SecurityFocus Linux Newsletter #79

SecurityFocus Linux Newsletter #79
----------------------------------
This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml

-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. VBA Emulation: A Viable Method of Macro Virus Detection? Part Two
     2. Restricting UNIX Users
     3. No Stone Unturned, Part Three
II. LINUX VULNERABILITY SUMMARY
     1. PHP-Survey Global.INC Information Disclosure Vulnerability
     2. Sudo Password Prompt Heap Overflow Vulnerability
     3. PHPProjekt Login Bypass Vulnerability
     4. PH PProjekt SQL Injection Vulnerability
     5. Ultimate PHP Board Encrypted Password Disclosure Vulnerability
     6. Ultimate PHP Board Image Tag Script Injection Vulnerability
     7. Qualcomm QPopper Bulletin Name Buffer Overflow Vulnerability
     8. CIDER Shadow Analyzer Remote Command Execution Vulnerability
     9. AutoLog IP Spoofing Vulnerability
     10. Solaris LBXProxy Display Name Buffer Overflow Vulnerability
     11. Netscape/Mozilla IRC Buffer Overflow Vulnerability
     12. Netscape/Mozilla/Galeon Local File Detection Vulnerability
     13. BEA Systems WebLogic Server URL Parsing Path Disclosure...
     14. BEA Systems WebLogic Server Null Character DOS Device Denial...
     15. PHPProjekt File Read Vulnerability
     16. Blahz-DNS Direct Script Call Authentication Bypass Vulnerability
     17. PHPProjekt Unauthorized Script Access Vulnerability
     18. Ultimate PHP Board Private Message Disclosure Vulnerability
     19. ACME Labs thttpd Cross-Site Scripting Vulnerability
     20. RedHat DocBook Tools Default Stylesheet Arbitrary File Write...
     21. BEA Systems WebLogic Server URL Parsing Source Code Disclosure...
     22. MyGuestbook Script Injection Vulnerability
     23. DNSTools Authentication Bypass Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. AW: entry in /etc/passwd (Thread)
     2. Trimming replies (Thread)
     3. entry in /etc/passwd (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Dragon IDS
     2. suGAURD
     3. VFind Security Toolkit
V. NEW TOOLS FOR LINUX PLATFORMS
     1. Astaro Security Linux (ASL) v3.052(beta)
     2. pam_hbci v1.0a
     3. Linux Security Auditing Tool v0.5.0
     4. Secure FTP Wrapper v2.1.1
     5. Gringotts v0.4.4
VI. SPONSORSHIP INFORMATION





I. FRONT AND CENTER
-------------------
1. VBA Emulation: A Viable Method of Macro Virus Detection? Part Two
By Gabor Szappanos

This is the second of two articles discussing emulation as a viable method
of virus detection. In this article, we will discuss code execution flow,
underlying operating system problems, and incompatibility issues with
incompatibility in different versions of Office, as well as VBA emulator
environment.

http://online.securityfocus.com/infocus/1576

2. Restricting UNIX Users
by Anton Chuvakin, Ph.D.

Stories of cruel system administrators oppressing poor users have been
around since the rise of UNIX in the 1970s. Users are inherently limited
in what they can do on a UNIX system due to file permissions, passwords
and other standard UNIX controls. However, it is often necessary to
further restrict system users in other ways, both to protect them from
themselves and to protect the system from the malicious or overly
"playful" users. This article will discuss ways in which security
administrators can limit what users are able to do on a UNIX system, with
a particular focus on Linux. Both local and remote users will be
considered. However, restricting root users from doing things on the
system (while possible) is a somewhat different story and will not be
addressed in detail here.

