block page message. This
vulnerability makes it possible for an attacker to construct a malicious
link containing HTML or script code that may be rendered in a user's
browser upon visiting that link. This attack would occur in the security
context of the site.
Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication credentials. Other attacks are also possible.
Symantec Web Security versions 2.5, 3.0.0, and 3.0.1 have been reported to
be vulnerable to this issue.
26. KDE Personal Information Management Suite VCF File Remote Bu...
BugTraq ID: 9419
Remote: Yes
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9419
Summary:
KDE Personal Information Management Suite (kdepim) helps users organize
mail, tasks, appointments, contacts etc. It is packaged with KDE, a
graphical desktop for the X Window System.
A buffer overflow vulnerability has been reported to exist in the KDE
Personal Information Management Suite (kdepim) that may allow a remote
attacker to execute arbitrary code on a vulnerable system. The issue
presents itself when an attacker sends a malformed VCF file to a user on a
vulnerable system. Due to a problem with the file information reader of
VCF files, an attacker may be able to execute arbitrary code on a
vulnerable system if the malicious VCF file is opened by the user.
The condition exists due to insufficient boundary checking. Because of
this, it may be possible for a remote attacker to gain unauthorized access
to a system running the vulnerable software.
Successful exploitation of this vulnerability may allow a remote attacker
to execute arbitrary code in the context of the user.
27. HP SharedX Unspecified Local Insecure File Access Vulnerabil...
BugTraq ID: 9420
Remote: No
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9420
Summary:
SharedX is the enhanced X protocol implemented by HP. It is available for
the Unix platform.
A problem has been identified in the way HP SharedX accesses files.
Because of this, a local attacker may be able to deny service to
legitimate users, or potentially gain unauthorized access.
Few details concerning this issue are available. Upon the release of
additional information concerning this issue, this vulnerability entry
will be further updated.
28. Real Networks Helix Server/Gateway Administration Service HT...
BugTraq ID: 9421
Remote: Yes
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9421
Summary:
Helix Universal Server is a media delivery server distributed and
maintained by Real Networks. It is available for the Unix, Linux, and
Microsoft Windows platforms.
A problem has been identified in the handling of HTTP post requests by the
administrative service in Real Networks Helix Universal Server. Because
of this, a remote attacker may deny service to legitimate users of the
server on an affected host.
This issue requires the attacker to have legitimate administrative service
login credentials to exploit. The root of the problem appears to be an
issue in the adminfs.so library, available on Microsoft Windows as
admi3260.dll. An attacker may send a maliciously crafted HTTP POST
request to the service, and upon the service receiving the request, it
crashes. This is likely due to an input-handling bug in the adminfs.so
library; this however has not been confirmed.
The server requires a manual restart to resume normal operation. In
addition to the Helix Universal Server, this problem is known to affect
the Helix Universal Gateway, Helix Universal Mobile Server, and Helix
Universal Mobile Gateway.
29. nCipher payShield SPP Library Bad Request Verification Vulne...
BugTraq ID: 9422
Remote: Yes
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9422
Summary:
nCipher payShield is a software/appliance solution, for an e-payment
security infrastructure.
payShield SPP Library has been reported prone to a vulnerability that may
result in bad requests being verified. This issue has only been reported
to present itself in the host-side library and applications that are
linked to it. It has been reported that the vulnerability exists because
the status of a command that is being processed when a module query is
triggered, may be lost.
Ultimately this may lead to a circumstance where an invalid PIN
verification will correctly return "Status_VerifyFailed" from the
payShield Hardware Security Module, but the associated library call
"SPP_VerifyPVV()" may return a "Status_OK".
An attacker may exploit this issue if they have access to the payShield
application; to flood the affected software with invalid requests until
eventually a "Status_OK" response is returned.
30. TCPDump ISAKMP Decoding Routines Multiple Remote Buffer Over...
BugTraq ID: 9423
Remote: Yes
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9423
Summary:
tcpdump is a freely available open source network monitoring tool. It is
available for the Unix, Linux, and Microsoft Windows operating systems.
Multiple buffer overflow vulnerabilities have been reported to exist in
tcpdump that may allow a remote attacker to gain unauthorized access to a
system running the vulnerable software. The conditions are present due to
insufficient boundary checking.
