SecurityFocus Linux Newsletter #100

SecurityFocus Linux Newsletter #100
-----------------------------------

This Issue is Sponsored by: SPI Dynamics

ALERT! - Cross-site scripting vulnerabilities in web applications allow
hackers to compromise confidential information, manipulate or steal
cookies, and create requests that can be mistaken for those of a valid
user!! All via port 80 and 443! Download this *FREE* white paper from SPI
Dynamics for a complete guide to protection!

Please visit us at: http://www.spidynamics.com/mktg/xss1/

-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Shredding the Paper Tiger of Cyberterrorism
     2. SecurityFocus DPP Program
     3. IIR's 3G Fraud & Security Forum
II. LINUX VULNERABILITY SUMMARY
     1. Rudi Benkovic JAWMail Script Injection Vulnerability
     2. PostNuke Modules.PHP Cross Site Scripting Vulnerability
     3. Null HTTPd Remote Heap Overflow Vulnerability
     4. Eric Prevoteau DCTC NULL Byte Denial Of Service Vulnerability
     5. Apache Tomcat DefaultServlet File Disclosure Vulnerability
     6. XOOPS HTML Injection Vulnerability
     7. Apache Oversized STDERR Buffer Denial Of Service Vulnerability
     8. NullLogic Null Webmail Format String Vulnerability
     9. PHPNuke News Message HTML Injection Vulnerability
     10. NPDS News Message HTML Injection Vulnerability
     11. DaCode News Message HTML Injection Vulnerability
     12. Interbase GDS_Lock_MGR UMask File Permission Changing...
     13. Zope Incorrect XML-RPC Request Information Disclosure...
     14. GV Malformed File Local Buffer Overflow Vulnerability
     15. Zope Through The Web Code Remote Denial Of Service Vulnerability
     16. PHPNuke Modules.PHP SQL Injection Vulnerability
     17. BEA WebLogic Server and Express HTTP Response Information...
     18. VBulletin Calendar.PHP Command Execution Vulnerability
     19. Zope ZCatalog Plug-In Remote Method Vulnerability
     20. Monkey HTTP Server File Disclosure Vulnerability.
     21. Drupal News Message HTML Injection Vulnerability
     22. PHPWebSite News Message HTML Injection Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. openssl (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. hp secure OS software for Linux
     2. PakSecured VPN Server
V. NEW TOOLS FOR LINUX PLATFORMS
     1. PASP vRC-1b
     2. Logrep v1.12
     3. Netfilter logs analyzer v0.1
VI. SPONSORSHIP INFORMATION


I. FRONT AND CENTER
-------------------
1. Shredding the Paper Tiger of Cyberterrorism
By Richard Forno

Government appointees and politicos should stop spreading fear,
uncertainty, and doubt with empty threats of cyberterrorism and focus on
the real issues surrounding information security.

http://online.securityfocus.com/columnists/111

2. SecurityFocus DPP Program

Attention Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

3. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space.  This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud?  We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud


II. BUGTRAQ SUMMARY
-------------------
1. Rudi Benkovic JAWMail Script Injection Vulnerability
BugTraq ID: 5771
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5771
Summary:

JAWMail is a freely available, open source web-based mail software package
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with JAWMail could make it possible to execute arbitrary script
code in a vulnerable client.

JAWMail does not sufficiently filter malicious HTML code from e-mails. As
a result, when a user opens an email in JAWMail that contains malicious
HTML code, the code contained in the mail would be executed in the browser
of the mail user.

This could allow an attacker to send malicious javascript or HTML to an
unsuspecting user of JAWMail, which would be executed in the security
context of the site hosting JAWMail.

Attackers may potentially exploit this issue to hijack web content or to
steal cookie-based authentication credentials. It may be possible to take
arbitrary actions as the victim user.

This vulnerability was reported for JAWMail 1.0-rc1. It is not known
whether other versions are affected.

2. PostNuke Modules.PHP Cross Site Scripting Vulnerability
BugTraq ID: 5809
Remote: Yes
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5809
Summary:

PostNuke is a content management system originally forked from the
PHP-Nuke project. It is implemented in PHP, and available for Windows,
Linux and other Unix based systems.

A cross site scripting vulnerability has been reported for PostNuke.

An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link. Attacker-supplied HTML and script code may be
executed on a web client in the context of the site hosting the webmail
system.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

3. Null HTTPd Remote Heap Overflow Vulnerability
BugTraq ID: 5774
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5774
Summary:

Null httpd is a small multithreaded web server for Linux and Windows,
mantained by NullLogic.

