SecurityFocus Linux Newsletter #233

Peter Laborge <[email protected]> 27 Apr 2005 17:04:43 -0000

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #233
------------------------------------

This Issue is Sponsored By: CanSecWest/core05

It won't affect you unless you run Linux, OSX, some BSDs, or Windows...
Can/SecWest/core05 - Vancouver, Canada - May 4-6 2005
World Security Pros. Cutting Edge Training, Tools, and Techniques
Security Masters Dojo May 3/4 2005

http://www.securityfocus.com/sponsor/CanSecWest_sf-news_050427

------------------------------------------------------------------------

Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------------
I. FRONT AND CENTER
1. Apple's Big Virus
2. Bluetooth Security Review, Part 1
II. LINUX VULNERABILITY SUMMARY
1. Webmin And Usermin Configuration File Unauthorized Access Vu...
2. Mozilla Suite And Firefox Search Plug-In Remote Script Code ...
3. Multiple Vendor TCP Session Acknowledgement Number Denial Of...
4. Mozilla Suite And Firefox Favicon Link Tag Remote Script Cod...
5. CVS Unspecified Buffer Overflow And Memory Access Vulnerabil...
6. Mozilla Firefox PLUGINSPAGE Remote Script Code Execution Vul...
7. Mozilla Suite And Firefox Blocked Pop-Up Window Remote Scrip...
8. Mozilla Suite And Firefox Global Scope Pollution Cross-Site ...
9. Mozilla Firefox Search Target Sidebar Panel Script Code Exec...
10. Mozilla Suite And Firefox XPInstall JavaScript Object Instan...
11. Mozilla Suite And Firefox Document Object Model Nodes Code E...
12. XV Image Decoders Multiple Unspecified Input Validation Vuln...
13. XV Planetary Data System Image Decoder Unspecified Input Val...
14. XV Planetary Data System Image Decoder Format String Vulnera...
15. XV Tagged Image File Format Image Decoder Format String Vuln...
16. XV Image File Name Remote Command Execution Vulnerability
17. RealNetworks RealPlayer Enterprise RAM File Parsing Buffer O...
18. Linux Kernel Unw_Unwind_To_User Local Denial of Service Vuln...
19. Linux Kernel Fib_Seq_Start Local Denial of Service Vulnerabi...
20. MPlayer RTSP Server Line Response Remote Buffer Overflow Vul...
21. MPlayer MMST Stream ID Remote Buffer Overflow Vulnerability
22. Logwatch Secure Script Denial Of Service Vulnerability
23. Real Networks Helix Player Unspecified Vulnerability
24. PHProjekt Chatroom Text Submission HTML Injection Vulnerabil...
25. GNU GZip Filename Directory Traversal Vulnerability
26. CPIO Filename Directory Traversal Vulnerability
27. KDE Kommander Unspecified Arbitrary Script Execution Vulnera...
28. PixySoft E-Cart Cat Parameter Remote Command Execution Vulne...
29. PixySoft E-Cart Art Parameter Remote Command Execution Vulne...
III. LINUX FOCUS LIST SUMMARY
1. Any way to automatically change arbitrary headers of... (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. CoreGuard Core Security System
2. EnCase Forensic Edition
3. KeyGhost SX
4. SafeKit
5. Astaro Linux Firewall
6. CAT Cellular Authentication Token and eAuthentication Servic...
V. NEW TOOLS FOR LINUX PLATFORMS
1. Umbrella v0.6
2. Kernel Socks Bouncer 2.6.11
3. NuFW 1.0.0
4. ldaupenum 0.02alpha
5. File System Saint 1.02a
6. Travesty 1.0
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Apple's Big Virus
By Kelly Martin
After your identity has been stolen, your bank accounts compromised, 53
critical patches and 27 reboots later, when will you decide that you've had
enough?
http://www.securityfocus.com/columnists/319

2. Bluetooth Security Review, Part 1
By Marek Bialoglowy
This two-part series looks at Bluetooth security and privacy issues,
including methods of detection, data loss prevention and social engineering.
http://www.securityfocus.com/infocus/1830

II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. Webmin And Usermin Configuration File Unauthorized Access Vu...
BugTraq ID: 13205
Remote: Yes
Date Published: Apr 16 2005
Relevant URL: http://www.securityfocus.com/bid/13205
Summary:
Usermin and Webmin are affected by a configuration file access validation vulnerability. This issue is due to a design error that causes certain configuration files to be assigned insecure permissions.

