SecurityFocus Linux Newsletter #101

John Boletta <[email protected]> Mon, 7 Oct 2002 11:43:52 -0600 (MDT)

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #101
-----------------------------------

This Issue is Sponsored By: Qualys

Bulletproof Your Network: FREE Guide

Existing security products -- firewalls, anti-virus and IDS -- are simply
no longer enough to ensure your networks are safe against sophisticated
attacks and worms such as Code Red and Nimda. FREE Guide shows you how to
ensure TOTAL security for your network. Get it now.

Visit us at: https://www.qualys.com/forms/guide_220.php

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Assessing Internet Security Risk, Part Four: Custom Web...
2. Evaluating Network Intrusion Detection Signatures, Part Two
3. SecurityFocus DPP Program
4. IIR's 3G Fraud & Security Forum
5. InfoSec World Conference and Expo/2003
II. LINUX VULNERABILITY SUMMARY
1. PostNuke Modules.PHP Cross Site Scripting Vulnerability
2. Zope Incorrect XML-RPC Request Information Disclosure...
3. GV Malformed File Local Buffer Overflow Vulnerability
4. BEA WebLogic Server and Express HTTP Response Information...
5. VBulletin Calendar.PHP Command Execution Vulnerability
6. Jetty Servlet Engine Cross Site Scripting Vulnerability
7. EmuMail Web Root Path Disclosure Vulnerability
8. EmuMail Email Form Script Injection Vulnerability
9. Eric S. Raymond Fetchmail Email Header Parsing Buffer Overflow...
10. Eric S. Raymond Fetchmail Multidrop Mode Denial Of Service...
11. Sendmail SMRSH Double Pipe Access Validation Vulnerability
12. Eric S. Raymond Fetchmail Multidrop Mode Email Header Parsing...
13. Monkey HTTP Server Multiple Cross Site Scripting Vulnerabilities
14. GNU Tar Hostile Destination Path Variant Vulnerability
15. Bugzilla Group Creation With Elevated Privileges Vulnerability
18. GV GZip Archive Malicious File Name Command Execution...
19. Bugzilla Bugzilla_Email_Append.pl Arbitrary Command Execution...
20. Bugzilla Account Creation SQL Injection Vulnerability
21. SafeTP Passive Mode Internal IP Address Revealing Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. VPN Choices for RedHat 7.3 (Thread)
2. openssl (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. nPatrol
2. SysOrb
V. NEW TOOLS FOR LINUX PLATFORMS
1. ratemask v1.0.0
2. EPS v1.2
3. Graphical certification authority v0.2.6
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. Assessing Internet Security Risk, Part Four: Custom Web Applications
By Charl van der Walt

This article is the fourth in a series that is designed to help readers to
assess the risk that their Internet-connected systems are exposed to. This
installment will discuss a relatively unexplored aspect of Internet
security, custom Web applications.

http://online.securityfocus.com/infocus/1631

2. Evaluating NID Signatures, Part Two
byKaren Kent Frederick

In this series of articles, we present recommendations that will help
readers to evaluate the quality of network intrusion detection (NID)
signatures, either through hands-on testing or through careful
consideration of third-party product reviews and comparisons. The first
installment discussed some of the basics of evaluating NID signature
quality, as well selecting attacks to be used in testing. This article
will conclude the discussion on criteria for choosing attacks and then
provide recommendations for generating attacks and creating a good testing
environment. We begin by discussing some methods of acquiring attacks and
attack traffic.

http://online.securityfocus.com/infocus/1630

3. SecurityFocus DPP Program

Attention Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

4. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud

5. InfoSec World Conference and Expo/2003

March 10-12, 2003, Orlando, FL
Optional Workshops March 8, 9, 12, 13, & 14
Vendor Expo March 10 & 11

Solutions to today's security concerns; hands-on experts; blockbuster
vendor expo; the CISO Executive Summit; invaluable networking
opportunitiesInfoSec World has it all!

Go to: http://www.misti.com/10/os03nl37inf.h

II. BUGTRAQ SUMMARY
-------------------
1. PostNuke Modules.PHP Cross Site Scripting Vulnerability
BugTraq ID: 5809
Remote: Yes
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5809
Summary:

PostNuke is a content management system originally forked from the
PHP-Nuke project. It is implemented in PHP, and available for Windows,
Linux and other Unix based systems.

A cross site scripting vulnerability has been reported for PostNuke.

An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link. Attacker-supplied HTML and script code may be
executed on a web client in the context of the site hosting the web-based
forum.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

2. Zope Incorrect XML-RPC Request Information Disclosure Vulnerability
BugTraq ID: 5806
Remote: Yes
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5806
Summary:

Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.