http://online.securityfocus.com/infocus/1575

3. No Stone Unturned, Part Three
by H. Carvey

This is the third installment of a five-part series describing the
(mis)adventures of a sysadmin named Eliot and his haphazard journey in
discovering “The Way” of Incident Response. As we left off last time,
Eliot had just begun compiling a list of tools that would be helpful in
incident investigation when he was interrupted by a call from Dave, a sys
admin with a branch office on the West Coast. Dave had asked for Eliot's
assistance with an apparent incident. Now, having begun an investigation,
Eliot was baffled and had asked Dave for some clarifying information.

http://online.securityfocus.com/infocus/1574


II. BUGTRAQ SUMMARY
-------------------
1. PHP-Survey Global.INC Information Disclosure Vulnerability
BugTraq ID: 4612
Remote: Yes
Date Published: Apr 26 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4612
Summary:

PHP-Survey is a web-based survey engine.  It is written in PHP and will
run on most Unix and Linux variants.  It is back-ended by a MySQL
database.

PHP-Survey comes with a script entitled 'global.inc', which contains
configuration information such as the name of the local host, database
credentials, and credentials for the survey administrator.  This file is
not interpreted as a PHP script if requested via HTTP, allowing remote
attackers to trivially gain access to the sensitive information contained
in 'global.inc'.

2. Sudo Password Prompt Heap Overflow Vulnerability
BugTraq ID: 4593
Remote: No
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4593
Summary:

Sudo is a widely used Linux/Unix utility that allow users to securely run
commands as other users.  Sudo is vulnerable to a heap overflow condition
related to it's customizable password prompt feature.

Sudo allows for users to have sudo generate a custom password prompt.
This prompt is supplied to sudo as an argument to the '-p' command-line
option.  Symbols for the system hostname and the username, '%h' and '%u',
can be placed in the prompt.  They will be expanded to their actual values
when the prompt is output.

When the string is constructed for output, memory is allocated to store it
using malloc().  Sudo suffers from a subtle flaw in calculating the amount
of memory required for a prompt that contains expanded hostname and
username tokens.  Under some conditions, less memory may be allocated than
is actually required.  If this occurs, the fully expanded prompt will be
written beyond the end of the allocated buffer.  This may result in
exploitable conditions, depending on the implementation of malloc().
Linux is confirmed vulnerable.

It is required that sudo be installed setuid root.  Successful
exploitation may allow for local attackers to gain root privileges.

3. PHPProjekt Login Bypass Vulnerability
BugTraq ID: 4596
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4596
Summary:

PHPProjekt is a freely available, open source PHP Groupware package. It is
actively maintained by the PHPProjekt Development Team. It will run on
most Linux and Unix variants, in addition to Microsoft Windows operating
systems.

Some of the PHPProjekt scripts are only intended to be accessed by users
who have been authenticated.  However, it has been reported that it is
possible for an unauthenticated attacker to access these scripts via a
specially crafted web request.

To validate that an authenticated user is accessing a script, the
$PHP_SELF variable is checked for the presence of certain strings(such as
'sms').  The $PHP_SELF variable is derived from the PATH_INFO variable.
It is trivial for an attacker to craft a web request which contains the
strings that PHPProjekt is looking for.  This will enable the attacker to
access the PHPProjekt scripts that ordinarily may only be accessed by an
authenticated user.

4. PHPProjekt SQL Injection Vulnerability
BugTraq ID: 4598
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4598
Summary:

PHPProjekt is a freely available, open source PHP Groupware package. It is
actively maintained by the PHPProjekt Development Team. It will run on
most Linux and Unix variants, in addition to Microsoft Windows operating
systems.

PHPProjekt does not properly sanitize user-supplied data before it is
passed into SQL queries.  This occurs in a number of places throughout
PHPProjekt.  This makes it possible for attackers to launch SQL injection
attacks.  For example, an attacker may be able to modify the logic of an
existing SQL query.

Exploitation of this issue may cause sensitive information contained in
the database to be disclosed.  The attacker may also potentially modify
data.  It is also possible that this issue may be leveraged to exploit
existing vulnerabilities in the underlying database.