A remotely exploitable heap overflow has been discovered in Null httpd.
The ReadPOSTData() function allocates in_ContentLength+1024 for the
servers recv buffer. It is possible to pass a negative value to
'in_ContentLength', which is a signed integer, due to insufficient content
validation.

A negative in_ContentLength will result in the allocation of a buffer less
then 1024 bytes in size. The server then attempts to read 1024 bytes from
the network socket, resulting in an overflow.

An attacker may exploit this condition to overwrite arbitrary words in
memory through the free() function.  This may allow for the execution of
arbitrary code.

It should be noted that although reported on v0.5.0, earlier versions are
likely vulnerable.

4. Eric Prevoteau DCTC NULL Byte Denial Of Service Vulnerability
BugTraq ID: 5781
Remote: Yes
Date Published: Sep 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5781
Summary:

DCTC (Direct Connect Text Clone) is a text based interface to the Direct
Connect network for Linux operating environments.

A vulnerability has been reported for DCTC 0.83.3 that results in the
client crashing. This vulnerability occurs due to inadequate checks when
processing requests.

The DCTC client will crash if it receives a string that contains a NULL
byte. When the client attempts to parse the string, it results in the DCTC
client crashing thereby leading to a denial of service condition.

The vulnerability occurs in the file, dc_manage.c.

This vulnerability is no longer present in DCTC 0.83.4.

5. Apache Tomcat DefaultServlet File Disclosure Vulnerability
BugTraq ID: 5786
Remote: Yes
Date Published: Sep 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5786
Summary:

Tomcat is a popular web server and JSP/Servlet container that is developed
by Apache as part of the Jakarta project.

The servlet "org.apache.catalina.servlets.DefaultServlet" is included with
Tomcat by default.  A file disclosure vulnerability has been reported in
DefaultServlet.  An attacker may cause the contents of "target.jsp" to be
output by making a request for the servlet in the following format:

http://target/servlets/org.apache.catalina.servlets.DefaultServlet/target.jsp

Attackers may exploit this vulnerability to view the contents of arbitrary
files within the webroot.  This includes JSP source code which may contain
sensitive data such as database usernames and passwords.

6. XOOPS HTML Injection Vulnerability
BugTraq ID: 5785
Remote: Yes
Date Published: Sep 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5785
Summary:

XOOPS is a freely available, open source portal script software package
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with XOOPS could make it possible for an attacker to inject
arbitrary HTML in XOOPS messages.

XOOPS does not sufficiently filter potentially malicious HTML code from
posted messages. As a result, when a user chooses to view a message
posting that contains malicious HTML code, the code contained in the
message would be executed in the browser of the vulnerable user. This will
occur in the context of the site hosting the XOOPS software.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for XOOPS 1.0-rc3. It is not known whether
other versions are affected.

7. Apache Oversized STDERR Buffer Denial Of Service Vulnerability
BugTraq ID: 5787
Remote: Yes
Date Published: Sep 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5787
Summary:

Apache is an freely available, open-source webserver.  It runs on a number
of operating systems including Unix and Linux variants and Microsoft
Windows.

Apache is prone to a denial of service condition when an excessive amount
of data is written to stderr.  This condition reportedly occurs when the
amount of data written to stderr is over the default amount allowed by the
operating system.  When the condition is triggered, the webserver will
hang, resulting in a denial of service.  To regain service, the webserver
process must be restarted.

This may potentially be an issue in web applications that write
user-supplied data to stderr.  Additionally, locally based attackers may
exploit this issue.

This issue has been confirmed in Apache 2.0.39/2.0.40 on Linux operating
systems.  Apache on other platforms may also be affected.  This issue does
not appear to be present in versions prior to 2.0.x.

8. NullLogic Null Webmail Format String Vulnerability
BugTraq ID: 5794
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5794
Summary:

Null Webmail is a small web-based email system designed for use with Linux
and Unix variant operating environments.

A format string vulnerability has been reported for Null Webmail 0.6.4.
Allegedly, there exists errors in the file 'wmserver.c'. Specifically,
this issue is known to exist in the wmprintf() function.

This may allegedly allow an attacker to supply Null Webmail with
maliciously constructed format strings which may cause memory to be
corrupted with attacker-supplied data.  The consequence of successful
exploitation may result in arbitrary code execution with the privileges of
the server.

The possibility of arbitrary code execution has not been confirmed.

This vulnerability has been reported for Null Webmail 0.6.4. It is not
known whether other versions are affected.

