SecurityFocus Linux Newsletter #86

John Boletta <[email protected]> Mon, 24 Jun 2002 13:14:10 -0600 (MDT)

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #86
----------------------------------

This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - September 30th, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Implementing Networks Taps with Network Intrusion Detection...
2. Filtering E-Mail with Postfix and Procmail, Part One
3. Alexis de Tocqueville Serves Up a Red Herring
4. Black Hat Briefings & Training
5. Cutting-Edge High Tech Crime Fighting
II. LINUX VULNERABILITY SUMMARY
1. Netscape Composer Font Face Field Buffer Overflow Vulnerability
2. MIT CGIEmail Arbitrary Recipient Mail Relay Vulnerability
3. Multiple Vendor Spoofed IGMP Report Denial Of Service
4. PHPEventCalendar Remote Command Execution Vulnerability
5. Mewsoft NetAuction Cross Site Scripting Vulnerability
6. Zeroboard PHP Include File Arbitrary Command Execution...
7. Caucho Technology Resin Server View_Source.JSP Arbitrary File...
8. Caucho Technology Resin Server Denial Of Service Vulnerability
9. OSCommerce Remote File Include Vulnerability
10. PHP Classifieds Cross-Site Scripting Vulnerability
11. My Postcards MagicCard.CGI Arbitrary File Disclosure...
12. Apache Chunked-Encoding Memory Corruption Vulnerability
13. PHPBB2 Install.PHP Remote File Include Vulnerability
14. Interbase GDS_Drop Interbase Environment Variable Buffer...
15. Interbase GDS_Lock_MGR Interbase Environment Variable Buffer...
16. Mandrake 8.2 Msec Insecure Default Permissions Vulnerability
17. Apache Tomcat Web Root Path Disclosure Vulnerability
18. WebScripts WebBBS Remote Command Execution Vulnerability
19. IRSSI Long Malformed Topic Denial Of Service Vulnerability
20. Cisco VPN Client for Unix Local Buffer Overflow Vulnerability
21. TransWare Active Mail HTML Injection Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. Have I been kitted? (Thread)
2. Web filtering? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. StillSecure Border Guard
2. InsideOut Firewall Reporter
3. Tripwire Open Source, Linux Edition
V. NEW TOOLS FOR LINUX PLATFORMS
1. Tiger security tool v3.0
2. wicap v0.4
3. Web shell v1.0
4. LCDproc v0.4.3
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. Implementing Networks Taps with Network Intrusion Detection Systems
by Nathan Einwechter, Senior Research Scientist Fate Research Labs

Over the past decade or so, the use of switches to replace hubs has
increased substantially. This is largely due to the increased size of
networks, and the requirement for increasingly faster and more efficient
networks. On most networks, the data must now be dependable and timely.
This transition from hubs to switches, however, has generated a conflict
with already deployed and designed network intrusion detection systems.

http://online.securityfocus.com/infocus/1594

2. Filtering E-Mail with Postfix and Procmail, Part One
by Brian Hatch

Most folks dislike spam in their e-mail. Spam takes up our network, disk,
and cpu resources. It requires that we weed through unwanted messages to
find the ones that we requested. (I'm not going to try to convince you
that spam is not good, you can check out some of the anti-spam resources
listed in the relevant links section below, if you're interested.)

http://online.securityfocus.com/infocus/1593

3. Alexis de Tocqueville Serves Up a Red Herring
By Richard Forno

The press release announcing the Alexis de Tocqueville Institution's
recent white paper proclaims that open source software is a threat to
national security. However, there is much in the document that the press
release conveniently overlooks.

http://online.securityfocus.com/columnists/89

4. Black Hat Briefings & Training

Attend Black Hat Briefings & Training, July 29 - August 1, Las Vegas, the
world's premier technical security event! 8 tracks, 12 training sessions,
Richard Clarke keynote, 500 delegates from 30 nations, with a near cult
following of both CSOs and "underground" security experts. See for
yourself what the buzz is all about.

Please visit www.blackhat.com for more information.

5. Tech Crime Fighting: Best Practices in Computer Forensics
June 17-18, 2002
American Management Association, Washington, DC

Walk away able to perform computer forensic examinations that will not
only yield sound evidence but will also hold up in a court of law! Learn
to find, collect and preserve digital evidence, and present the evidence
in court. Also learn to successfully combine private and public computer
forensics forces to investigate computer crimes. Keynote speech by
Microsoft's Chief Security Strategist Scott Charney. Public sector
employee discounts available.