A vulnerability has been reported for Zope 2.5.1 and earlier. Reportedly,
Zope does not handle XML-RPC requests properly. Specially crafted XML-RPC
requests may cause Zope to respond to a request with an error page with
system specific details.

An attacker can exploit this vulnerability by making a special XML-RPC
request to the Zope server. Zope will fail when attempting to process this
request and will divulge sensitive information to the attacker.

It has also been reported that this vulnerability exists even when
starting Zope without the '-D' option.

This could result in information disclosure, and could potentially be used
to gain intelligence in launching an attack against a system.

3. GV Malformed File Local Buffer Overflow Vulnerability
BugTraq ID: 5808
Remote: No
Date Published: Sep 26 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5808
Summary:

gv is a freely available, open source Portable Document Format (PDF) and
PostScript (PS) viewing utility. It is available for Unix and Linux
operating systems.

A problem with gv could make it possible for an attacker to execute
arbitrary code in the security context of a local user.

It has been reported that an insecure sscanf() function exists in gv.
Due to this function, an attacker may be able to put malicious code in the
%%PageOrder: portion of a file. When this malicious file is opened with
gv, the code would be executed in the security context of the local user.

It should be noted that this vulnerability may also affect other packages.
As gv is originally derived from the 1.5 release of GhostView, this
vulnerability may affect GhostView releases also.

4. BEA WebLogic Server and Express HTTP Response Information Disclosure Vulnerability
BugTraq ID: 5819
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5819
Summary:

BEA Systems WebLogic Server is a web and wireless application server for
Microsoft Windows and most Unix and Linux distributions. BEA WebLogic
Express provides a platform for serving dynamic data to web and wireless
applications.

BEA WebLogic Server and Express are reported to be prone to an issue which
has the potential to disclose sensitive information to malicious parties.
The vulnerable software occasionally returns two responses for a HTTP
request. This condition has to do with how the affected software buffers
HTTP response data.

As a result, two users may receive responses from a single user's request,
which may unintentionally expose sensitive information to a malicious
party. The nature of the information disclosed is entirely dependent on
what resource was requested when the condition occurs.

It has been reported by the vendor that there is no way for an attacker to
trigger this vulnerability, and that the condition may occur randomly.

5. VBulletin Calendar.PHP Command Execution Vulnerability
BugTraq ID: 5820
Remote: Yes
Date Published: Sep 27 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5820
Summary:

vBulletin is commercial web forum software written in PHP and back-ended
by a MySQL database. It will run on most Linux and Unix variants, as well
as Microsoft operating systems.

A remote command execution vulnerability has been reported for vBulletin.
The vulnerability is due to vBulletin failing to properly sanitize
user-supplied input from URI parameters.

The vulnerability occurs in the 'calendar.php' file included with
vBulletin. Reportedly, modifying certain URI parameters may result in the
execution of attacker-supplied commands on the vulnerable system with the
privileges of the webserver process.

6. Jetty Servlet Engine Cross Site Scripting Vulnerability
BugTraq ID: 5821
Remote: Yes
Date Published: Sep 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5821
Summary:

Jetty is a freely available, open source Java Web Server and Servlet
Container. It is available for Linux, Unix, and Microsoft Windows
platforms.

A problem with Jetty may make it possible for users to launch cross-site
scripting attacks.

It has been reported that Jetty does not properly sanitize requests.
This could result in a user clicking a malicious link that would execute
script or HTML code in the security context of the site hosted by the
Jetty server. An attacker could exploit this vulnerability to gain
authentication cookies, or other sensitive information.

This vulnerability occurs when the script code is appended with two hex
linefeed (0a) characters in the requested URL. This vulnerability may
affect other versions of Jetty.

7. EmuMail Web Root Path Disclosure Vulnerability
BugTraq ID: 5823
Remote: Yes
Date Published: Sep 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5823
Summary:

Emumail is an open source web mail application. It is available for the
Unix, Linux, and Microsoft Windows operating systems.

A problem with Emumail could make it possible for an attacker to gain
sensitive information.

Under some conditions, Emumail may reveal sensitive configuration
information. When unexpected characters are inserted into some fields in
web mail forms, the form generates an error. The error page returned may
contain the directory to the web root on the Emumail server.

8. EmuMail Email Form Script Injection Vulnerability
BugTraq ID: 5824
Remote: Yes
Date Published: Sep 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5824
Summary:

Emumail is an open source web mail application. It is available for the
Unix, Linux, and Microsoft Windows operating systems.

A problem with EmuMail could make it possible for a user to execute
arbitrary script code.