The conditions are reported to exist in the ISAKMP decoding routines of
tcpdump. It has been reported that a remote attacker may be able to cause
a buffer overrun condition by sending specially crafted packets to a
vulnerable system. Immediate consequences of a successful attack may
cause a denial of service condition in the software, however, it has been
reported that an attacker may be able to execute arbitrary code on a
vulnerable system as the 'pcap' user.
An attacker may leverage the issue by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing an
affected procedure to return to an address of their choice. Successful
exploitation of these issues may allow an attacker to execute arbitrary
code as the 'pcap' user in order to gain unauthorized access.
Some of the issues are reported to affect tcpdump versions prior to 3.8.1
and others reportedly affect all versions up to and including tcpdump
3.8.1.
This vulnerability record will be divided into multiple Bugtraq IDs when
analysis of the individual issues is complete. Some of these issues may
already be known. Where it is appropriate, existing Bugtraq IDs will also
be updated to reflect the information in the advisory.
31. PHPDig Config.PHP Include Remote Command Execution Vulnerabi...
BugTraq ID: 9424
Remote: Yes
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9424
Summary:
PhpDig is a freely available, open source search engine written in PHP.
It is available for the Unix and Linux operating systems.
A problem has been identified in the handling of includes in PhpDig.
Because of this, it may be possible for a remote user to gain unauthorized
access to a vulnerable host.
The problem is in the filtering of input by the config.php script located
in the includes sub-directory. It is possible for an attacker to supply
the $relative_script_path variable to the config.php script, making it
possible to include a script from a remote system containing malicious
content. Upon supplying the location to the malicious language file or
other file required by the script, the commands contained in the file
would be executed on the vulnerable host.
It should be noted that commands executed on a host through this
vulnerability will be carried out with the privileges of the web server
process.
32. LionMax Software WWW File Share Pro Multiple Remote Vulnerab...
BugTraq ID: 9425
Remote: Yes
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9425
Summary:
LionMax Software WWW File Share Pro is a HTTP server that runs on
Microsoft Windows platforms.
WWW File Share Pro has been reported prone to multiple remote
vulnerabilities.
The first reported issue is that a remote attacker may employ the "upload"
functionality of the vulnerable software to overwrite arbitrary files that
are writable by the WWW File Share Pro process. An attacker may exploit
this vulnerability by including "../" directory traversal sequences in the
filename of the uploaded file.
The second issue reported, may allow a remote user to deny service to the
affected software. It has been reported that if WWW File Share Pro handles
a POST request that contains excessive data it will consume system
resources and leave the affected system unresponsive. The POST request
must consist of a large Content-Length HTTP header value, and may contain
POST data that exceeds 2 megabytes of data.
The final issue that has been reported regards the access control routines
used to control access to directories that are protected by WWW File Share
Pro. It has been reported that a remote attacker may invoke a specially
crafted HTTP request for the target protected resource and in doing so may
bypass access controls. The malicious URI must include a period character
appended to the target folder name. Alternatively the URI may contain one
or more slash or backslash characters prepended to the target folder name.
33. FishNet FishCart Rounding Function Integer Wrapping Vulnerab...
BugTraq ID: 9426
Remote: Yes
Date Published: Jan 14 2004
Relevant URL: http://www.securityfocus.com/bid/9426
Summary:
FishCart is a commercially available, open source shopping cart software
package. It is available for the Unix, Linux, and Microsoft platforms.
A problem in the handling of rounding has been discovered in FishNet
FishCart. Because of this, attackers entering numbers of excessive size
may be able to produce unexpected results in a vulnerable implementation.
The problem is in the rnd() function. By passing numbers of one billion
or more to fields in the software that pass the value to the rnd()
function, it is possible to force the value to wrap to a negative value.
An attacker could exploit this issue to interrupt business operations, and
potentially create security issues.
34. Vicomsoft RapidCache Server Host Argument Denial of Service ...
BugTraq ID: 9427
Remote: Yes
Date Published: Jan 15 2004
Relevant URL: http://www.securityfocus.com/bid/9427
Summary:
Vicomsoft RapidCache is a web caching server that runs on Microsoft
Windows and Apple MacOS platforms.
A remote denial of service vulnerability has been reported to exist in the
software that may allow an attacker to cause the server to crash.