For more information, call 800-280-8440, or visit www.frallc.com (see
InfoTech events).

II. BUGTRAQ SUMMARY
-------------------
1. Netscape Composer Font Face Field Buffer Overflow Vulnerability
BugTraq ID: 5010
Remote: No
Date Published: Jun 13 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5010
Summary:

Netscape is a freely available web browser distributed by Netscape
Communications, and available for various platforms. This vulnerability
is known to affect those installations on the Linux platform.

A problem has been discovered that may allow the execution of arbitrary
code through a vulnerable Netscape browser.

A buffer overflow has been reported in the Composer function of Netscape.
When an HTML page with a Font Face field of arbitrary length is edited
using Netscape Composer, a memory corruption bug may occur that could
allow the overwriting of process memory, and execution of attacker
supplied code.

It should be noted that any code executed in a vulnerable browser would be
executed with the privileges of the user executing Netscape. Also, this
vulnerability requires that a user of Netscape Composer will have
downloaded a malicious HTML file, and is attempting to edit this file
locally using Netscape Composer.

2. MIT CGIEmail Arbitrary Recipient Mail Relay Vulnerability
BugTraq ID: 5013
Remote: Yes
Date Published: Jun 14 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5013
Summary:

MIT cgiemail is designed to take the input of web forms and convert it to
an e-mail format defined by the author of the form. It was written for use
on UNIX and Linux variant operating systems.

A vulnerability has been reported for cgiemail that allows cgiemail to act
as an open relay for email. The vulnerability is due to failure of proper
santization of user supplied values. In particular the new line code "%0a"
is not filtered properly.

cgiemail uses templates when generating emails. To exploit this issue, an
attacker must know the exact path of a template file that cgiemail uses.
As well, the attacker must know of the fields that will be included in the
generated email.

As a result, a malicious user may trivially specify any email address,
effectively using the script as an open mail relay. This technique is well
known, and commonly used for sending unsolicited email.

3. Multiple Vendor Spoofed IGMP Report Denial Of Service Vulnerability
BugTraq ID: 5020
Remote: Yes
Date Published: Jun 14 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5020
Summary:

Internet Group Management Protocol (IGMP) is the specified guidelines for
the management of Internet Multicast Routing management.

A problem with the implementation of the protocol in some operating
systems could lead to a denial of service.

It is possible for an arbitrary host to deny service to a system on the
same segment of network. In a situation where a multicast router sends a
membership report request, a host sending a unicast membership report
response to the primary responder can prevent the responder from sending a
message to the multicast router. In doing so, the router will not receive
a response from any host, and thus the transmission will time out and
cease.

This problem could result in an attacker launching a denial of service
against an affected host, and could additionally be used to deny service
to a range of vulnerable hosts on a subnet.

This vulnerability may additionally affect other operating systems, though
it is currently unknown which implementations may be vulnerable.

4. PHPEventCalendar Remote Command Execution Vulnerability
BugTraq ID: 5021
Remote: Yes
Date Published: Jun 14 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5021
Summary:

PHPEventCalendar is a web based calendar. It is implemented in PHP and
should be supported on UNIX and Linux variants as well as Microsoft
Windows operating environments.

A vulnerability has been reported in phpEventCalendar that may allow a
user of phpEventCalendar to execute commands on a vulnerable host.

The vulnerability exists in the 'index.php' file. The user supplied value
to the 'userfile' parameter is not properly sanitized.

Commands executed via this method will be executed with the privileges of
the user running the web server process. This could potentially lead to a
denial of service, or a remote attacker gaining elevated privileges.

5. Mewsoft NetAuction Cross Site Scripting Vulnerability
BugTraq ID: 5023
Remote: Yes
Date Published: Jun 14 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5023
Summary:

Mewsoft NetAuction is designed for users to create auction sites. It is
developed for use with Microsoft Windows and Linux operating environments.

NetAuction does not filter script code from URI parameters, making it
prone to cross-site scripting attacks. Attacker-supplied HTML code may be
included in a malicious link to 'auction.cgi' via the 'terms' parameter.

The supplied HTML code will be executed in the browser of a web user who
visits this link, in the security context of the host running NetAuction.
Such a link might be included in a HTML e-mail or on a malicious webpage.

This may enable a remote attacker to steal cookie-based authentication
credentials from legitimate users of a host running NetAuction.