9. PHPNuke News Message HTML Injection Vulnerability
BugTraq ID: 5796
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5796
Summary:

PHPNuke is a freely available, open source content management system
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with PHPNuke could make it possible for an attacker to inject
arbitrary HTML in PHPNuke news posts.

PHPNuke does not sufficiently filter potentially malicious HTML code from
news posts. As a result, when a user chooses to view a news posting that
contains malicious HTML code, the code contained in the posted message
would be executed in the browser of the vulnerable user. This will occur
in the context of the site hosting the PHPNuke software. It should be
noted that administrative approval may be required before news posts are
actually displayed on the vulnerable site. If this is the case and a post
requires approval through a Web-based interface, then an administrator of
the vulnerable site may be the intended target of attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for PHPNuke 6.0. It is not known whether
other versions are affected.

10. NPDS News Message HTML Injection Vulnerability
BugTraq ID: 5797
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5797
Summary:

NPDS (Nuke Permanent Double-Side Portal System)  is a freely available,
open source content management system implemented in PHP. It is available
for the Unix, Linux, and Microsoft operating environments.

Problems with NPDS could make it possible for an attacker to inject
arbitrary HTML in NPDS news posts.

NPDS does not sufficiently filter potentially malicious HTML code from
news posts. As a result, when a user chooses to view a news posting that
contains malicious HTML code, the code contained in the posted message
would be executed in the browser of the vulnerable user. This will occur
in the context of the site hosting the NPDS software. It should be noted
that administrative approval may be required before news posts are
actually displayed on the vulnerable site. If this is the case and a post
requires approval through a Web-based interface, then an administrator of
the vulnerable site may be the intended target of attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for NPDS 4.8. It is not known whether
other versions are affected.

11. DaCode News Message HTML Injection Vulnerability
BugTraq ID: 5798
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5798
Summary:

DaCode is a freely available, open source content management system
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with DaCode could make it possible for an attacker to inject
arbitrary HTML in DaCode news posts.

DaCode does not sufficiently filter potentially malicious HTML code from
news posts. As a result, when a user chooses to view a news posting that
contains malicious HTML code, the code contained in the posted message
would be executed in the browser of the vulnerable user. This will occur
in the context of the site hosting the DaCode software. It should be noted
that administrative approval may be required before news posts are
actually displayed on the vulnerable site. If this is the case and a post
requires approval through a Web-based interface, then an administrator of
the vulnerable site may be the intended target of attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for DaCode 1.2.0. It is not known whether
other versions are affected.

12. Interbase GDS_Lock_MGR UMask File Permission Changing Vulnerability
BugTraq ID: 5805
Remote: No
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5805
Summary:

Interbase is a SQL database distributed and maintained by Borland.  It is
available for Unix and Linux operating systems.

A problem with Interbase may make it possible for a local user to gain
elevated privileges.

The gds_lock_mgr program within Interbase is typically installed setuid.
This program does not properly handle user-supplied umasks, and may allow
the creation of files with insecure permissions as a privileged user.

When executed, the gds_lock_mgr program creates a predictable temporary
file.  Combined with the flaw in the umask handling, a user can execute a
symbolic link attack to create an arbitrary file with insecure permissions
as a privileged user.  This could result in the user gaining elevated
privileges.

13. Zope Incorrect XML-RPC Request Information Disclosure Vulnerability
BugTraq ID: 5806
Remote: Yes
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5806
Summary:

Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.

A vulnerability has been reported for Zope 2.5.1 and earlier. Reportedly,
Zope does not handle XML-RPC requests properly. Specially crafted XML-RPC
requests may cause Zope to respond to a request with an error page with
system specific details.

An attacker can exploit this vulnerability by making a special XML-RPC
request to the Zope server. Zope will fail when attempting to process this
request and will divulge sensitive information to the attacker.

It has also been reported that this vulnerability exists even when
starting Zope without the '-D' option.

This could result in information disclosure, and could potentially be used
to gain intelligence in launching an attack against a system.

14. GV Malformed File Local Buffer Overflow Vulnerability
BugTraq ID: 5808
Remote: No
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5808
Summary:

gv is a freely available, open source Portable Document Format (PDF) and
PostScript (PS) viewing utility.  It is available for Unix and Linux
operating systems.

A problem with gv could make it possible for an attacker to execute
arbitrary code in the security context of a local user.

It has been reported that an insecure sscanf() function exists in gv.
Due to this function, an attacker may be able to put malicious code in the
%%PageOrder: portion of a file.  When this malicious file is opened with
gv, the code would be executed in the security context of the local user.