The issue presents itself when an attacker sends an excessively large
string value to the server via the 'Host' argument through an HTTP GET
request. Immediate consequences of an attack may result in a denial of
service condition affectively denying service to legitimate users.
Although unlikely, there is a possibility that this issue may allow an
attacker to execute arbitrary code with the privileges of the server
process in order to gain unauthorized access.
RapidCache versions 2.2.6 and prior have been reported to be prone to this
issue.
35. Vicomsoft RapidCache Server Directory Traversal Vulnerabilit...
BugTraq ID: 9428
Remote: Yes
Date Published: Jan 15 2004
Relevant URL: http://www.securityfocus.com/bid/9428
Summary:
Vicomsoft RapidCache is a web-caching server that runs on Microsoft
Windows and Apple MacOS platforms.
A vulnerability has been reported to exist in RapidCache that may allow a
remote attacker to access information outside the server root directory.
The problem exists due to insufficient sanitization of user-supplied data.
The issue may allow a remote attacker to traverse outside the server root
directory by using '../' character sequences.
Successful exploitation of this vulnerability may allow a remote attacker
to gain access to sensitive web server readable information that may be
used to launch further attacks against a vulnerable system.
RapidCache versions 2.2.6 and prior have been reported to be prone to this
issue.
36. Linux Kernel 32 Bit Ptrace Emulation Full Kernel Rights Vuln...
BugTraq ID: 9429
Remote: No
Date Published: Jan 15 2004
Relevant URL: http://www.securityfocus.com/bid/9429
Summary:
Unix and Unix-like kernels offer a debugging facility called ptrace.
Ptrace allows for one process to 'attach' to another and inspect/modify
it's memory. Updating certain sections of memory (system registers) that
control a process's privileges must be carefully verified to ensure that
privilege is not escalated.
A vulnerability has been discovered in the 32-bit ptrace emulation in the
Linux kernel on x86_64 (AMD64) architectures. This vulnerability allows a
user space program to gain full control of the kernel due to a failure to
validate information stored in a system register.
It has been reported that due to improper validation of the data written
to the EFLAGS register of a child process it is possible for a user
process to set itself, or another process, to ring 0 privileges. Ring 0
is the highest possible privilege level, and so the user space process can
gain full control of the vulnerable kernel.
This issue arises because the PTRACE_SETREGS request, when used to set the
EFLAGS register, fails to retain the previous state of the system flags.
At every write to the EFLAGS register, the ptrace software clears all of
the EFLAGS flags that a restricted to privileged processes. This results
in setting the I/O Privilege Level (via the IOPL flag in the EFLAGS
register) to ring 0, giving the process the ability to write to memory
space outside of its own. Another result of this is that all maskable
interrupts become disabled. This could be used to crash the kernel and
therefor result in denial of service.
This issue is known to affect the 2.4 Linux kernels that support the
x86_64 (AMD 64) architecture, however other version of the kernel may also
be vulnerable for x86_64 (AMD64) processors.
Further information concerning this issue is not currently available. This
BID will be updated as more information becomes available.
37. ELM frm Command Remote Buffer Overflow Vulnerability
BugTraq ID: 9430
Remote: Yes
Date Published: Jan 15 2004
Relevant URL: http://www.securityfocus.com/bid/9430
Summary:
ELM is a mail user agent for unix.
A buffer overflow vulnerability has been reported to exist in ELM e-mail
client that may allow a remote attacker to execute arbitrary code on a
vulnerable system.
It has been reported that a remote attacker may be able to cause a buffer
overrun condition by sending a message with an excessively long header
field. Specifically, the issue is presented if the maliciously crafted
message is opened by a user via the 'frm' command. The condition exists
due to insufficient boundary checking. Because of this, it may be possible
for a remote attacker to gain unauthorized access to a system running the
vulnerable software.
Successful exploitation of this vulnerability may allow a remote attacker
to execute arbitrary code in the context of the user running the affected
mail client.
Although unconfirmed, ELM versions 2.5.6 and prior may be vulnerable to
this issue.
38. Whale Communications e-Gap Security Appliance Login Page Sou...
BugTraq ID: 9431
Remote: Yes
Date Published: Jan 15 2004
Relevant URL: http://www.securityfocus.com/bid/9431
Summary:
Whale Communications e-GAP appliance provides for a secure remote web
access platform.
