SecurityFocus Linux Newsletter #95

SecurityFocus Linux Newsletter #95
----------------------------------

This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!
http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml
-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Introduction to Autorooters: Crackers Working Smarter, not Harder
     2. Know Your Enemy: Building Virtual Honeynets
     3. An Open Letter to the CIO
     4. The 21 Best Ways to Lose Your Information
     5. SecurityFocus DPP Program
     6. InforwarCon 2002
II. LINUX VULNERABILITY SUMMARY
     1. Ilia Alshanetsky FUDForum SQL Injection Vulnerability
     2. Lynx Command Line URL CRLF Injection Vulnerability
     3. Kerio MailServer Multiple SYN Packet Denial Of Service...
     4. Abyss Web Server Administrative Console Unauthorized Access...
     5. AOL Instant Messenger Link Special Character Remote Heap...
     6. nCipher PKCS#11 Symmetric Message Signature Verification...
     7. Ilia Alshanetsky FUDForum File Disclosure Vulnerability
     8. Kerio MailServer Web Mail Multiple Cross Site Scripting...
     9. Linux Kernel 2.4.18 Security Issues
     10. Ilia Alshanetsky FUDForum File Modification Vulnerability
     11. Abyss Web Server Malicious HTTP Request Information Disclosure...
     12. Abyss Web Server Encoded Backslash Directory Traversal...
     13. Light Channel Name Arbitrary Command Execution Vulnerability
     14. SCPOnly SSH Environment Shell Escaping Vulnerability
     15. Stephen Ball File Manager Source.PHP Directory Traversal...
     16. Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. New SecurityFocus Lists! (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Tripwire Open Source, Linux Edition
     2. SMART Extractor
     3. Immunix
V. NEW TOOLS FOR LINUX PLATFORMS
     1. XORSuite v2.2
     2. ClarkConnect Internet Gateway v1.1
     3. lcrzoex v4.11
VI. SPONSORSHIP INFORMATION


I. FRONT AND CENTER
-------------------
1. Introduction to Autorooters: Crackers Working Smarter, not Harder
by Matt Tanase

Efficiency and automation: one can argue that they are two of the most
valuable by-products of any technology. There is little doubt that the
electronic tools of today allow us to get more done in less time. We use
software to eliminate tedious work, reduce man-hours, and sift through
mounds of data in seconds. Crackers, as we know, are smart... and lazy. It
should come as no surprise then that they too, have employed technology to
reduce their workload. The result? A type of malicious code known as
autorooters, programs designed to automatically scan and attack target
computers at blistering speeds.

http://online.securityfocus.com/infocus/1619

2. Know Your Enemy: Building Virtual Honeynets
by The Honeynet Project

Over the past several years, honeynets have demonstrated their value as a
security mechanism, primarily to learn about the tools, tactics, and
motives of the blackhat community. This information is critical for
organizations to better understand and protect against the threats they
face. Among the problems with honeynets is that they are resource
intensive, difficult to build, and complex to maintain. Honeynets require
a variety of both physical systems and security mechanisms to be
effectively deployed. However, the Honeynet Project has been researching a
new possibility, virtual honeynets. These systems share many of the values
of traditional honeynets, but have the advantages of running all the
systems on a single system. This makes virtual honeynets cheaper to build,
easier to deploy, and simpler to maintain.

http://online.securityfocus.com/infocus/1614

3. An Open Letter to the CIO
By Richard Forno

As the summer winds down and work resumes in earnest, our humble columnist
offers this open letter to CIOs on behalf of security admins everywhere.

http://online.securityfocus.com/

4. The 21 Best Ways to Lose Your Information
by Kevin Beaver, CISSP ([email protected])

Have you ever wondered what the best ways are to get hacked, be adversely
affected by disasters, or otherwise lose information stored on your
computer systems? Here, in no particular order, are the 21 best ways to
not secure your systems:

http://online.securityfocus.com/guest/16221

5. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

6. InforwarCon 2002

InforwarCon 2002: Homeland Defense and Cyber-Terrorism, Washington, DC
September 4-5, 2002, optional workshops September 3 & 6. Presented by MIS
Training Institute and Interpact, Inc. Proven strategies for protecting
against threats to critical infrastructures and government systems.

Visit us at:
http://www.misti.com/08/iw02nl26inf.html


II. BUGTRAQ SUMMARY
-------------------
1. Ilia Alshanetsky FUDForum SQL Injection Vulnerability
BugTraq ID: 5500
Remote: Yes
Date Published: Aug 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5500
Summary:

Ilia Alshanetsky FUDForum is a freely available Web-based forum. It is
implemented in PHP and is available for Linux and Unix variant, as well
as, Microsoft Windows operating systems.