It should be noted that this vulnerability may also affect other packages.
As gv is originally derived from the 1.5 release of GhostView, this
vulnerability may affect GhostView releases also.

15. Zope Through The Web Code Remote Denial Of Service Vulnerability
BugTraq ID: 5813
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5813
Summary:

Zope is a freely available, open source content management system.  It is
available for Unix, Linux, and Microsoft operating systems.

A problem with Zope could make it possible for a remote user to launch a
denial of service.

Zope systems that permit users to write "Through The Web Code" could be
vulnerable to a denial of service.  Due to insufficient validation of
input, it is possible for a remote user to submit a malicious piece of
code that will result in the shutdown of the vulnerable Zope server.

It should be noted that if a system running a vulnerable version of the
software allows remote users to write Python Scripts, DTML Methods, or
Page Templates via "Through The Web Code," the system is vulnerable to
denial of service.

16. PHPNuke Modules.PHP SQL Injection Vulnerability
BugTraq ID: 5799
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5799
Summary:

PHPNuke is a web based Portal system. Implemented in PHP, it is available
for a range of systems, including Microsoft Windows and Linux.

A SQL injection vulnerability has been discovered in all versions of
PHPNuke.

Due to insufficient sanitization of variables used to construct SQL
queries in the 'modules.php' script. It is possible to modify the logic of
SQL queries through malformed query strings in requests for the vulnerable
script.

By injecting SQL code into variables, it may be possible for an attacker
to cause a denial of service or corrupt database information.

This issue was reported in PHPNuke version 6.0. Other versions may also be
affected.

17. BEA WebLogic Server and Express HTTP Response Information Disclosure
Vulner$
BugTraq ID: 5819
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5819
Summary:

BEA Systems WebLogic Server is a web and wireless application server for
Microsoft Windows and most Unix and Linux distributions.  BEA WebLogic
Express provides a platform for serving dynamic data to web and wireless
applications.

BEA WebLogic Server and Express are reported to be prone to an issue which
has the potential to disclose sensitive information to malicious parties.
The vulnerable software occasionally returns two responses for a HTTP
request.  This condition has to do with how the affected software buffers
HTTP response data.

As a result, two users may receive responses from a single user's request,
which may unintentionally expose sensitive information to a malicious
party.  The nature of the information disclosed is entirely dependent on
what resource was requested when the condition occurs.

It has been reported by the vendor that there is no way for an attacker to
trigger this vulnerability, and that the condition may occur randomly.

18. VBulletin Calendar.PHP Command Execution Vulnerability
BugTraq ID: 5820
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5820
Summary:

vBulletin is commercial web forum software written in PHP and back-ended
by a MySQL database. It will run on most Linux and Unix variants, as well
as Microsoft operating systems.

A remote command execution vulnerability has been reported for vBulletin.
The vulnerability is due to vBulletin failing to properly sanitize
user-supplied input from URI parameters.

The vulnerability occurs in the 'calendar.php' file included with
vBulletin. Reportedly, modifying certain URI parameters may result in the
execution of attacker-supplied commands on the vulnerable system with the
privileges of the webserver process.

19. Zope ZCatalog Plug-In Remote Method Vulnerability
BugTraq ID: 5812
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5812
Summary:

Zope is a freely available, open source content management system.  It is
available for Unix, Linux, and Microsoft operating systems.

It has been reported that a problem in Zope may lead to users gaining
access to intended information.

Under some circumstances, it may be possible for a remote user to take
advantage of the plug-ins functionality of ZCatalog, included with the
Zope package.  Due to insecure default settings, it may be possible for
remote users to call arbitrary methods of catalog indexes anonymously.

It should also be noted that untrusted code run on the Zope system could
also allow the calling of arbitrary methods, and potentially call
malicious catalog indexes.

20. Monkey HTTP Server File Disclosure Vulnerability.
BugTraq ID: 5792
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5792
Summary:

Monkey is an open source Web server written in C, based on the HTTP/1.1
protocol. It is available for the Linux platform.

A directory traversal bug has been discovered in Monkey HTTP server.

It is possible for an attacker to bypass Monkeys input validation by
constructing a request containing an extra slash, appended with a typical
directory traversal string containing "dot-dot-slash" sequences (../).

For example:

http://vulnerable.com//../../../sensitive/file

By exploiting this issue an attacker can potentially break out of the web
root and gain access to arbitrary web server readable files.

21. Drupal News Message HTML Injection Vulnerability
BugTraq ID: 5801
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5801
Summary:

Drupal is a freely available, open source content management system
implemented in PHP. It is available for the Unix, Linux, and Microsoft
operating environments.