An attacker may leverage this issue to gain access to various, potentially sensitive system configuration files. This may facilitate privilege escalation or other attacks.

2. Mozilla Suite And Firefox Search Plug-In Remote Script Code ...
BugTraq ID: 13211
Remote: Yes
Date Published: Apr 16 2005
Relevant URL: http://www.securityfocus.com/bid/13211
Summary:
A remote script code execution vulnerability affects Mozilla Suite and Mozilla Firefox. This issue is due to a failure of the application to provide secure access validation prior to carrying out remotely supplied script code execution.

An attacker may leverage this issue to execute arbitrary code in the context of a Web site that is being viewed by an unsuspecting user; if the Web page being viewed is a privileged page, remote code execution is possible. This may facilitate cross-site scripting as well as a compromise of an affected computer.

It should be noted that this issue was previously reported in BID 13208 (Mozilla Suite Multiple Code Execution, Cross-Site Scripting, And Policy Bypass Vulnerabilities); it has been assigned its own BID.

3. Multiple Vendor TCP Session Acknowledgement Number Denial Of...
BugTraq ID: 13215
Remote: Yes
Date Published: Apr 18 2005
Relevant URL: http://www.securityfocus.com/bid/13215
Summary:
Multiple Vendor TCP/IP stack implementations are reported prone to a denial of service vulnerability.

A report indicates that the vulnerability manifests when an erroneous TCP acknowledgement number is encountered in an active TCP session stream.

A successful attack may result in a degradation of the target connection, effectively denying service for legitimate users. Additionally, reports indicate that the computer being attacked may suffer CPU performance degradation, potentially denying service for local users too.

4. Mozilla Suite And Firefox Favicon Link Tag Remote Script Cod...
BugTraq ID: 13216
Remote: Yes
Date Published: Apr 16 2005
Relevant URL: http://www.securityfocus.com/bid/13216
Summary:
A remote script code execution vulnerability affects Mozilla Suite and Mozilla Firefox. This issue is due to a failure of the application to deny remote unauthorized access to trusted local interfaces.

An attacker may be able to exploit this issue to execute arbitrary script code with the privileges of an unsuspecting user that activated the affected Web browser. This may facilitate the installation and execution of malicious applications on an affected computer.

5. CVS Unspecified Buffer Overflow And Memory Access Vulnerabil...
BugTraq ID: 13217
Remote: Yes
Date Published: Apr 18 2005
Relevant URL: http://www.securityfocus.com/bid/13217
Summary:
CVS is prone to unspecified buffer overflow, memory access vulnerabilities, and a NULL pointer dereference denial of service.

It is conjectured that the issues may be leveraged by a remote authenticated user to disclose regions of the CVS process memory, and to corrupt CVS process memory. The two issues combined may lead to a remote attacker reliably executing arbitrary code in the context of the vulnerable process, although this is not confirmed.

This BID will be updated as soon as further information is made available.

6. Mozilla Firefox PLUGINSPAGE Remote Script Code Execution Vul...
BugTraq ID: 13228
Remote: Yes
Date Published: Apr 16 2005
Relevant URL: http://www.securityfocus.com/bid/13228
Summary:
A remote script code execution vulnerability affects Mozilla Firefox. This issue is due to a failure of the application to deny remote unauthorized access to malicious Plugin Finder Service links.

7. Mozilla Suite And Firefox Blocked Pop-Up Window Remote Scrip...
BugTraq ID: 13229
Remote: Yes
Date Published: Apr 16 2005
Relevant URL: http://www.securityfocus.com/bid/13229
Summary:
A remote script code execution vulnerability affects Mozilla Suite and Mozilla Firefox. This issue is due to a failure of the application to execute JavaScript in blocked pop-up windows securely.

8. Mozilla Suite And Firefox Global Scope Pollution Cross-Site ...
BugTraq ID: 13230
Remote: Yes
Date Published: Apr 16 2005
Relevant URL: http://www.securityfocus.com/bid/13230
Summary:
A remote cross-site scripting vulnerability affects Mozilla Suite and Mozilla Firefox. This issue is due to a failure of the application to properly clear stored parameters.