This issue has been reported in version 3.0, other versions may also be
vulnerable.

6. Zeroboard PHP Include File Arbitrary Command Execution Vulnerability
BugTraq ID: 5028
Remote: Yes
Date Published: Jun 15 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5028
Summary:

Zeroboard is a PHP web board package available for the Linux and Unix
platforms.

A problem with Zeroboard could make it possible for remote users to
execute arbitrary commands.

Under some circumstances, it may be possible to include arbitrary PHP
files. The _head.php file does not sufficiently check or sanitize input.
When the "allow_url_fopen" variable and the "register_globals" variable in
php.ini are set to "On," it is possible to load a PHP include file from a
remote URL via the _head.php script.

Upon loading the arbitrary include file, commands embedded in the file
would be executed on the vulnerable server with the privileges of the HTTP
process. This problem could allow an attacker to execute arbitrary
commands on the vulnerable system.

7. Caucho Technology Resin Server View_Source.JSP Arbitrary File Disclosure Vulnerability
BugTraq ID: 5031
Remote: Yes
Date Published: Jun 17 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5031
Summary:

Caucho Technology Resin is a servlet and JSP (Java Server Pages) engine
that supports java and javascript. It is built for Unix and Linux variants
as well as Microsoft Windows operating environments.

A vulnerability has been reported in Resin Server 2.1.2, deployed on a
Microsoft Windows platform, that may allow remote attackers to view
contents of arbitrary files.

The 'view_source.jsp' script, found in an example folder as part of the
Resin Server installation, may allow remote attackers access to files
readable by the web server.

The vulnerability occurs when parsing requests for directory traversal.
The 'view_source.jsp' script prevents directory traversal via '/../'
sequences. However, an attacker attempting directory traversal via '\..\'
sequences will succeed. This may allow an attacker to request any files on
the vulnerable system readable by the web server.

This problem could lead to a remote user gaining access to sensitive
information on a system. This could include information such as access
control passwords, or other information stored on the server not meant for
public access.

8. Caucho Technology Resin Server Denial Of Service Vulnerability
BugTraq ID: 5032
Remote: Yes
Date Published: Jun 17 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5032
Summary:

Caucho Technology Resin is a servlet and JSP (Java Server Pages) engine
that supports java and javascript. It is built for Unix and Linux variants
as well as Microsoft Windows operating environments.

A vulnerability has been reported in Resin Server 2.1.1, deployed on a
Microsoft Windows platform, that may cause Resin Server to cease
functioning properly leading to a denial of service condition.

The vulnerability occurs when a client accesses non-existent resources.
If large variables are defined for such requests, parts (if not all) of
Resin will cease to be fully operational. A denial of service condition
may result.

An attacker may take advantage of this vulnerability to deny service to
legitimate users.

9. OSCommerce Remote File Include Vulnerability
BugTraq ID: 5037
Remote: Yes
Date Published: Jun 16 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5037
Summary:

osCommerce is open-source e-commerce software written in PHP. osCommerce
will run on most Unix and Linux variants as well as Microsoft Windows
operating systems.

osCommerce is prone to an issue which may allow remote attackers to
include arbitrary files located on remote servers. This issue is present
in the 'include_once.php'. An attacker may exploit this by supplying a
path to a file on a remote host as a value for the 'include_file'
parameter.

If the remote file is a PHP script, this may allow for execution of
attacker-supplied PHP code with the privileges of the webserver.
Successful exploitation may gain the attacker local access on the affected
host.

10. PHP Classifieds Cross-Site Scripting Vulnerability
BugTraq ID: 5022
Remote: Yes
Date Published: Jun 14 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5022
Summary:

PHP Classifieds is web-based classifieds software. It will run on most
Unix and Linux variants.

PHP Classifieds has been reported to be prone to cross-site scripting
attacks. This issue results from the failure of the 'latestwap.php' to
sanitize user-supplied input. Attackers may inject arbitrary HTML or
script code into the 'url' URI parameter via a malicious link. When the
malicious link is visited, the attacker's script code will be executed in
the web client of the user browsing the link, in the security context of
the website hosting the vulnerable software.

This may potentially be exploited to steal cookie-based authentication
credentials from legitimate users of the site hosting the software.

11. My Postcards MagicCard.CGI Arbitrary File Disclosure Vulnerability
BugTraq ID: 5029
Remote: Yes
Date Published: Jun 15 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5029
Summary:

My Postcards is a commercial available eletronic postcard system. It is
available for Unix and Linux Operating Systems.