The e-GAP appliance has been reported prone to a source code disclosure
vulnerability. It has been reported that, when the affected appliance
handles unexpected HTTP requests it may divulge the source code of the
login script.
An attacker may exploit this condition to reveal information that may be
harnessed to aid in further attacks against the target system.
It should be noted that although this vulnerability has been reported to
affect Whale Communications e-GAP appliance version 2.5, other versions
might also be affected.
39. QMail-SMTPD Long SMTP Session Integer Overflow Denial of Ser...
BugTraq ID: 9432
Remote: Yes
Date Published: Jan 16 2004
Relevant URL: http://www.securityfocus.com/bid/9432
Summary:
qmail is a popular Mail Transfer Agent (MTA).
A vulnerability has been reported to exist in qmail-smtpd that may allow a
remote attacker to cause a denial of service condition in the software. It
has been reported that an attacker may be able to crash the current
qmail-smtpd session via a long SMTP request. The problem is reported to
exist due to an integer-handling bug. It has reported that the excessive
SMTP session data causes a signed integer to wrap; this negative value is
then employed as an array subscript. A subsequent attempt to access the
out-of-bounds address based on the wrapped integer will trigger a segment
violation. This may be leveraged by a remote attacker to consume resources
and thereby deny service to legitimate users.
A remote attacker may potentially exploit this vulnerability to crash or
hang a qmail SMTP session.
qmail 1.03 running on a Linux platform has been reported to be prone to
this issue, however, other versions may be affected as well.
40. Rit Research Labs The Bat! PGP Message Memory Writing Vulner...
BugTraq ID: 9433
Remote: Yes
Date Published: Jan 16 2004
Relevant URL: http://www.securityfocus.com/bid/9433
Summary:
The Bat! is a commercially-available mail user agent, distributed and
maintained by Rit Research Labs. It is available for the Microsoft Windows
platform.
It has been reported that there is an issue with the way The Bat! handles
certain malformed PGP signed messages. PGP support is configured by
default.
The issue exists when The Bat! processes email messages containing PGP
signatures with multiple recursively included parts. Specially
constructed malformed signatures could allow The Bat! to read and write to
unallocated regions of memory. This could potentially allow for execution
of arbitrary attacker-supplied code.
It is important to note that since The Bat! contains its own exception
handler, the application will not crash when processing messages
containing these malformed PGP signatures.
This issue was reported to affect The Bat! 2.01. The vendor has reported
that the issue could not be reproduced on The Bat! 2.03 beta and that 2.02
CE is probably not vulnerable. The Bat! versions 1.x are not vulnerable
to this issue.
41. SuSE 3Ddiag Insecure Temporary File Handling Symbolic Link V...
BugTraq ID: 9434
Remote: No
Date Published: Jan 15 2004
Relevant URL: http://www.securityfocus.com/bid/9434
Summary:
3Ddiag is a 3D diagnosis tool designed to evaluate the 3D hardware,
software libraries and hardware driver configuration on SuSE Linux 7.3 and
greater.
A vulnerability has been found in the handling of temporary files by the
3Ddiag tool in the SuSE Linux distribution. This issue may allow local
destruction of data on affected systems potentially leading to a loss of
sensitive data or denial of service.
This issue is due to the 3Ddiag tool failing to properly handle the
creation and state of temporary files in the /usr/bin/switch2nv,
/usr/bin/switch2nvdia and /usr/bin/3Ddiag.ignoredb applications.
The switch2nv and switch2nvidia scripts, which are used by the 3Ddiag
utility, create a file in the /tmp directory named XF86Config. An attacker
would be able to remove the temporary file and replace it with a malicious
symbolic link pointing to a target file. When either application is
activated it will write to the link with root privileges and without
verifying the files validity, causing the target file to be overwritten.
The 3Ddiag.ignoredb application creates a temporary file in the /tmp/
directory named 3Ddiag.ignoredb. An attacker can create a symbolic link
with a name corresponding to the temporary file. When the 3Ddiag
application is activated, the target file will be overwritten with root
privileges thus causing loss of sensitive data or denial of service
against the vulnerable system.
This issue is likely only to affect personal desktop machines and poorly
configured servers as this tool is implemented to update software
libraries and hardware configurations, and is not intended for use by
remote users. Furthermore this tool is only available for SuSE Linux 7.3
and greater.