An attacker may exploit this issue to execute arbitrary script code in the context of a page that is currently being viewed. This may facilitate the theft of cookie based authentication credentials as well a other attacks.

9. Mozilla Firefox Search Target Sidebar Panel Script Code Exec...
BugTraq ID: 13231
Remote: Yes
Date Published: Apr 16 2005
Relevant URL: http://www.securityfocus.com/bid/13231
Summary:
A remote script code execution vulnerability affects Mozilla Firefox. This issue is due to a failure of the application to securely run script code targeted at the sidebar panel.

10. Mozilla Suite And Firefox XPInstall JavaScript Object Instan...
BugTraq ID: 13232
Remote: Yes
Date Published: Apr 16 2005
Relevant URL: http://www.securityfocus.com/bid/13232
Summary:
Mozilla Suite and Mozilla Firefox are affected by an input validation vulnerability. This issue is due to a failure in the application to verify input passed to installation objects.

An attacker may be able to exploit this issue to execute malicious code in the context of the affected browser, subsequently facilitating unauthorized access.

11. Mozilla Suite And Firefox Document Object Model Nodes Code E...
BugTraq ID: 13233
Remote: Yes
Date Published: Apr 16 2005
Relevant URL: http://www.securityfocus.com/bid/13233
Summary:
Mozilla Suite and Mozilla Firefox are affected by a code execution vulnerability. This issue is due to a failure in the application to properly verify Document Object Model (DOM) property values.

An attacker may leverage this issue to execute arbitrary code with the privileges of the user that activated the vulnerable Web browser, ultimately facilitating a compromise of the affected computer.

12. XV Image Decoders Multiple Unspecified Input Validation Vuln...
BugTraq ID: 13243
Remote: Yes
Date Published: Apr 19 2005
Relevant URL: http://www.securityfocus.com/bid/13243
Summary:
Multiple unspecified input validation vulnerabilities affect xv. These issues are due to a failure of the application to properly sanitize input prior to using it to carry out critical functions.

Although unconfirmed, it is likely that these issues may be exploited to cause the affected application to crash, and potentially execute arbitrary commands or machine code. This BID will be updated and potentially split into seperate BIDs with the release of further details.

13. XV Planetary Data System Image Decoder Unspecified Input Val...
BugTraq ID: 13244
Remote: Yes
Date Published: Apr 19 2005
Relevant URL: http://www.securityfocus.com/bid/13244
Summary:
An unspecified input validation vulnerability affects xv. This issues is due to a failure of the application to properly sanitize input prior to using it to carry out critical functions.

Reportedly this issue is distinct from those outlined in BID 13243 (XV Image Decoders Multiple Unspecified Input Validation Vulnerabilities).

14. XV Planetary Data System Image Decoder Format String Vulnera...
BugTraq ID: 13245
Remote: Yes
Date Published: Apr 19 2005
Relevant URL: http://www.securityfocus.com/bid/13245
Summary:
A remote, client-side format string vulnerability affects xv. This issue is due to a failure of the application to securely implement a formatted printing function.

An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that activated the vulnerable utility.

15. XV Tagged Image File Format Image Decoder Format String Vuln...
BugTraq ID: 13246
Remote: Yes
Date Published: Apr 19 2005
Relevant URL: http://www.securityfocus.com/bid/13246
Summary:
A remote, client-side format string vulnerability affects xv. This issue is due to a failure of the application to securely implement a formatted printing function.

An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that activated the vulnerable utility.

16. XV Image File Name Remote Command Execution Vulnerability
BugTraq ID: 13247
Remote: Yes
Date Published: Apr 19 2005
Relevant URL: http://www.securityfocus.com/bid/13247
Summary:
A remote, client-side command execution vulnerability affects xv. This issue is due to a failure of the application to properly sanitize input prior to using it to carry out critical functions.

An attacker may leverage this issue to execute arbitrary commands with the privileges on an unsuspecting user.

17. RealNetworks RealPlayer Enterprise RAM File Parsing Buffer O...
BugTraq ID: 13264
Remote: Yes
Date Published: Apr 19 2005
Relevant URL: http://www.securityfocus.com/bid/13264
Summary:
RealNetworks RealPlayer Enterprise is reported prone to a buffer overflow vulnerability. It is reported that the issue manifests when a malicious RAM file is parsed.