Problems with Drupal could make it possible for an attacker to inject
arbitrary HTML in Drupal news posts.

Drupal does not sufficiently filter potentially malicious HTML code from
news posts. As a result, when a user chooses to view a news posting that
contains malicious HTML code, the code contained in the posted message
would be executed in the browser of the vulnerable user. This will occur
in the context of the site hosting the Drupal software. It should be noted
that administrative approval may be required before news posts are
actually displayed on the vulnerable site. If this is the case and a post
requires approval through a Web-based interface, then an administrator of
the vulnerable site may be the intended target of attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for Drupal 4.0.0. It is not known whether
other versions are affected.

22. PHPWebSite News Message HTML Injection Vulnerability
BugTraq ID: 5802
Remote: Yes
Date Published: Sep 25 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5802
Summary:

phpWebSite is a freely available, open source portal content management
system implemented in PHP. It is available for the Unix, Linux, and
Microsoft operating environments.

Problems with phpWebSite could make it possible for an attacker to inject
arbitrary HTML in phpWebSite news posts.

phpWebSite does not sufficiently filter potentially malicious HTML code
from news posts. As a result, when a user chooses to view a news posting
that contains malicious HTML code, the code contained in the posted
message would be executed in the browser of the vulnerable user. This will
occur in the context of the site hosting the phpWebSite software. It
should be noted that administrative approval may be required before news
posts are actually displayed on the vulnerable site. If this is the case
and a post requires approval through a Web-based interface, then an
administrator of the vulnerable site may be the intended target of
attacks.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for phpWebSite 0.8.3. It is not known
whether other versions are affected.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. openssl (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/293225


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. hp secure OS software for Linux
by Hewlett-Packard
Platforms: N/A
Relevant URL:
http://www.hp.com/security/products/linux/
Summary:

A secure server platform for Linux as an enhancement to the HP Netaction
software suite. HP Secure OS Software for Linux, will help businesses
secure their Linux environments by offering intrusion prevention,
real-time protection against attacks, and damage containment. HP is first
to market with this business-critical security solution for Linux. HP
Secure OS Software for Linux provides high reliability, performance,
availability, flexibility and scalability. Additionally, it is easy to
install and manage, making it attractive to businesses that don't have
large IT organizations.

2. PakSecured VPN Server
by Paktronix Systems
Platforms: N/A
Relevant URL:
http://www.paktronix.com/products/vpn.php
Summary:

The most popular enhancement option for the PakSecured Firewall is our
IPSec VPN. The PakSecured VPN connects any two or more networks together
across the Internet using full IPSec encryption technology. Topologies
range from point-to-point through partial-mesh and full-mesh all the way
to fully geared mesh networks with redundant stems. Policy Routing
structures within the Linux kernel enable advanced routing and selection
mechanisms for providing different VPN mesh structures thus maximizing
expensive bandwidth and providing automatic failover and priority routing.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. PASP vRC-1b
by josiahcarlson
Relevant URL:
http://www.sourceforge.net/projects/pasp
Platforms: Os Independent
Summary:

PASP is a Bayesian-like spam filter that can be used as a POP3 proxy.

2. Logrep v1.12
by Tevfik Karagulle
Relevant URL:
http://logrep.sourceforge.net/
Platforms: Linux, POSIX, Windows 2000, Windows NT
Summary::

Logrep is a framework for extraction and presentation of information from
various logfiles. Currently Snort, Squid, Postfix, Apache, Trend Micro
VirusWall, and Microsoft IIS are supported. HTML reports, 2D analysis,
overview page, secure communication, and bar charts are available.

3. Netfilter logs analyzer v0.1
by gege
Relevant URL:
http://www.gege.org/iptables/
Platforms: Linux, POSIX
Summary:

IPTables log analyzer displays Linux 2.4 iptables logs (rejected packets)
in a nice HTML page. This page is easy to read and understand to reduce
the manual analysis time, and contains statistics on packets and links to
more detailed information on a given host, port, domain, etc.


VI. SPONSORSHIP INFORMATION
---------------------------
This Issue is Sponsored by: SPI Dynamics

ALERT! - Cross-site scripting vulnerabilities in web applications allow
hackers to compromise confidential information, manipulate or steal
cookies, and create requests that can be mistaken for those of a valid
user!! All via port 80 and 443! Download this *FREE* white paper from SPI
Dynamics for a complete guide to protection!

Please visit us at: http://www.spidynamics.com/mktg/xss1/

-------------------------------------------------------------------------------