Reportedly, L-Forum is vulnerable to SQL injection attacks. User input is
not properly sanitized before being included in SQL statements. The
vulnerability lies in the files 'report.php', 'selmsg.php' and
'showposts.php'.

SQL code may be inserted into the requests and executed by the database
server. These requests could include adding, deleting, and modifying data.
It may be possible to access sensitive information, such as authentication
credentials for other users of the forum software.

Additionally, this may allow a remote attacker to exploit vulnerabilities
that exist in the underlying database.

2. Lynx Command Line URL CRLF Injection Vulnerability
BugTraq ID: 5499
Remote: Yes
Date Published: Aug 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5499
Summary:

Lynx is a freely distributable, text-based WWW client. It is available for
use on various operating systems and platforms including Linux and Unix
variant and Microsoft Windows operating environments.

A CRLF injection vulnerability has been reported for Lynx that may allow
an attacker to include extra HTTP headers when viewing web pages. If Lynx
is called from the command line, carriage return and line feed (CRLF)
characters may be included in the specified URL. These characters are not
escaped when the input is used to construct a HTTP request.

As CRLF is used as a delimiter between headers under the HTTP protocol,
exploitation of this vulnerability will result in additional headers being
included in the HTTP request.

Injection of a 'Host' header may cause the request to be serviced as if
made to a different domain, if the server in question supports multiple
hosts. It may also be possible to inject arbitrary cookie data.

It is still possible for attackers to exploit this vulnerability even if
the '-realm' and '-restrictions=useragen' options are used. Reportedly, it
is also possible for an attacker to contact other type of servers,
including POP3 servers and MTAs (Mail Transfer Agents).

This vulnerability has been reported for Lynx versions 2.8.4rel.1,
2.8.5dev.8, 2.8.3rel.1 and 2.8.2rel.1. It is not known whether other
versions are affected.

*** Links 0.9.6 and ELinks have also been reported as being vulnerable.
Some versions of Links and ELinks URL encode space characters so an
attacker needs to use tab characters, instead of spaces, to exploit the
issue on these browsers.

3. Kerio MailServer Multiple SYN Packet Denial Of Service Vulnerability
BugTraq ID: 5505
Remote: Yes
Date Published: Aug 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5505
Summary:

Kerio MailServer is a mail server designed for use with Microsoft Windows
and Linux and Unix variant operating systems.

Kerio MailServer is vulnerable to a denial of service condition when it
receives multiple SYN packets.

An attacker may be able to exploit this vulnerability by sending multiple
SYN packets to all the services of Kerio Mailserver (POP3, SMTP, IMAP,
Secure IMAP, POP3S, Web-mail, Secure Web-mail). This prevents all the
affected services from responding to requests for service.

An attacker sending five SYN packets will cause the service to stop
responding for a few minutes. During this duration, Kerio Mailserver will,
reportedly, consume all resources of the system and fail to respond to any
more requests for service. Repeated exploitation of this vulnerability
will prevent Mailserver from responding at all. Other services offered by
the vulnerable system will be affected as well.

4. Abyss Web Server Administrative Console Unauthorized Access Vulnerability
BugTraq ID: 5548
Remote: Yes
Date Published: Aug 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5548
Summary:

Abyss Web Server is a freely available personal web server. It is
maintained by Aprelium Technologies and runs on Microsoft Windows
operating systems, as well as Linux.

A vulnerability has been reported for Abyss Web Server for both the Linux
and Microsoft Windows operating environments. Reportedly, it is possible
for an attacker to obtain access to Abyss Web Server's administrative
console without any need for authentication.

An attacker can exploit this vulnerability to change any, and all,
configuration parameters of Abyss Web Server, including the administrative
password. It will also enable the remote attacker to stop and restart the
Web server.

5. AOL Instant Messenger Link Special Character Remote Heap Overflow Vulnerability
BugTraq ID: 5492
Remote: Yes
Date Published: Aug 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5492
Summary:

AIM is the AOL Instant Messenger.  It is available for various platforms,
including Linux and Microsoft Windows.  This vulnerability affects the
Windows client.

It has been reported that it is possible to cause a heap overflow in AIM.

A problem has been reported in the handling of special characters, such as
spaces (%20).  When an URL is sent to a user containing special characters
that must be converted to addressable format, an overflow may occur.
This has reportedly been reproduced to create a denial of service.