It has been reported that EmuMail does not properly sanitize input.
Under some conditions, it is possible to pass an email containing script
or html code through the EmuMail web mail interface. This would result in
execution of the script code in the security context of the EmuMail site.

This could allow an attacker to potentially steal cookie information.

9. Eric S. Raymond Fetchmail Email Header Parsing Buffer Overflow Vulnerability
BugTraq ID: 5825
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5825
Summary:

Fetchmail is a freely available, open source mail retrieval utility. It is
maintained by Eric S. Raymond.

A buffer overflow vulnerability has been reported for Fetchmail 6.0.0 and
earlier. Reportedly, this vulnerability is due to improper checks of
user-supplied values for email headers. The vulnerability occurs in the
readheaders() function which is used to parse email headers.

Fetchmail does not properly check the size of some user-specified data
when copying information into stack buffers. Reportedly, the function,
nxtaddr() limits the size of user-supplied data to BUFSIZ bytes. BUFSIZ is
usually defined to be 1024 bytes. Some systems running glibc, however,
define BUFSIZ to be 8192 bytes. Thus a remote attacker is able to trigger
the overflow condition, by composing an email consisting of overly large
email headers, and cause Fetchmail to improperly allocate space on the
system stack.

It is believed that an attacker could potentially exploit this condition
to overwrite stack variables with malicious attacker-supplied values. It
is possible that exploitation could result in execution of malicious
attacker-supplied code as the Fetchmail process.

This vulnerability has been reported for Fetchmail 6.0.0 and earlier.

10. Eric S. Raymond Fetchmail Multidrop Mode Denial Of Service Vulnerability
BugTraq ID: 5826
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5826
Summary:

Fetchmail is a freely available, open source mail retrieval utility. It is
maintained by Eric S. Raymond.

A denial of service vulnerability has been reported for Fetchmail 6.0.0
and earlier. The vulnerability is due to improper boundary checks when
processing email headers. Specifically, the vulnerability occurs when
Fetchmail is in multidrop mode and attempts to obtain DNS information
through the getmxrecord() function.

A remote attacker is able to exploit this vulnerability by sending a
large, specially crafted DNS packet to a vulnerable version of Fetchmail.
This may be possible if the attacker controls a malicious DNS server or is
able to forge DNS replies. This will cause Fetchmail to crash when
processing the malformed packet.

This vulnerability has been reported for Fetchmail 6.0.0.

11. Sendmail SMRSH Double Pipe Access Validation Vulnerability
BugTraq ID: 5845
Remote: No
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5845
Summary:

Sendmail is a freely available, open source mail transport agent. It is
maintained and distributed by the Sendmail Consortium. Sendmail is
available for the Unix and Linux operating systems.

A problem with Sendmail Restricted Shell could allow a user unauthorized
commands.

smrsh is designed to prevent the execution of commands outside of the
restricted environment. However, when commands are entered using either
double pipes (||) or a mixture of dot (.) and slash (/) characters, a user
may be able to bypass the checks performed by smrsh. This could lead to
the execution of commands outside of the restricted environment.

This problem could lead to an attacker escaping from an environment
restricted by smrsh. Any commands executed would be in the security
context of the user's id. A user could gain unrestricted access to the
system with the privileges of the current user id.

12. Eric S. Raymond Fetchmail Multidrop Mode Email Header Parsing Heap Overflow Vulnerability
BugTraq ID: 5827
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5827
Summary:

Fetchmail is a freely available, open source mail retrieval utility. It is
maintained by Eric S. Raymond.

A remotely exploitable heap overflow vulnerability has been reported for
Fetchmail 6.0.0 and earlier. The vulnerability occurs in the
parse_received() function which is used to parse the 'Received:' email
headers. This vulnerability affects Fetchmail in multidrop mode and will
cause Fetchmail to corrupt heap memory with attacker-supplied values.

Reportedly, certain parts of the 'Received:' header get copied into memory
buffers without any checks being performed. An attacker can exploit this
vulnerability by composing an email that includes a specially crafted
'Received:' header and sending this email to a victim Fetchmail user. When
Fetchmail processes the malicious email, the overflow condition will be
triggered and memory in the heap will be corrupted.

An attacker may exploit this condition to overwrite arbitrary words in
memory. This may allow for the execution of arbitrary code.

This vulnerability has been reported for Fetchmail 6.0.0 and earlier.

13. Monkey HTTP Server Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 5829
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5829
Summary:

Monkey is an open source Web server written in C, based on the HTTP/1.1
protocol. It is available for the Linux platform.

It has been reported that Monkey HTTP server is prone to cross site
scripting vulnerabilities.