A problem with My Postcards could make it possible for a remote attacker
to disclose the contents of arbitrary files.

The magiccard.cgi script does not properly handle some types of input.
As a result, it may be possible for a remote user to specify the location
of a specific file on the system hosting the My Postcards software. Upon
specifying the location of a file that is readable by the web server
process, the user could disclose the contents of the specified file.

12. Apache Chunked-Encoding Memory Corruption Vulnerability
BugTraq ID: 5033
Remote: Yes
Date Published: Jun 17 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5033
Summary:

Apache is a freely available webserver for Unix and Linux variants, as
well as Microsoft operating systems.

The HTTP protocol specifies a method of data coding called 'Chunked
Encoding', designed to facilitate fragmentation of HTTP requests in
transit. A vulnerability has been discovered in the Apache implementation
of 'Chunked Encoding'.

When processing requests coded with the 'Chunked Encoding' mechanism,
Apache fails to properly calculate required buffer sizes. This may be due
to improper (signed) interpretation of an unsigned integer value.

Consequently, several conditions may occur that have security
implications. It has been reported that a buffer overrun and signal race
condition occur. Exploitation of these conditions may result in the
execution of arbitrary code.

On Windows and Netware platforms, Apache uses threads within a single
server process to handle concurrent connections. Causing the server
process to crash on these platforms may result in a denial of service.

It has been confirmed that this vulnerability may be exploited to execute
arbitrary code on both Win32 and UNIX platforms.

Note: Products which use or bundle Apache such as Oracle 9iAS or IBM
Websphere may also be affected.

13. PHPBB2 Install.PHP Remote File Include Vulnerability
BugTraq ID: 5038
Remote: Yes
Date Published: Jun 17 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5038
Summary:

phpBB2 is an open-source web forum application that is written in PHP and
backended by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

A problem has been discovered in phpBB2 which may enable an attacker to
include an arbitrary attacker-supplied file which is located on a remote
host.

The problem is that an arbitrary path can be specified as a value for the
'phpbb_root_path' URL parameter. This issue exists in the 'install.php'
script. An attacker may exploit this vulnerability by supplying the
location of a remote file as the value for the 'phpbb_root_path' URL
parameter.

In the case that the remote file is a PHP script, this may allow commands
to be executed remotely with the privileges of the webserver. Successful
exploitation will allow a remote attacker to gain local, interactive
access to a host running the vulnerable software. This is especially a
concern for hosts running Microsoft Windows operating systems, as
webservers are generally run with SYSTEM privileges on these platforms.

14. Interbase GDS_Drop Interbase Environment Variable Buffer Overflow Vulnerability
BugTraq ID: 5044
Remote: No
Date Published: Jun 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5044
Summary:

Interbase is a database distributed and maintained by Borland. It is
available for Unix and Linux operating systems.

A problem with Interbase could make it possible for a local user to gain
elevated privileges.

A buffer overflow has been discovered in the setuid root gds_drop program
packaged with Interbase. This problem could allow a local user to execute
the program with strings of arbitrary length. By using a custom crafted
string, the attacker could overwrite stack memory, including the return
address of a function, and potentially execute arbitrary code as root.

The vulnerability occurs in the INTERBASE environment variable. When the
gds_drop program is executed with a string of arbitrary length (typically
500 or more characters) in the INTERBASE environment variable, the result
in an exploitable buffer overflow.

This could make it possible for a local user to gain administrative
access.

15. Interbase GDS_Lock_MGR Interbase Environment Variable Buffer Overflow Vulnerability
BugTraq ID: 5046
Remote: No
Date Published: Jun 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5046
Summary:

Interbase is a database distributed and maintained by Borland. It is
available for Unix and Linux operating systems.

A problem with Interbase could make it possible for a local user to gain
elevated privileges.

A buffer overflow has been discovered in the setuid root program
gds_lock_mgr, packaged with Interbase. This problem could allow a local
user to execute the program with strings of arbitrary length. By using a
custom crafted string, the attacker could overwrite stack memory,
including the return address of a function, and potentially execute
arbitrary code as root.

The vulnerability occurs in the INTERBASE environment variable. When the
gds_lock_mgr program is executed with a string of arbitrary length
(typically 500 or more bytes) in the INTERBASE environment variable, the
result in an exploitable buffer overflow.

This could make it possible for a local user to gain administrative
access.