5. Ultimate PHP Board Encrypted Password Disclosure Vulnerability
BugTraq ID: 4602
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4602
Summary:

Ultimate PHP Board (UPB) is web forum software.  It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

Encrypted UPB user passwords are included in files which may be accessible
to a malicious user.  Encrypted user passwords are stored by UPB under the
user ID of each registered member.  The user files have an extension of
".xbb".  A malicious user may make a web request for the file containing
the encrypted password of a particular user.

The malicious user may construct a cookie using the encrypted password of
a registered UPB user and gain access to their account.  UPB cookie data
is constructed using the following format:

ID + 'þ' + 'Xb' + 'encrypted user password'

For example, the cookie data for user ID 5 with an encrypted password of
'OhJmLwt' would be:

'5þXbOhJmLwt'

6. Ultimate PHP Board Image Tag Script Injection Vulnerability
BugTraq ID: 4603
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4603
Summary:

Ultimate PHP Board (UPB) is web forum software.  It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

Ultimate PHP Board including a feature called UPB-Code, which allows users
to control the format of their messages using special formatting tags.
The [IMG] tag allows users to embed images inside of forum messages.

UPB does not filter HTML from image tags.  This may allow an attacker to
inject arbitrary script code in forum messages.  Injected script code will
be executed in the browser of an arbitrary web user who views the
malicious forum message, in the context of the website running UPB.

This may be potentially be exploited to hijack web content or steal
cookie-based authentication credentials from legitimate users.

It may be possible to inject script code into other UPB-Code formatting
tags, though this has not been confirmed.

7. Qualcomm QPopper Bulletin Name Buffer Overflow Vulnerability
BugTraq ID: 4614
Remote: No
Date Published: Apr 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4614
Summary:

QPopper is a freely available, open source software package distributed by
Qualcomm.  It is designed for use on various operating systems, although
this problem affects the Unix and Linux platforms.

A problem with the software may allow a local user to execute code.  The
problem is in the handling of bulletins.

QPopper does not sufficiently check bounds on some data.  When a user
supplies a bulletin with a long name (greater than 256 bytes), a buffer
overflow occurs.  This could result in the overwriting of process memory,
including the return address within the stack, and code execution.

This problem makes it possible for a local user to execute arbitrary
commands with the privileges of the QPopper process.  Typically, this
process is started by root, which would therefore allow execution of code
with root privileges.

It should be noted that QPopper servers that do not process a users
.qpopper-options file are not vulnerable to this problem.

8. CIDER Shadow Analyzer Remote Command Execution Vulnerability
BugTraq ID: 4625
Remote: Yes
Date Published: Apr 29 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4625
Summary:

CIDER (Cooperative Intrusion Detection Evaluation and Response) Shadow
Analyzer is a component of the Shadow Intrusion Detection System.  It will
run on a number of Linux distributions.  The CIDER Shadow Analyzer
component is intended to be only accessible within the internal network.

The CIDER Shadow Analyzer component provides a web-based interface for the
CIDER Shadow Sensor.  It is possible for attackers within the internal
network to mount remote command executions via this web interface.

The CIDER Shadow Analyzer does not adequately filter shell metacharacters.
As a result, remote attackers may execute commands on the underlying host
with the privileges of the webserver process.

This may enable a remote attacker within the internal network to gain
local access to the host running the vulnerable software.

It is not known whether CIDER Shadow 1.7 is also affected by this issue.

9. AutoLog IP Spoofing Vulnerability
BugTraq ID: 4627
Remote: Yes
Date Published: Apr 29 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4627
Summary:

AutoLog is website usage tracking software.  It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

AutoLog uses cookies to track which users have visited the website it is
running on.

By sending a specially crafted cookie containing an arbitrary IP address,
a remote attacker may cause a false IP to be logged by the script.

An attacker may exploit this issue to conceal the source of malicious web
activity.