An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link. Attacker-supplied HTML and script code may be
executed on a web client visiting the malicious link in the context of the
webserver.

Attacks of this nature may make it possible for attackers to manipulate
web content or to steal cookie-based authentication credentials. It may be
possible to take arbitrary actions as the victim user.

14. GNU Tar Hostile Destination Path Variant Vulnerability
BugTraq ID: 5834
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5834
Summary:

GNU Tar 1.13.25 contains a vulnerability in the handling of pathnames for
archived files.

By specifying a path for an archived item which points outside the
expected directory scope, the creator of the archive can cause the file to
be extracted to arbitrary locations on the filesystem - including paths
containing system binaries and other sensitive or confidential
information.

Since tar can override umask settings, the output file can be rendered
executable.

This can be used to create or overwrite binaries in any desired location.
Properly exploited, this grants the archive creator an elevation of
privileges, potentially to 'root'.

This issue is a variant of the vulnerability described in BID 3024. It is
not known whether earlier versions are also affected by this variant.

15. Bugzilla Group Creation With Elevated Privileges Vulnerability
BugTraq ID: 5843
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5843
Summary:

Bugzilla is a freely available, open source bug tracking software package.
It is available for Linux, Unix, and Microsoft Operating Systems.

A vulnerability has been reported for Bugzilla. This vulnerability affects
sites that use the 'usebuggroups' feature of Bugzilla. This feature, when
enabled, allows sites to track bugs based on products and allows site
administrators to restrict access to bugs on a per-product basis. The
'editgroups.cgi' page will show a listing of all current groups.

The vulnerability is the result of improper mathematical calculations done
when a site has 47, or more, bug groups. When a new product is added to a
site that has 47, or more, bug groups, the new group will be created with
extra privileges set. Any new users that are added to this group will
automatically gain access to other group privileges.

An attacker can exploit this vulnerability to obtain access to a
privileged group and perform actions pertaining to that group.

Site administrators may be able to find groups with extra privileges by
viewing the 'editgroups.cgi' page and looking for 'bit' values that end in
'0'. A large value such as, '4503599627370480', is indicative of an error
in large integer math. Administrators may be able to change the group bit
values and check permissions of users belonging to the offending groups.

This vulnerability affects Mozilla Bugzilla 2.14.3 and earlier and
Bugzilla 2.16 and earlier.

16. BEA WebLogic Server and Express Inadvertent Security Removal Weakness
BugTraq ID: 5846
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5846
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

Under some circumstances, BEA WebLogic Server and Express are prone to a
weakness which may inadvertently cause security constraints to be removed.

This issue occurs when applications containing Servlets or EJBs are
deployed on multiple servers. When such an application is undeployed from
one server, the specified security constraints and role mappings for
Servlets or EJBs will be removed on all servers. The consequence of this
weakness is that all Servlets or EJBs will be left exposed.

Applications will be undeployed when a server shuts down or when the
application is untargetted from the server. This issue is present during
the time period when an appropriate application has been undeployed. The
application may be re-deployed when the server is restarted or when it is
targetted on another server.

17. Trolltech Qt Assistant Default Port Unauthorized Access Weakness
BugTraq ID: 5833
Remote: Yes
Date Published: Sep 30 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5833
Summary:

Qt is a C++ toolkit for application development. It is designed for use
with various platforms including Linux and Unix variants as well as
Microsoft Windows operating environments.

A weakness has been reported for the Qt Assistant. The Qt Assistant is a
browser for the Qt documentation and is typically used in conjuntion with
Qt Designer. Reportedly, the Qt Assistant opens port 7358 for
communication with Qt Designer. This port, however, can be accessed
remotely.

An attacker can exploit this weakness by connecting to a vulnerable system
on port 7358 and making requests for HTML pages. The requests will be
processed by the Qt Assistant and will be displayed on the screen of the
user that is currently using the Assistant.

Numerous simultaneous requests may cause the Qt Assistant from responding
to legitimate requests in a timely manner.

18. GV GZip Archive Malicious File Name Command Execution Vulnerability
BugTraq ID: 5840
Remote: No
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5840
Summary:

gv is a freely available, open source Portable Document Format (PDF) and
PostScript (PS) viewing utility. It is available for Unix and Linux
operating systems.

A problem with gv could make the execution of arbitrary commands possible.

Under some circumstances, gv does not properly handle file names. When a
PostScript (PS) or Portable Document Format (PDF) file contained within a
compressed archive such as a gzip archive is opened with gv, command
execution may occur. A file name containing special characters such as
backticks (`), quotes ("), and ampersands (&) will be interpretted as
commands, and executed by gv.

This problem could make the execution of arbitrary commands possible.
Any commands executed through gv would be executed with the permissions of
the gv user.