42. OpenCA Crypto-Utils.Lib Signature Verification Vulnerability
BugTraq ID: 9435
Remote: Yes
Date Published: Jan 16 2004
Relevant URL: http://www.securityfocus.com/bid/9435
Summary:
OpenCA is an Open Source Certification Authority solution. OpenCA includes
a library to support Crypto procedures, this library is named
crypto-utils.lib.
OpenCA has reported a vulnerability in the crypto-utils.lib library,
specifically in the libCheckSignature() function. This function is
normally employed to load a signature from the OpenCA database and ensure
that the signer certificate matches. However a flaw has been discovered in
the manner in which the affected function operates, the
libCheckSignature() function only performs a comparison on the base of the
serial of the associated certificate. This may inadvertently lead to the
acceptance of a malicious certificate.
The vendor has reported that, if the signature chain can manufacture a
trust-relationship to the chain directory of OpenCA, and a valid
certificate that possesses a matching serial already exists in the Public
Key Infrastructure that is being used, then the malicious certificate may
be accepted.
The result of this issue is that a malicious party in possession of a
certificate that has been crafted in a manner sufficient to trigger this
vulnerability, could possibly sign something that may verify. This can be
abused to establish a false sense of trust, leading to a variety of other
attacks.
This issue has been reported to affect all versions of OpenCA up to and
including OpenCA version 0.9.1.6.
43. OpenBSD 3.4 Crypto Card Handlers File Descriptor Leak Vulner...
BugTraq ID: 9436
Remote: No
Date Published: Jan 16 2004
Relevant URL: http://www.securityfocus.com/bid/9436
Summary:
OpenBSD 3.4 has been reported prone to an undisclosed file descriptor leak
vulnerability. The vendor has reported that this vulnerability may present
problems when a crypto card is installed in the affected system.
Although unconfirmed it has been conjectured that this issue may be
exploited by a local attacker to gain access to a privileged IO channel.
Ultimately this may in turn allow an attacker to become privy to sensitive
data related to cryptological procedures. This, however, has not been
confirmed.
This issue does not affect OpenBSD 3.3.
This BID will be updated as further details regarding this vulnerability
are disclosed.
44. PHPShop Project Multiple Vulnerabilities
BugTraq ID: 9437
Remote: Yes
Date Published: Jan 16 2004
Relevant URL: http://www.securityfocus.com/bid/9437
Summary:
phpShop Project is a web based application development platform written in
php.
Multiple vulnerabilities have been reported to exist in the software that
may allow an attacker to carry out attacks against the database, disclose
sensitive information, and execute HTML or script code in a user's
browser.
The following specific issues were outlined:
Multiple vulnerabilities have been reported to exist in the software that
may allow a remote user to inject malicious SQL syntax into database
queries. The issues may be exploited via the 'page', 'offset' and
'product_id' variables of the software. The problems exist due to
insufficient sanitization of user-supplied data. A remote attacker may
exploit these issues to influence SQL query logic to disclose sensitive
information that could be used to gain unauthorized access.
An information disclosure issue has been identified in the software as
well. It has been reported that a user with valid credentials is able to
view sensitive information about any customer such as Nickname, Company
Name, Last Name, First Name, Middle Name, Address including City, State,
Zip Code, Country, Telephone, Fax Number via the account/shipto module.
Furthermore, it has been reported that the information is fairly easy to
gather as user IDs usually start with numbers ranging from 18 to 20. An
attacker may also be able to gather information about the administrator.
An HTML injection vulnerability is reported to exist in the software that
may allow an attacker to include malicious HTML code in one or many fields
of shipping information page. The injected code could then be interpreted
by the browser of a user visiting the vulnerable site.
Finally, multiple vulnerabilities have been reported to exist in the
software that may allow a remote user to launch cross-site scripting
attacks. Reportedly, the software contains various variables that are
prone to these attacks via HTTP GET requests. An attacker may carry out
cross-site scripting attacks without having access to a page as well.
Various proof of concepts including vulnerable variables have been
provided in the report. The cause of these vulnerabilities is improper
sanitization of user-supplied data.
phpShop versions 0.6.1-b and prior are reported to be vulnerable to these
issues.