10. Solaris LBXProxy Display Name Buffer Overflow Vulnerability
BugTraq ID: 4633
Remote: No
Date Published: Apr 29 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4633
Summary:

Low-Bandwidth X Proxy (lbxproxy) is a server that handles low-bandwidth
connections to X Windows.  It runs on Solaris as well as a number of Unix
and Linux variants.

lbxproxy is prone to a locally exploitable buffer overflow condition.
This is due to insufficient bounds checking of the display name.  Display
is used to specify the port of the X Server to connect to.

By supplying an overly long string as a display name, it is possible to
overwrite stack variables such as the return address.  The attacker may
exploit this condition to cause attacker-supplied instructions to be
executed.

Successful exploitation will enable an attacker to execute arbitrary
attacker-supplied instructions and as a consequence gain elevated
privileges.

lbxproxy on Solaris is installed setgid root, so successful exploitation
may enable the attacker to gain the privileges of the root group.

This issue was reported for lbxproxy on the Sun Solaris operating system.
It is not known whether this is an issue on other operating systems.

11. Netscape/Mozilla IRC Buffer Overflow Vulnerability
BugTraq ID: 4637
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4637
Summary:

Mozilla is a freely available, open-source web browser. It runs on most
Linux and Unix variants, as well as MacOS and Microsoft Windows
9x/ME/NT/2000/XP operating systems.  Netscape is another web-browser
product which runs on the same platforms as Mozilla.

Netscape and Mozilla crash when handling an exceptionally long request
(32KB+) for a channel using the IRC protocol.

An attacker may exploit this issue to crash a web user's browser.  This is
most likely to occur via a hyperlink in a malicious webpage, but may also
occur via HTML e-mail.

This issue is most likely due to a buffer overflow condition, but it is
not known whether this condition may be exploited to execute arbitrary
attacker-supplied instructions.

Other browsers based on the Mozilla codebase (such as Galeon) may also be
affected by this issue.

12. Netscape/Mozilla/Galeon Local File Detection Vulnerability
BugTraq ID: 4640
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4640
Summary:

Mozilla is a freely available, open-source web browser. It runs on most
Linux and Unix variants, as well as MacOS and Microsoft Windows
9x/ME/NT/2000/XP operating systems.  Netscape is another popular
web-browser product which runs on the same platforms as Mozilla.  The
Galeon browser is available for various Linux distributions.

External Cascading Style-Sheets (CSS) may be embedded inside of HTML
files.  This is accomplished using the <LINK> element.  The security model
of the web client is designed to prevent links to other file types and
links to local files on the client's system from remote pages.

It has been demonstrated that it is possible for a webpage to circumvent
this security model by linking to the external file and causing a HTTP
redirect to occur.  This could be exploited to detect the existence of a
file on the local system of the web client viewing the malicious page.

This could lead to a disclosure of sensitive information to remote
attackers.

13. BEA Systems WebLogic Server URL Parsing Path Disclosure Vulnerability
BugTraq ID: 4643
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4643
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

It is possible to cause the server to disclose sensitive path information.
This is due to difficulties parsing certain types of malformed requests,
such as those containing null characters (%00).

Various types of malformed web requests will cause the server to display
an error page containing the absolute path to the webroot directory.  For
example, this may be accomplished by appending a '%00.jsp' string to the
end of a request for a HTML file.  This condition may also occur if the
attacker prepends an encoded backslash (%5c) to the beginning of the
filename for a HTML file.  Other types of malformed web requests may also
cause this condition to occur.

Path information may aid the attacker in making further attacks against
the host.

14. BEA Systems WebLogic Server Null Character DOS Device Denial of Service Vulnerability
BugTraq ID: 4646
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4646
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

It is possible to create a denial of service condition by appending a null
character to a web request for MS-DOS device name (such as AUX).  Each
such malformed request will cause the connection to hang.  After a number
of these requests, the server will not be able to accept any more
connections, as only so many threads can be processed at once.