In the event that this is an exploitable heap overflow, this vulnerability
could potentially be used to execute arbitrary code.  If this is the case,
remote code execution in the context of the AIM user would result.

6. nCipher PKCS#11 Symmetric Message Signature Verification Vulnerability
BugTraq ID: 5498
Remote: Unknown
Date Published: Aug 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5498
Summary:

nCipher produces a range of hardware and software security products which
support a range of cryptographic operations. A vulnerability has been
reported in the nCipher cryptographic library, related to the checking of
some message signatures.

The RSA PKCS#11 specification allows the signing of messages with a
symmetric key. Verification of these signatures is supported by the
nCipher cryptographic library. However, an error in the library
implementation may result in incorrect results being returned when
signatures are verified.

Under some conditions, the vulnerable function C_Verify may return the
'CKR_OK' message when an invalid signature is verified. The
'CKR_SIGNATURE_INVALID' message would normally be expected under this
condition. As a result, products and processes which rely on this library
function may make erroneous trust decisions regarding messages with
invalid signatures.

The consequences of exploitation will be highly dependent on the nature of
the application using the vulnerable library. It is likely that
exploitation will allow an attacker to inject or modify encrypted
information which is normally protected by a signature. Impersonation of
trusted parties may be possible.

Reportedly, the vulnerable signature mechanism is used by a number of
common protocols, including SSLv2, SSH and IPSEC.

This issue exists in versions 1.2.0 and later of the nCipher cryptographic
library.

7. Ilia Alshanetsky FUDForum File Disclosure Vulnerability
BugTraq ID: 5501
Remote: Yes
Date Published: Aug 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5501
Summary:

Ilia Alshanetsky FUDForum is a freely available Web-based forum. It is
implemented in PHP and is available for Linux and Unix variant, as well
as, Microsoft Windows operating systems.

Reportedly, FUDForum may disclose contents of arbitrary files to
attackers. This vulnerability is present in the 'tmp_view.php' script. The
vulnerability is the result of FUDForum failing to check the path of the
file that is being requested.

By simply making malicious requests to 'tmp_view.php' via URI parameters,
an attacker is able to obtain access to potentially sensitive files.

8. Kerio MailServer Web Mail Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 5507
Remote: Yes
Date Published: Aug 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5507
Summary:

Kerio MailServer is a mail server designed for use with Microsoft Windows
and Linux and Unix variant operating systems.

Reportedly, Kerio Mailserver is vulnerable to cross site scripting
attacks. The vulnerability is present in Kerio Mailserver's web mail
component.

An attacker may exploit this vulnerability by causing a victim user to
follow a malicious link. Attacker-supplied code may execute within the
context of the site hosting the vulnerable software when the malicious
link is visited.

This type of vulnerability may be used to steal cookies or perform other
web-based attacks. It may be possible to take actions as an authenticated
user of the web mail system.

9. Linux Kernel 2.4.18 Security Issues
BugTraq ID: 5539
Remote: Unknown
Date Published: Aug 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5539
Summary:

Red Hat has issued an advisory reporting the correction of several
vulnerabilities in version 2.4.18 of the Linux kernel.  Some of the
security issues are related to the following device drivers:

stradis rio500 se401 usbvideo apm

Furhermore, vulnerabilities reportedly exist in components of the procfs
virtual filesystem that may cause kernel memory to be exposed.  It should
be assumed that at the very least, local attackers may exploit these
vulnerabilities to elevate privileges.

SecurityFocus is currently completing analysis of the reported
vulnerabilities and will issue individual alerts for each.

10. Ilia Alshanetsky FUDForum File Modification Vulnerability
BugTraq ID: 5502
Remote: Yes
Date Published: Aug 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5502
Summary:

Ilia Alshanetsky FUDForum is a freely available Web-based forum. It is
implemented in PHP and is available for Linux and Unix variant, as well
as, Microsoft Windows operating systems.

Reportedly, it is possible for an administrator to manipulate (create,
modify and view) files outside of the FUDForum directories. This
vulnerability is present in the 'adm/admbrowse.php' script. The
vulnerability is the result of FUDForum allowing access to files and
directories outside of FUDForum directories.

By simply making malicious requests to 'adm/admbrowse.php' via URI
parameters, an attacker is able to obtain access to potentially sensitive
files. It may also be possible to create and modify arbitrary files on the
vulnerable system. However, this has not been confirmed.