45. XtremeASP PhotoGallery Adminlogin.ASP SQL Injection Vulnerab...
BugTraq ID: 9438
Remote: Yes
Date Published: Jan 16 2004
Relevant URL: http://www.securityfocus.com/bid/9438
Summary:
XtremeASP PhotoGallery is a web-based picture gallery script. It is
implemented in ASP and available for Microsoft Windows platforms.
XtremeASP PhotoGallery is back-ended by a MySQL database.
XtremeASP PhotoGallery is prone to an SQL injection vulnerability. The
issue is reported to exist in 'adminlogin.asp', which does not
sufficiently sanitize user-supplied input for username and password values
before including it in SQL queries. This could permit remote attackers to
pass malicious input to database queries, resulting in modification of
query logic or other attacks.
Successful exploitation could result in compromise of the photo gallery,
disclosure or modification of data or may permit an attacker to exploit
vulnerabilities in the underlying database implementation.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Feds seek input on spammer sentencing
By: Kevin Poulsen
Should deceptive spammers get extra prison time for harvesting e-mail
addresses from websites? Should their punishment be tied to the number of
messages they send? The commission charged with establishing sentences for
CAN-SPAM Act violators wants your input.
http://www.securityfocus.com/news/7846
2. No relief from Microsoft phishing bug
By: Kevin Poulsen
Redmond fails to patch a bug in Internet Explorer that makes consumers
easy prey for online fraudsters.
http://www.securityfocus.com/news/7807
3. Lamo Pleads Guilty to Times Hack
By: Kevin Poulsen
The hacker became a convicted felon Thursday, and now faces six to twelve
months in custody.
http://www.securityfocus.com/news/7771
4. Nigerian 419ers run dry
By: The Register
http://www.securityfocus.com/news/7856
5. New Internet virus spreading fast
By: Regan Morris, The Associated Press
http://www.securityfocus.com/news/7854
6. Beware the Habeas Joe Job
By: Jan Libbenga, The Register
http://www.securityfocus.com/news/7852
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. File::Scan v0.79
By: Henrique Dias <[email protected]>
Relevant URL: http://www.cpan.org/authors/id/H/HD/HDIAS/
Platforms: N/A
Summary:
File::Scan allows users to make multiplataform virus scanners which can
detect Windows/DOS/Mac viruses. It include a virus scanner and signatures
database.
2. Dropbear SSH Server v0.41
By: Matt Johnston
Relevant URL: http://matt.ucc.asn.au/dropbear/dropbear.html
Platforms: POSIX
Summary:
Dropbear is an SSH 2 server that is designed to be small enough to be used
in low-memory embedded environments, while still being functional and
secure enough for general use.
3. OSIRIS v3.0.0
By: The Shmoo Group
Relevant URL: http://osiris.shmoo.com
Platforms: BSDI, FreeBSD, Linux, MacOS, OpenBSD, UNIX, Windows 2000,
Windows NT, Windows XP
Summary:
Osiris is a host integrity management system that can be used to monitor
changes to a network of hosts over time and report those changes back to
the administrator(s). Currently, this includes monitoring any changes to
the filesystems. Osiris takes periodic snapshots of the filesystem and
stores them in a database. These databases, as well as the
configurations and logs, are all stored on a central management host.
When changes are detected, Osiris will log these events to the system
log and optionally send email to an administrator. In addition to files,
Osiris has preliminary support for the monitoring of other system
information including user lists, file system details, kernel modules,
and network interface configurations (not included with in this beta
release).
4. mrtg v2.10.13
By: Tobias Oetiker
Relevant URL: http://people.ee.ethz.ch/~oetiker/webtools/mrtg/
Platforms: POSIX, Windows 2000, Windows NT
Summary:
The Multi Router Traffic Grapher (MRTG) is a tool to monitor the traffic
load on network-links. MRTG generates HTML pages containing GIF/PNG images
which provide a live visual representation of this traffic.
5. Yet Another antiVirus Recipe v1.8.6
By: nikant
Relevant URL: http://agriroot.aua.gr/~nikant/nkvir/
Platforms: N/A
Summary:
Yet Another antiVirus Recipe is a procmail that helps to filter out a lot
of the most common e-mail worms. It detects worms with base-64 signatures
(such as Klez, Hybris, and BugBear), HTML IFRAME exploits, CLSID hidden
extension exploits, -XML code base exploits, executable extensions (bat,
pif, vbs, vba, scr, lnk, com, and exe), and macros for doc, dot, xls, and
xla files. It also detects most Nigerian scam e-mails.