This condition is in part due to difficulties parsing requests that
contain NULL characters, but is also caused by poor handling of requests
for MS-DOS devices.  BugTraq ID 3816 "BEA Systems WebLogic Server DOS
Device Denial of Service Vulnerability" describes a similar condition,
which was fixed in WebLogic Server 6.1 SP2.  However, the null character
variation of this attack affects systems running WebLogic Server 6.1 SP2.
Other versions may also be affected.

The server must be restarted to regain normal functionality.

15. PHPProjekt File Read Vulnerability
BugTraq ID: 4597
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4597
Summary:

PHPProjekt is a freely available, open source PHP Groupware package. It is
actively maintained by the PHPProjekt Development Team. It will run on
most Linux and Unix variants, in addition to Microsoft Windows operating
systems.

It has been reported that an attacker may trick the PHPProjekt upload
functions into reading local files on the host running the vulnerable
software.

PHPProjekt does not validate that the variables associated with the upload
functions were set by a file upload.  It is possible for an attacker to
set arbitrary values for the upload related variables using normal POST
data.

This may be exploited by the attacker to display the contents of arbitrary
web-readable files.

16. Blahz-DNS Direct Script Call Authentication Bypass Vulnerability
BugTraq ID: 4618
Remote: Yes
Date Published: Apr 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4618
Summary:

Blahz-DNS is a web based management tool for DNS information. It is
implemented in PHP, and available for Linux systems.

A vulnerability has been reported in some versions of Blahz-DNS which
allows any remote attacker to gain administrative access. While
authentication is required to access the scripts through the login page,
no additional checks are performed. An attacker may directly call
additional scripts, bypassing the authentication check altogether.

This may allow an arbitrary attacker to gain full administrative access to
the Blahz-DNS system.

17. PHPProjekt Unauthorized Script Access Vulnerability
BugTraq ID: 4599
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4599
Summary:

PHPProjekt is a freely available, open source PHP Groupware package. It is
actively maintained by the PHPProjekt Development Team. It will run on
most Linux and Unix variants, in addition to Microsoft Windows operating
systems.

Some of the PHPProjekt scripts are only intended to be accessed by users
who have been authenticated.  Attackers may submit data using the HTTP
POST method to view or edit data contained in scripts that normally
require authentication to be accessed.  Data submitted in this manner must
be properly formatted.

This is due to insufficient validation of the source of data that is
submitted to PHPProjekt.

18. Ultimate PHP Board Private Message Disclosure Vulnerability
BugTraq ID: 4600
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4600
Summary:

Ultimate PHP Board (UPB) is web forum software.  It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

UPB includes a private messaging system.  Private messages are stored by
UPB under the user ID of each registered member.  Private message files
have an extension of ".pm".  UPB does not sufficiently validate which user
is attempting to access a given private message file.  As a result,
malicious users may request the private message file of a particular user
and read that user's private messages.

Information gathered in this manner may aid the attacker in making social
engineering attacks against UPB users.

19. ACME Labs thttpd Cross-Site Scripting Vulnerability
BugTraq ID: 4601
Remote: Yes
Date Published: Apr 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4601
Summary:

thttpd is a web server product maintained by ACME Labs. thttpd has been
compiled for Linux, BSD and Solaris, as well as other Unix like operating
systems.

It is possible for attackers to construct urls that will cause scripting
code to be embedded in error pages.

thttpd fails to check URLs for the presence of script commands when
generating error pages, allowing attacker supplied code to execute. As a
result, when an innocent user follows such a link, the script code will
execute within the context of the hosted site.

Successful exploitation of this vulnerability could enable an attacker to
execute code in the security context of a trusted site. In addition, this
issue could allow an attacker to access the trusted site's cookies,
possibly aiding in other web-based attacks.

It should be noted that this issue was tested on 2.20b, other versions may
also be affected by this issue.