11. Abyss Web Server Malicious HTTP Request Information Disclosure Vulnerability
BugTraq ID: 5549
Remote: Yes
Date Published: Aug 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5549
Summary:

Abyss Web Server is a freely available personal web server. It is
maintained by Aprelium Technologies and runs on Microsoft Windows
operating systems, as well as Linux.

Reportedly, it is possible for attackers to obtain the contents of files
by appending a special character to HTTP requests to Abyss Web Server.

An attacker can exploit this vulnerability to obtain access to contents of
potentially sensitive files. Reportedly, by appending the '+' character,
Abyss Web Server will disclose the contents of some files to remote
attackers.

It has been reported possible to exploit this vulnerability to view the
contents of '.chl' files used for remote administration of the server. It
may be possible to view the contents of other executable files intended to
serve CGI requests. This has not, however, been confirmed.

This vulnerability has been reported for Abyss Web Server 1.0.3. It is not
known whether other versions are affected.

12. Abyss Web Server Encoded Backslash Directory Traversal Vulnerability
BugTraq ID: 5547
Remote: Yes
Date Published: Aug 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5547
Summary:

Abyss Web Server is a freely available personal web server. It is
maintained by Aprelium Technologies and runs on Microsoft Windows
operating systems, as well as Linux.

A directory traversal vulnerability has been reported for Abyss Web
Server. The issue is related to the failure to properly process the
backslash '\', encoded as '%5c', character, which may be used as a
directory delimiter under these platforms. By using the URL encoded
sequence '%2e%2e%5c', the web root may be escaped.

Exploitation can result in arbitrary system files being sent to a remote
attacker. This information may be of value in attempting further attacks
against the vulnerable system.

The directory traversal vulnerability was reported for Abyss Web Server
for both the Microsoft Windows and Linux operating environment. In a Linux
environment, it is only possible to escape immediately out of the web root
directory and into the Abyss folder; it is not possible for an attacker to
view files residing outside of the Abyss installation folder. However, in
a Windows environment the attacker is able to traverse outside of the
webroot and into all areas of the filesystem.

13. Light Channel Name Arbitrary Command Execution Vulnerability
BugTraq ID: 5555
Remote: Yes
Date Published: Aug 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5555
Summary:

Light is a freely available, open source IRC script for the EPIC IRC
client.  It is available for Unix, Linux, and Windows platforms.

Light contains a vulnerability which may allow the execution of arbitrary
code.

It has been discovered that Light does not properly handle some channel
names.  A channel containing embedded code in the channel name would, when
joined by a user of Light, result in the execution of the code in the
channel name.  This could allow an attacker to gain access to a system in
the security context of the Light user.

14. SCPOnly SSH Environment Shell Escaping Vulnerability
BugTraq ID: 5526
Remote: No
Date Published: Aug 20 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5526
Summary:

scponly is a freely available, open source restricted secure copy client.
It is available for Unix and Linux operating systems.

A problem with scponly could make it possible for a user to gain
unintended access to a system running a vulnerable version.

The default installation of scponly does not place sufficient access
controls on the .ssh subdirectory.  Due to this oversight, it is possible
for a remote user to upload files which may allow command execution.
This could lead to unintended command execution, and regular shell access
to a vulnerable host.

The problem is in the environment file contained within the .ssh
subdirectory.  If this file is installed with permissions that allow user
modification to the file (which is the default behavior), a user would be
able to upload a new version of this file.  This file could contain
malicious commands, such as changing the user's shell, and would be
executed by the user upon the next log-in.

15. Stephen Ball File Manager Source.PHP Directory Traversal Vulnerability
BugTraq ID: 5533
Remote: Yes
Date Published: Aug 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5533
Summary:

Stephen Ball File Manager is a utility to manage files on a system. It is
implemented in PHP and is available for Microsoft Windows and Unix and
Linux variant operating systems.

A vulnerability has been reported for File Manager 1.5. Reportedly, it is
possible to launch directory traversal attacks against File Manager. It is
possible for remote attackers to access arbitrary files residing on a
vulnerable host.

An attacker may exploit this issue by submitting a request to the script
'source.php', and passing a CGI parameter specifying an arbitrary system
file. The '../' character sequence may be used to escape the specified
root directory.

Information disclosed through this vulnerability may aid an attacker in
making further attacks against the vulnerable system.

16. Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
BugTraq ID: 5542
Remote: Yes
Date Published: Aug 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5542
Summary:

Jakarta Tomcat is a Java Servlet and JSP server produced by the Apache
Software Foundation. Tomcat is available for Microsoft Windows, Linux, and
other Unix based operating systems.