A remote attacker may exploit this vulnerability to execute arbitrary code in the context of a user that uses a vulnerable version of the media player to load a malicious RAM file.

18. Linux Kernel Unw_Unwind_To_User Local Denial of Service Vuln...
BugTraq ID: 13266
Remote: No
Date Published: Apr 19 2005
Relevant URL: http://www.securityfocus.com/bid/13266
Summary:
A local denial of service vulnerability affects the Linux kernel.

A local attacker may leverage this issue to cause an affected Linux kernel to panic, effectively denying service to legitimate users.

19. Linux Kernel Fib_Seq_Start Local Denial of Service Vulnerabi...
BugTraq ID: 13267
Remote: No
Date Published: Apr 19 2005
Relevant URL: http://www.securityfocus.com/bid/13267
Summary:
A local denial of service vulnerability affects the Linux kernel.

A local attacker may leverage this issue to cause an affected Linux kernel to panic, effectively denying service to legitimate users.

Although only the Linux kernel version 2.6.9 is reported vulnerable, it is likely that other versions are vulnerable as well.

20. MPlayer RTSP Server Line Response Remote Buffer Overflow Vul...
BugTraq ID: 13270
Remote: Yes
Date Published: Apr 20 2005
Relevant URL: http://www.securityfocus.com/bid/13270
Summary:
A remote heap-based buffer overflow vulnerability affects MPlayer. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

21. MPlayer MMST Stream ID Remote Buffer Overflow Vulnerability
BugTraq ID: 13271
Remote: Yes
Date Published: Apr 20 2005
Relevant URL: http://www.securityfocus.com/bid/13271
Summary:
A remote heap-based buffer overflow vulnerability affects MPlayer. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

22. Logwatch Secure Script Denial Of Service Vulnerability
BugTraq ID: 13273
Remote: Yes
Date Published: Apr 20 2005
Relevant URL: http://www.securityfocus.com/bid/13273
Summary:
Logwatch is prone to a denial of vulnerability in the secure script.

This issue may be exploited by a local attacker who can inject a malicious string into a log file, causing a denial of service condition. As a result, the utility may not detect subsequent malicious activity.

23. Real Networks Helix Player Unspecified Vulnerability
BugTraq ID: 13280
Remote: Unknown
Date Published: Apr 20 2005
Relevant URL: http://www.securityfocus.com/bid/13280
Summary:
An unspecified vulnerability affects Real Networks Helix Player. The cause of this issue is currently unknown.

The potential impact of this issue is currently unknown; this BID will be updated as more information is released.

It should be noted that it is likely that this issue corresponds with that reported in BID 13264 (RealNetworks RealPlayer Enterprise RAM File Parsing Buffer Overflow Vulnerability). If it is confirmed that this issue corresponds to the RealPlayer issue, this BID will be retired.

Note: This BID is being retired as it has been confirmed that this issue affecting Helix Player is the same issue affecting RealPlayer as reported in BID 13264 (RealNetworks RealPlayer Enterprise RAM File Parsing Buffer Overflow Vulnerability).

24. PHProjekt Chatroom Text Submission HTML Injection Vulnerabil...
BugTraq ID: 13286
Remote: Yes
Date Published: Apr 20 2005
Relevant URL: http://www.securityfocus.com/bid/13286
Summary:
PHProjekt is prone to an HTML injection vulnerability in the Chatroom text submission form. The application fails to sanitize user-supplied input that is in turn displayed to all users of the chatroom.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

25. GNU GZip Filename Directory Traversal Vulnerability
BugTraq ID: 13290
Remote: Yes
Date Published: Apr 20 2005
Relevant URL: http://www.securityfocus.com/bid/13290
Summary:
gzip is prone to a directory traversal vulnerability. The issue manifests when gunzip is invoked on a malicious archive using the '-N' switch.

An archive containing an absolute path for a filename that contains '/' characters, results in the file getting written using the absolute path contained in the filename.

A remote attacker may leverage this issue using a malicious archive to corrupt arbitrary files with the privileges of the user that is running the vulnerable software.

26. CPIO Filename Directory Traversal Vulnerability
BugTraq ID: 13291
Remote: Yes
Date Published: Apr 20 2005
Relevant URL: http://www.securityfocus.com/bid/13291
Summary:
cpio is prone to a directory traversal vulnerability. The issue manifests when cpio is invoked on a malicious archive.