20. RedHat DocBook Tools Default Stylesheet Arbitrary File Write Vulnerability
BugTraq ID: 4654
Remote: No
Date Published: May 01 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4654
Summary:

Red Hat Linux includes a collection of tools for working with the DocBook
format, an XML specification for book content. An issue has been reported
in the default stylesheet included with these tools.

When converting a DocBook file to multiple HTML files, element identifiers
included within the DocBook file are used to construct file names. It is
possible for these elements to include full paths, which may result in
arbitrary files being overwritten.

This vulnerability may be exploited if a local user attempts to convert an
unsafe DocBook file to a collection of HTML files. File access will be
determined by the privileges of the user converting the file.

21. BEA Systems WebLogic Server URL Parsing Source Code Disclosure Vulnerability
BugTraq ID: 4645
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4645
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

It is possible to cause the server to disclose JSP script source code.
This is due to difficulties parsing certain types of malformed requests,
such as those containing null characters (%00).

Disclosure of script source code may aid allow the attacker to probe for
other vulnerabilities or may disclose sensitive information such as
database credentials.

Various types of malformed web requests will cause the server to disclose
JSP script source code.  For example, this may be accomplished by
appending a '%00x' to a request for an existing JSP script.  An attacker
could also append a '+.' string to the end of a request to disclose script
source code.  Other types of malformed web requests may also cause this
condition to occur.

22. MyGuestbook Script Injection Vulnerability
BugTraq ID: 4651
Remote: Yes
Date Published: Apr 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4651
Summary:

MyGuestbook is freely available guestbook software.  It will run on most
Unix and Linux variants, as well as Microsoft Windows operating systems.

MyGuestbook does not adequately filter HTML tags from various fields.
This may enable an attacker to inject arbitrary script code into pages
that are generated by the guestbook.

The attacker's script code may be executed in the web client of arbitrary
users who view the pages generated by the guestbook, in the security
context of the website running the software.

Attackers may potentially exploit this issue to hijack web content or to
steal cookie-based authentication credentials.

23. DNSTools Authentication Bypass Vulnerability
BugTraq ID: 4617
Remote: Yes
Date Published: Apr 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4617
Summary:

DNSTools is a web based managment tool for DNS information. It is
implemented in PHP, and available for Linux and Solaris.

A vulnerability has been reported in some versions of DNSTools which
allows any remote attacker to gain administrative access.

Access rights are controlled through the use of the variables
user_logged_in and user_dnstools_administrator. Reportedly, these
variables are not properly initialized, allowing an attacker to
artificially construct a URL setting them to arbitrary values. This allows
the attacker to bypass access control measures, gaining administrative
access to the system.

Administrative access will allow an attacker to freely modify host names,
DNS servers and domain data.

Earlier versions of DNSTools may share this vulnerability. This has not,
however, been confirmed.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. AW: entry in /etc/passwd (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

2. Trimming replies (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

3. entry in /etc/passwd (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/Pine.GSO.4.44.0205011631280.9349-100000@ismene


IV.NEW PRODUCTS FOR LINUX PLATFORMS
-----------------------------------
1. Dragon IDS
by Enterasys Networks
Platforms: FreeBSD, Linux, OpenBSD, Solaris
Relevant URL:
http://www.enterasys.com/ids/dragonids.html
Summary:

The Dragon IDS draws from three types of detected suspicious activity.
First, Enterasys Networks maintains an extremely large database of known
hacker techniques. These techniques have corresponding 'signatures' that
are programmed into the Dragon network and host agents. Examples of hacker
techniques include denial of service attacks and buffer overflows. Second,
Dragon network and host agents are programmed to search for anomalies that
are likely hacker attacks. These anomalies are less exact than a perfect
match of a hacker technique, but are still highly effective for detection
of port scans, distributed network probes, new forms of buffer overflows
and denial of service attacks. And thirdly, all Dragon agents can detect
security policy deviations. These policy deviations include detection of
unauthorized network services, applications running on unusual ports and
logs from network sessions denied by firewalls.