A cross site scripting vulnerability has been reported in some versions of
Tomcat. Reportedly, if a HTTP request is made for a JSP, malicious script
code embedded in the URI may be included in a page generated by Tomcat.

An attacker may generate a link to a vulnerable site, and include
arbitrary malicious script code. If a user is enticed into following this
link, the supplied code will be returned by the server, and execute within
the context of the vulnerable site.

Exploitation may result in the disclosure of sensitive cookie data, or the
ability to take actions as an authenticated user of the vulnerable site.
The consequences of exploitation will be highly dependant on the details
of the vulnerable site.

This may be related to the issues discussed in BID 2982. This has not,
however, been confirmed.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. New SecurityFocus Lists! (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/288099


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Tripwire Open Source, Linux Edition
by Tripwire, Inc.
Platforms: Linux
Relevant URL:
http://www.tripwire.com/products/linux/
Summary:

Tripwire Open Source, Linux Edition is the same great data and network
integrity software that Tripwire is known for, yet specifically designed
to run on the Linux operating system. Tripwire Open Source, Linux Edition
was inspired from Tripwire 2.2.1 software and is now co-developed by the
open source community.

2. SMART Extractor
by WetStone Technologies
Platforms: Linux
Relevant URL:
http://www.wetstonetech.com/extractor.html
Summary:

WetStone Technologies, SM&A, the Computer Forensics Research and
Development Center (CFRDC), and the New York State Police Forensic
Investigation Center (NYSPFIC) have developed the Extractor, a Linux
RedHat® deleted file recovery tool. The technology can assist law
enforcement, government and commercial organizations in retrieving
maliciously or accidentally deleted files within the increasingly poplular
Linux operating system environment.

3. Immunix
by WireX
Platforms: Linux
Relevant URL:
http://www.immunix.org/
Summary:

"Immunix" is a family of tools designed to enhance system integrity by
hardening system components and platforms against security attacks. The
Immunix OS is a Linux platform hardened with the Immunix tool set.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. XORSuite v2.2
by Ramsey G. Brenner
Relevant URL:
http://home.earthlink.net/~rgbrenner/projects/xorsuite/
Platforms: POSIX
Summary:

A OTP suite. Provides 5 programs which create keys, create fake keys,
encrypt and decrypt files. An uninstaller is also included.

2. ClarkConnect Internet Gateway v1.1
by Peter Baldwin
Relevant URL:
http://www.clarkconnect.org/download/
Platforms: Linux
Summary:

ClarkConnect is a software package that transforms an old beat up PC into
a smart, simple, and secure Internet gateway and server for your home or
small office network. In addition to connection sharing, the software
comes with a strong firewall, Apache, dynamic DNS utilities, and Samba
filesharing. The software is based on Red Hat Linux.

3. lcrzoex v4.11
by Laurent Constantin
Relevant URL:
http://www.laurentconstantin.com/en/lcrzoex/
Platforms: FreeBSD, Linux, OpenBSD, Solaris, Windows 2000, Windows 95/98,
Windows NT, Windows XP
Summary:

Lcrzoex is a toolbox for network administrators and network hackers.
Lcrzoex contains over 300 functionnalities using network library lcrzo.
Each one can be compiled alone and modified to match your needs.

Lcrzoex can be used in the following contexts :
- discover the Ethernet address of a computer (number 2, 3, 134, etc.)
- sniff your LAN to detect what's going on (number 7, 8, 9, etc.)
- check the checksums created by a network program which isn't working
(number 16, 17, 18, etc.)
- intercept a session and replay it as many times you want to strictly
test your application (number 10, 11, 12, 22, etc.)
- verify if a router is well configured even if the needed computers are
down (number 48, ..., 53, etc.)
- check if your router/firewall/computer blocks
- IP protocols (number 29, ..., 34, etc.)
- IP options (number 29, ..., 34, 73, ..., 79, etc.), source routing
(number 45, 56, 59, 62, etc.)
- IP fragments (number 44, 55, 58, 61, 72, etc.)
- TCP options (number 48, ..., 53, etc.)
- ICMP types (number 65, ..., 70, etc.)
- ARP poisoning (number 80, 81, 82, 83, etc.)
- create a tcp/udp client with a special local port (number 85, 89, 86,
93, 97, etc.)
- convert between numbers (number 139, ..., 148, etc.) - etc.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!
http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml
-------------------------------------------------------------------------------