An archive containing an absolute path for a filename that contains '/' characters, results in the file getting written using the absolute path contained in the filename.

A remote attacker may leverage this issue using a malicious archive to corrupt arbitrary files with the privileges of the user that is running the vulnerable software.

27. KDE Kommander Unspecified Arbitrary Script Execution Vulnera...
BugTraq ID: 13313
Remote: Yes
Date Published: Apr 22 2005
Relevant URL: http://www.securityfocus.com/bid/13313
Summary:
KDE Kommander is prone to a vulnerability that could allow arbitrary script code to be executed without user interaction. Such code would execute in the security context of the user running Kommander.

This issue was reported to affect Quanta 3.1.x and KDE from 3.2 to 3.4.0.

28. PixySoft E-Cart Cat Parameter Remote Command Execution Vulne...
BugTraq ID: 13316
Remote: Yes
Date Published: Apr 22 2005
Relevant URL: http://www.securityfocus.com/bid/13316
Summary:
PixySoft E-Cart is prone to a remote arbitrary command execution vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

Specifically, the user-specified 'cat' URI parameter is supplied to a Perl open() routine.

PixySoft E-Cart versions 1.1 is reported vulnerable to this issue.

29. PixySoft E-Cart Art Parameter Remote Command Execution Vulne...
BugTraq ID: 13321
Remote: Yes
Date Published: Apr 22 2005
Relevant URL: http://www.securityfocus.com/bid/13321
Summary:
PixySoft E-Cart is prone to a remote arbitrary command execution vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

Specifically, the user-specified 'art' URI parameter is supplied to a Perl open() routine.

PixySoft E-Cart versions 1.1 is reported vulnerable to this issue.

III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Any way to automatically change arbitrary headers of... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/396758

IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. CoreGuard Core Security System
By: Vormetric
Platforms: AIX, Linux, Solaris, Windows 2000, Windows XP
Relevant URL: http://www.vormetric.com/products/#overview
Summary:

CoreGuard System profile

The CoreGuard System is the industry's first solution that enforces
acceptable use policy for sensitive digital information assets and
protects personal data privacy across an enterprise IT environment.
CoreGuard's innovative architecture and completeness of technology
provide a comprehensive, extensible solution that tightly integrates all
the elements required to protect information across a widespread,
heterogeneous enterprise network, while enforcing separation of duties
between security and IT administration. At the same time, CoreGuard is
transparent to users, applications and storage infrastructures for ease
of deployment and system management.

CoreGuard enables customers to:
* Protect customer personal data privacy and digital information assets
* Protect data at rest from unauthorized viewing by external attackers
and unauthorized insiders
* Enforce segregation of duties between IT administrators and security
administration
* Ensure host & application integrity * Block malicious code, including
zero-day exploits

2. EnCase Forensic Edition
By: Guidance Software Inc.
Platforms: DOS, FreeBSD, Linux, MacOS, NetBSD, OpenBSD, PalmOS, Solaris, UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.guidancesoftware.com/products/EnCaseForensic/index.shtm
Summary:

EnCase Forensic Edition Version 4 delivers the most advanced features for computer forensics and investigations. With an intuitive GUI and superior performance, EnCase Version 4 provides investigators with the tools to conduct large-scale and complex investigations with accuracy and efficiency. Guidance Software?s award winning solution yields completely non-invasive computer forensic investigations while allowing examiners to easily manage large volumes of computer evidence and view all relevant files, including "deleted" files, file slack and unallocated space.

The integrated functionality of EnCase allows the examiner to perform all functions of the computer forensic investigation process. EnCase's EnScript, a powerful macro-programming language and API included within EnCase, allows investigators to build customized and reusable forensic scripts.

3. KeyGhost SX
By: KeyGhost Ltd
Platforms: BeOS, DOS, Linux, OS/2, Solaris, SunOS, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.keyghost.com/SX/
Summary:

KeyGhost SX discreetly captures and records all keystrokes typed, including chat conversations, email, word processor, or even activity within an accounting or specialist system. It is completely undetectable by software scanners and provides you with one of the most powerful stealth surveillance applications offered anywhere.