2. suGAURD
by DataLynxInc.
Platforms: AIX, DG-UX, HP-UX, IRIX, Linux, SCO, Solaris, SunOS
Relevant URL:
http://www.dli-security.com/suguard.htm
Summary:

suGUARD allows the system manager to create a sophisticated hierarchical
management structure for systems and application software. This security
package works by defining a profile that specifies the requirements (UID,
GID, security level, access location, time-of-day, etc.) needed to run any
program or script, without the user needing to know those oh-so-sensitive
passwords. suGUARD validates and logs all command access attempts, alerts
the system manager about unauthorized usage, and detailed utilization
reports.

3. VFind Security Toolkit
by Cybersoft
Platforms: AIX, DG-UX, HP-UX, IRIX, Linux, SCO, Solaris, SunOS, True64
UNIX, UNIX, Unixware, Windows 95/98, Windows NT
Relevant URL:
http://www.cyber.com/products/vfind/info/
Summary:

The VFind Security ToolKit is a suite of four powerful network and
computer security utilities that provide flexible and uncompromising
protection. The VFind Security ToolKit boasts the worlds first UNIX virus
scanner and a unique heterogeneous design that allows for complete
protection, even in today's multi-platform networks. The object-oriented
design of the VFind Security ToolKit offers an unsurpassed level of
flexibility and power that is easily integrated with your operating system
and even with other applications.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Astaro Security Linux (ASL) v3.052(beta)
by Astaro AG, [email protected]
Relevant URL:
http://www.astaro.com/products/download.html
Platforms: Linux
Summary:

Astaro Security Linux is a new firewall solution. It does stateful
inspection, packet filtering, content filtering, virus scanning, VPN with
IPSec, and much more. With its Web-based management tool and the ability
to pull updates over the Internet, it it is pretty easy to manage. It is
based on a special hardened Linux 2.4 distribution where most daemons are
running in change-roots and are protected by capabilities.

2. pam_hbci v1.0a
by Stefan Palme
Relevant URL:
http://online.securityfocus.com/tools/2634
Platforms: Linux, POSIX
Summary:

pam_hbci is a PAM module for Linux that enables you to use your HBCI
chip-card to identify or authenticate you. HBCI is a German standard for
home banking over TCP/IP. The module contains many options and supports
all chip-card terminals with a working CTAPI interface.

3. Linux Security Auditing Tool v0.5.0
by Triode
Relevant URL:
http://www.dimlight.org/~number9/lsat/
Platforms: Linux, POSIX
Summary:

Linux Security Auditing Tool (LSAT) is a post install security auditing
tool. It is modular in design, so new features can be added quickly. It
checks inetd entries and scans for unneeded RPM packages. It is being
expanded to work with Linux distributions other than Red Hat, and checks
for kernel versions.

4. Secure FTP Wrapper v2.1.1
by Glub Tech, Inc.
Relevant URL:
https://www.glub.com/store/export.jsp?product_id=ftpswrap_2_0
Platforms: Java
Summary:

Secure FTP Wrapper is a server-based package that enables an existing FTP
server to become a Secure FTP server. In this release the wrapper allows
for a Secure Sockets Layer, or SSL, connection to be made to your FTP
server.

5. Gringotts v0.4.4
by Germano Rizzo
Relevant URL:
http://devel.pluto.linux.it/projects/Gringotts/
Platforms: Linux, POSIX
Summary:

Gringotts is a small utility that allows you to jot down sensitive data
(passwords, credit card numbers, PINs, etc.) in an easy-to-read,
easy-to-access, and most of all very secure form. Gringotts makes use of
the MCrypt and MHash libraries for encryption, and uses GTK+ 2 for the
user interface.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml

-------------------------------------------------------------------------------