16. Mandrake 8.2 Msec Insecure Default Permissions Vulnerability
BugTraq ID: 5050
Remote: No
Date Published: Jun 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5050
Summary:

Mandrake ships with an interface for setting and maintaining system-wide
security policy during an install of the operating system. This
functionality is provided by the Mandrake-Security package (msec).
Various settings provide differing levels of security.

The Mandrake 8.2 version of msec installs home directories with
world-readable permissions on the Standard security setting. This is
misleading as the Standard (msec level 2) security setting is intended to
be ideal for systems which have multiple local users. This may expose
contents of home directories to other local users. Additionally, msec
will proactively reset the permissions of home directories if they are
changed from the default world-readable permissions.

msec is a mandatory component of Mandrake 8.2 and may not be deselected
during an install of the operating system.

It should be noted that it is still possible to ensure more secure home
directory permissions by using a more restrictive msec setting.

17. Apache Tomcat Web Root Path Disclosure Vulnerability
BugTraq ID: 5054
Remote: Yes
Date Published: Jun 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5054
Summary:

Apache Tomcat is a freely available, open source web server maintained by
the Apache Foundation. It is available for use on Unix and Linux variants
as well as Microsoft Windows operating environments.

A vulnerability has been reported for Apache Tomcat 4.0.3 on a Microsoft
Windows platform. Reportedly, it is possible for a remote attacker to make
requests that will result in Apache Tomcat returning an error page
containing information that includes the absolute path to the server's web
root.

For example, submitting a request for LPT9 to Tomcat will result in the
following error message: "java.io.FileNotFoundException: C:\Program
Files\Apache Tomcat 4.0\webapps\ROOT\lpt9 (The system cannot find the file
specified)"

Gaining knowledge of path information could assist an attacker in further
attacks against the host.

18. WebScripts WebBBS Remote Command Execution Vulnerability
BugTraq ID: 5048
Remote: Yes
Date Published: Jun 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5048
Summary:

WebBBS is web-based BBS software, written in Perl. WebBBS was designed to
run on Unix and Linux variants.

WebBBS does not sufficiently filter shell metacharacters from CGI
parameters. As a result, remote attackers may execute arbitrary commands
on the underlying shell of the system hosting the vulnerable software.
This issue is known to exist in the 'webbbs_post.pl' script and is due to
insufficient filtering of the 'followup' CGI variable.

Remote attackers may gain local, interactive access to the host with the
privileges of the webserver process as a result of successful
exploitation.

19. IRSSI Long Malformed Topic Denial Of Service Vulnerability
BugTraq ID: 5055
Remote: Yes
Date Published: Jun 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5055
Summary:

irssi is a freely available, open source irc client. irssi is available
for the Linux and Unix operating systems.

irssi version 0.8.4 is prone to a denial of service condition when a user
joins a channel with a long, malformed topic. The vulnerability occurs
when a user attempts to join a channel that has an overly long topic
description. When the string, "\x1b\x5b\x30\x6d\x0d\x0a", is appended to
the topic, irssi will crash resulting in a denial of service.

An attacker can cause irssi clients to crash by changing the topic of a
channel while users are still online or by enticing users to join channels
with malformed topic descriptions.

An attacker may take advantage of this vulnerability to deny service to
legitimate users.

20. Cisco VPN Client for Unix Local Buffer Overflow Vulnerability
BugTraq ID: 5056
Remote: No
Date Published: Jun 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5056
Summary:

The Cisco VPN Client software is used to establish Virtual Private Network
(VPN) connections between client machines and a Cisco VPN Concentrator.
VPN tunnels can be used to provide an encrypted connection between a
private network and an external machine. The VPN Client is available for
Windows, Linux, Solaris and Mac OS X.

A vulnerability has been reported in some versions of the VPN Client. If
an oversized profile name is passed to the vpnclient binary, a buffer
overflow condition may occur. It is possible to overwrite stack data,
including stack frame information used to restore the instruction pointer
register.

A local attacker may pass specially constructed data to the vpnclient
command to exploit this condition. The ability to overwrite the
instruction pointer allows the attacker to execute arbitrary code as the
vpnclient command.

By default, vpnclient runs suid root. Exploitation of this vulnerability
will grant a local attacker root access to the vulnerable system.

This vulnerability affects the VPN Client version 3.5.1 for Linux, Solaris
and Mac OS X. Windows clients are not believed to be vulnerable. Earlier
versions of the VPN Client may share this vulnerability, although this has
not been confirmed.