19. Bugzilla Bugzilla_Email_Append.pl Arbitrary Command Execution Vulnerability
BugTraq ID: 5844
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5844
Summary:

Bugzilla is a freely available, open source bug tracking software package.
It is available for Linux, Unix, and Microsoft Operating Systems.

A problem with Bugzilla could make it possible to execute arbitrary
commands.

Under some circumstances, it may be possible to execute arbitrary commands
on a Bugzilla server. A user may be able to insert maliciously formatted
entries into the Bugzilla database that would be handled by the
bugzilla_email_append.pl script. A maliciously formatted entry passed to
this script could result in the execution of arbitrary commands.

This problem could allow a remote user to execute arbitrary code on a
Bugzilla server. This could lead to a remote attacker gaining access to
the system with the privileges of the web server process.

20. Bugzilla Account Creation SQL Injection Vulnerability
BugTraq ID: 5842
Remote: Yes
Date Published: Oct 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5842
Summary:

Bugzilla is a freely available, open source bug tracking software package.
It is available for Linux, Unix, and Microsoft Operating Systems.

Bugzilla is prone to SQL injection attacks. This issue is due to
insufficient sanitization of apostrophes (') from e-mail addresses during
account creation. Maliciously formatted SQL injected via the e-mail
address field will be included in a SQL query.

An attacker could exploit this condition to modify the logic of SQL
queries, potentially resulting in disclosure of sensitive information or
database corruption. SQL injection may also enable a remote attacker to
exploit other existing vulnerabilities in the underlying datbase
implementation.

21. SafeTP Passive Mode Internal IP Address Revealing Vulnerability
BugTraq ID: 5822
Remote: Yes
Date Published: Sep 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5822
Summary:

SafeTP is a freely available, open source secure ftp client-server
software package. It is available for Unix, Linux, and Microsoft
Operating Systems.

A problem with SafeTP may result in the disclosure of sensitive
information.

It has been reported that under some circumstances, the SafeTP server may
reveal sensitive network information. When a passive session is initiated
in a specific manner, SafeTP may return the address of a system serving
files that is behind at NAT firewall.

This disclosure of information could give an attacker limited information
about network configuration behind a NAT firewall. It could be used to
launch further, directed attacks against network resources.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. VPN Choices for RedHat 7.3 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/293950

2. openssl (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/293850

IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. nPatrol
by nSecure Software
Platforms: Linux
Relevant URL:
http://www.realtime-spy.com/
Summary:

nPatrol is an adaptive Intrusion Detection System designed not only to
protect systems from known vulnerabilities, but also from new modes of
attack. It helps in addressing the business risks and coping with rapid
changes within an organization. nPatrol strengths include detection of
intrusuins using multiple techniques.

2. SysOrb
by Evalesco Systems ApS
Platforms: FreeBSD, HP-UX, Linux, Netware, Solaris, SunOS, Windows 2000,
Windows NT
Relevant URL:
http://www.nsecure.net/features.htm
Summary:

SysOrb is the leading network monitoring system giving you the best
price/performance ratio in the industry. No other system provides a
similar combination of advanced monitoring technology, security,
scalability and flexibility.

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. ratemask v1.0.0
by Oskar Andreasson
Relevant URL:
http://www.frozentux.net/ratemask/
Platforms: Linux, POSIX
Summary:

ratemask is a small program that will make it easier to create ICMP type
masks, as used in the icmp_ratemask sysctl, viewable through the /proc
filesystem.

2. EPS v1.2
by Volatile
Relevant URL:
http://www.inter7.com/eps/
Platforms: POSIX
Summary:

EPS (Email Processing System) is a set of API for parsing email messages.
It is fast, thread-safe, understands content types and MIME, and has been
extensively tested. It features re-entry routines to cut down on memory
allocation and de-allocation.

3. Graphical certification authority v0.2.6
by chris
Relevant URL:
http://www.hohnstaedt.de/xca.html
Platforms: Linux, POSIX
Summary:

Graphical certification authority is an interface for managing RSA keys
and certificates, and the creation and signing of PKCS#10 requests. It
uses the OpenSSL library and a Berkeley DB for key and certificate
storage. It supports importing and exporting keys and PEM DER PKCS8
certificates, signing and revoking of PEM DER PKCS12, and the selection of
x509v3 extensions. A tree view of certificates is presented.

VI. SPONSORSHIP INFORMATION
---------------------------
This Issue is Sponsored By: Qualys

Bulletproof Your Network: FREE Guide

Visit us at: https://www.qualys.com/forms/guide_220.php

-------------------------------------------------------------------------------