6. m0n0wall vpb25r595
By: Manuel Kasper
Relevant URL: http://m0n0.ch/wall
Platforms: FreeBSD
Summary:
m0n0wall is an all-in-one firewall software package (based on FreeBSD)
geared towards embedded PCs. It includes an easy-to-use Web interface like
commercial firewall boxes do. PHP is used instead of shell scripts, and
the entire system configuration is stored in a single XML-formatted file.
There is support for wireless LAN, VPN, traffic shaping, and more.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Security Analysts/Engineers - Washington DC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350354
2. Federal Sales Executive - Tenable Network Security -... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350275
3. NYC - Manager - Threat & Vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350206
4. Senior Executive Sales DC (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350200
5. Seeking Network Security Position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350137
6. Security position in San Diego (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350136
7. Configuration Relaease Security Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350051
8. Federal Agency Cyber Security Subject Matter Expert ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350016
9. DC Security Opportunities (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350012
10. International & Southeast US - Security Sales and Ma... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350011
11. IT Position Available in Wash. DC Metro Area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350010
12. Looking for OCONUS DOD work (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/350009
13. LA - PwC - IT Security with IT Audit skills needed -... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349939
14. Secure Software Inc. seeks Auditors, Developers, and... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349938
15. Technical IT Security Consultant - 6 months Contract... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349937
16. U.S. Citizen available for Immediate Relocation to D... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349936
17. DC Security Opportunity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349875
18. Telecom Security Consultant Middle East (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349849
19. Sr. Manager (Indianapolis, IN) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349848
20. Contacts for positions in Iraq, Afghanistan or other... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349847
21. Security Analyst (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349842
22. Seeking InfoSec Sales in Financial Services (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349751
23. Federal Sales Director - Washington, DC area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349749
24. Sterling-Hoffman?s Mid-West Security Job Report - Ja... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349592
25. asia/pacific security jobs (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349568
26. Cincinnati, Cleveland, and Columbus OH (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349564
27. Sterling-Hoffman?s South East Security Job Report - ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349533
28. IT/Security Audit in the Motor City (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349532
29. Sterling-Hoffman?s Mid-Atlantic Security Job Report ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349531
30. Sterling-Hoffman?s North East Security Job Report - ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349529
31. Sterling-Hoffman?s West Coast Security Job Report - ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349528
32. Contacts for positions in Iraq, Afghanistan or other... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349455
33. iBM z800/z900 Systems Security Engineer Opening (Kan... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/349454
VI. INCIDENTS LIST SUMMARY
--------------------------
1. Issue of AIM; was -> UDP Port 5140 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/350287
2. UDP Port 5140 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/350255
3. new/old port 135 scans? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/349634
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. a method for bypassing cookie restrictions in web br... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/350283
2. RES: Password Setup (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/350109
3. Password Setup (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/350022
4. get SP on Solaris (SPARC) with GCC 3.3.2 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/349739
5. Buffer UNDERFLOWS: What do you know about it? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/349658
6. Regarding a selection for mobile code/scripting lang... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/349471
7. RUXCON Call For Papers (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/349459
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. About MS-Networking security. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/350278
2. Encrypt data - SQL Server 2000 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/350216
3. USB - Devices (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/350036
4. MDAC security patch problem? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/349982
5. Disable NTLM on W2k (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/349815
6. SMTP Service in private DMZ OK? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/349811
7. Betr.: Active Directory Question (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/349769
8. Active Directory Question (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/349767
9. SecurityFocus Microsoft Newsletter #171 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/349746
10. application whitelisting (was Active Directory Ques... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/349706
11. [work] RE: Active Directory Question (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/349599
IX. SUN FOCUS LIST SUMMARY
--------------------------
NO NEW POSTS FOR THE WEEK 2004-01-13 to 2004-01-20.
X. LINUX FOCUS LIST SUMMARY
---------------------------
NO NEW POSTS FOR THE WEEK 2004-01-13 to 2004-01-20.
XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
[email protected] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer.
Alternatively you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.
If your email address has changed email [email protected] and
ask to be manually removed.
------------------------------------------------------------------------