21. TransWare Active Mail HTML Injection Vulnerability
BugTraq ID: 5007
Remote: Yes
Date Published: Jun 13 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5007
Summary:

Transware Active! Mail is a web based email application designed for use
with Unix and Linux variant operating systems.

It has been reported that Active! Mail, versions 1.422 and 2.0, are prone
to HTML injection attacks. Active! Mail does not properly strip email
headers of HTML code prior to displaying them. When the malicious mail is
viewed by the recipient, the attacker's script code will execute in their
browser in the security context of the web mail system.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the webmail system. The attacker may
use the stolen credentials to hijack the session of the recipient of the
malicious e-mail. In this instance, HTML injection attacks may also aid
in social engineering.

III. LINUX FOCUS LIST SUMMARY
----------------------------
1. Have I been kitted? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

2. Web filtering? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/Pine.BSO.4.44.0206131728060.9397-100000@paperboy.websocietyinc.com

IV.NEW PRODUCTS FOR LINUX PLATFORMS
-----------------------------------
1. StillSecure Border Guard
by Latis Networks
Platforms: Linux
Relevant URL:
http://www.latis.com/solutions.html
Summary:

StillSecure Border Guard is a security solution that enhances the
capabilities of your existing firewall and IDS. By actively connecting
these components, Border Guard provides real-time intrusion protection.
Once a security threat is detected, you can determine whether Border Guard
engages dynamic attack suppression, or sends alerts with recommendations
of appropriate actions for you to take.

2. InsideOut Firewall Reporter
by Stonylake Solutions
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Relevant URL:
http://www.stonylakesolutions.com/insideout.asp
Summary:

InsideOut Firewall Reporter is an easy to use, powerful, real time,
browser based reporting application for firewall logs. It provides over
150 useful reports. Windows and Linux versions available. Visit the site
for a live demo.

3. Tripwire Open Source, Linux Edition
by Tripwire, Inc.
Platforms: Linux
Relevant URL:
http://www.tripwire.com/products/linux/
Summary:

Tripwire Open Source, Linux Edition is the same great data and network
integrity software that Tripwire is known for, yet specifically designed
to run on the Linux operating system. Tripwire Open Source, Linux Edition
was inspired from Tripwire 2.2.1 software and is now co-developed by the
open source community.

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Tiger security tool v3.0
by Javier Fernández-Sanguino Peña
Relevant URL:
http://savannah.gnu.org/projects/tiger/
Platforms: UNIX
Summary:

TIGER is a set of Bourne shell scripts, C programs, and data files which
are used to perform a security audit of Unix systems. The security audit
results are useful both for system analysis (security auditing) and for
real-time, host-based intrusion detection.

2. wicap v0.4
by Brian Caswell
Relevant URL:
http://www.snort.org/~bmc/software/wicap/
Platforms: FreeBSD, OpenBSD, POSIX, Solaris, SunOS
Summary:

wicap is a captive portal that is easy to set up and supports OpenBSD.

3. Web shell v1.0
by Alex Dyatlov [email protected]
Relevant URL:
http://dyatlov.ru
Platforms: UNIX
Summary:

Webshell is a remote UNIX shell that works via HTTP. The client script
provides a shell-like prompt, encapsulating user commands into HTTP POST
requests and sending them to the server script. The server script extracts
and executes commands and returns STDOUT and STDERR output. Features
include command line history support, file upload/download, and it can
work through an HTTP proxy server.

4. LCDproc v0.4.3
by William W. Ferrell
Relevant URL:
http://lcdproc.omnipotent.net
Platforms: FreeBSD, Linux, OpenBSD, Solaris
Summary:

LCDproc is a utility to drive one or more LCD (and LCD-like) devices
attached to a host. It is comprised of a server, which uses a modular
device driver system to control attached displays, and one or more clients
to gather data as appropriate and send screen data to the server. The
included client displays a multitude of system statistics (CPU/memory/disk
usage, uptime, date and time, temperature, etc.). Multiple clients can
connect to the server simultaneously, and clients can set priorities on
the screens they provide to influence in what order items are displayed.
This facility can also be used to "pop" critical screens (such as an entry
from syslog from a log-watching client). All functionality is implemented
in userland. Support for many display devices and several platforms
(Linux, *BSD, and Solaris at least) is included.

VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

-------------------------------------------------------------------------------