Because KeyGhost uses STRONG 128-Bit encryption to store the recorded data in it?s own internal memory (not on the hard drive), it is impossible for a network intruder to gain access to any sensitive data stored within the device.

4. SafeKit
By: Evidian Inc.
Platforms: AIX, HP-UX, Linux, Solaris, Windows 2000
Relevant URL: http://www.evidian.com/safekit/index.htm
Summary:

Evidian's SafeKit technology makes it possible to render any application available 24 hours per day. With no extra hardware: just use your existing servers and install this software-only solution.

This provides ultimate scalability. As your needs grow, all you need to do is add more standard servers into the cluster. With the load balancing features of SafeKit, you can distribute applications over multiple servers. If one system fails completely, the others will continue to serve your users.

5. Astaro Linux Firewall
By: Astaro
Platforms: Linux
Relevant URL: http://www.astaro.com/php/statics.php?action=asl&lang=gb
Summary:

Astaro Linux Firewall: All-in-one firewall, virus protection, content filtering and spam protection internet security software package for Linux.
Free download for home users.

6. CAT Cellular Authentication Token and eAuthentication Servic...
By: Mega AS Consulting Ltd
Platforms: Java, Linux, OpenBSD, Os Independent, SecureBSD, Solaris, UNIX, Windows 2000, Windows NT
Relevant URL: http://www.megaas.co.nz
Summary:

Low cost, easy to use Two Factor Authentication One Time Password token using the Cellular. Does not use SMS or communication, manages multiple OTP accounts - new technology. For any business that want a safer access to its Internet Services. More information at our site.

We also provide eAuthentication service for businesses that will not buy an Authentication product but would prefer to pay a monthly charge for authentication services from our our CAT Server.

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Umbrella v0.6
By: Umbrella
Relevant URL: http://umbrella.sourceforge.net/
Platforms: Linux
Summary:

Umbrella is a security mechanism that implements a combination of Process-Based Access Control (PBAC) and authentication of binaries through Digital Signed Binaries (DSB). The scheme is designed for Linux-based consumer electronic devices ranging from mobile phones to settop boxes.

Umbrella is implemented on top of the Linux Security Modules (LSM) framework. The PBAC scheme is enforced by a set of restrictions on each process.

2. Kernel Socks Bouncer 2.6.11
By: Paolo Ardoino
Relevant URL: http://ksb.sourceforge.net/
Platforms: Linux
Summary:

Kernel Socks Bouncer is a Linux Kernel 2.6.x patch that redirects tcp connections [SSH, telnet, browsers...] to follow through socks5. KSB26 uses a character device to pass socks5 and target ips to the Linux Kernel.

3. NuFW 1.0.0
By: INL
Relevant URL: http://www.nufw.org
Platforms: Linux
Summary:

NuFW performs an authentication of every single connections passing through the IP filter, by transparently requesting user's credentials before any filtering decision is taken. Practically, this brings the notion of user ID down to the IP layers.

4. ldaupenum 0.02alpha
By: Roni Bachar & Sol Zehnwirth
Relevant URL: https://sourceforge.net/projects/ldapenum
Platforms: Linux, Perl (any system supporting perl), Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

ldapenum is a perl script designed to enumerate system and password information from domain controllers using the LDAP service when IPC$ is locked. The script has been tested on windows and linux.

5. File System Saint 1.02a
By: Joshua Fritsch
Relevant URL: http://www.unixgeeks.org/saint
Platforms: Linux, UNIX
Summary:

A fast, flexible, lightweight perl-based host IDS.

6. Travesty 1.0
By: Robert Wesley McGrew
Relevant URL: http://cse.msstate.edu/~rwm8/travesty/
Platforms: Linux
Summary:

Travesty is an interactive program for managing the hardware addresses (MAC) of ethernet devices on your computer. It supports manually changing the MAC, generating random addresses, and applying different vendor prefixes to the current address.
It also allows the user to import their own lists of hardware addresses and descriptions that can be navigated from within the Travesty interface. Travesty is written in Python, and is very simple to add functionality to, or modify.

VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

VII. SPONSOR INFORMATION
-----------------------

This Issue is Sponsored By: CanSecWest/core05

http://www.securityfocus.com/sponsor/CanSecWest_sf-news_050427

------------------------------------------------------------------------

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------------