SecurityFocus Linux Newsletter #140

John Boletta <[email protected]> Mon, 14 Jul 2003 11:42:41 -0600 (MDT)

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #140
-----------------------------------

This Issue is Sponsored by: KaVoDo

Your network Firewall and IDS products do not prevent Web application
exploits - the most common form of online attack - resulting in Web
defacement, data theft, sabotage and fraud.

KaVaDo is the first and only company that provides a complete and an
integrated suite of Web application security products, allowing you to
assess your entire environment, automatically set positive security
policies and maintain it without compromising business performance.

For more information on KaVaDo and to download a FREE white paper on Web
applications - security policy automation, please visit
http://www.securityfocus.com/Kavado-linux-secnews2
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Linux Firewall-related /proc Entries
2. The Persistence of Hoax
3. U.S. Information Security Law, Part Four
4. The SecurityFocus 4th Anniversary Contest
II. LINUX VULNERABILITY SUMMARY
1. Teapop SQL Injection Vulnerability
2. ZKFingerD Multiple Format String Vulnerabilities
3. SEMI/WEMI Insecure Temporary File Creation Vulnerability
4. CCBill WhereAmI.CGI Remote Arbitrary Command Execution...
5. Tower Toppler HOME Environment Variable Local Buffer Overflow...
6. Knoppix QT Insecure Temporary File Creation Vulnerability
7. GNU Chess Local Buffer Overflow Vulnerability
8. X-Face-EL Insecure Temporary File Creation Vulnerability
9. IglooFTP PRO Multiple Buffer Overflow Vulnerabilities
10. Macromedia ColdFusion MX Remote Development Service File...
11. Macromedia ColdFusion MX Remote Development Service Default...
12. TerminatorX XLocaleDIR Environment Variable Buffer Overflow...
13. GKrellM Mailwatch Plugin From Header Remote Buffer Overflow...
14. MyServer Malformed URI Denial Of Service Vulnerability
15. Apache Web Server Type-Map Recursive Loop Denial Of Service...
16. CPanel Admin Interface HTML Injection Vulnerability
17. UnrealIRCD OperServ Raw Join Denial Of Service Vulnerability
18. Apache Web Server FTP Proxy IPV6 Denial Of Service Vulnerability
19. Macromedia Apache Web Server Encoded Space Source Disclosure...
20. Anope Services OperServ Raw Join Denial Of Service Vulnerability
21. Apache Web Server Prefork MPM Denial Of Service Vulnerability
22. SKK/DDSKK Insecure Temporary Files Vulnerability
23. XBlockOut XBL Display Local Buffer Overrun Vulnerability
24. TerminatorX Home Environment Variable Buffer Overflow...
III. LINUX FOCUS LIST SUMMARY
1. Stealthy Linux Key Logger (Thread)
2. LIDS on production server anyone?? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. NetOp Remote Control
2. StoneGate High Availability Firewall
3. WatchGuard SOHO 2.2
V. NEW TOOLS FOR LINUX PLATFORMS
1. pkdump v0.96.1
2. Quick Spam Filter v0.7.4
3. pam_dotfile v0.5
VI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Linux Firewall-related /proc Entries
By Brian Hatch

This article will discuss Linux kernel variables and the effect they have
on network security for your host or firewall. These variables determine
the handling of network packets and are independent of any kernel
filtering rules.

http://www.securityfocus.com/infocus/1711

2. The Persistence of Hoax
By George Smith

Vmyths.com is fading into the sunset, while the virus hoaxes it
steadfastly
debunked seem to live on forever.

http://www.securityfocus.com/columnists/172

3. U.S. Information Security
Law, Part Four By Steven
Robinson

This is the last article in a four-part series looking at U.S. information
security laws and the way those laws affect the work of security
professionals. This installment continues the discussion of information
security in the public sector and provides an overview of national
security law in the United States as it pertains to information security.

http://www.securityfocus.com/infocus/1710

4. The SecurityFocus 4th Anniversary Contest

Only three days left to win a pair of passes to the Black Hat Briefings.
Be sure to take a few minutes out of your day to enter the contest.

Please visit the contest page here:
http://www.securityfocus.com/contest

II. BUGTRAQ SUMMARY
-------------------
1. Teapop SQL Injection Vulnerability
BugTraq ID: 8146
Remote: Yes
Date Published: Jul 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8146
Summary:

teapop is a POP3 server implementation for Unix and Linux variants.

teapop is prone to an SQL injection vulnerability. This issue occurs in
modules supplied with Teapop that allow authentication via a MySQL or
PostgreSQL database. These modules do not sufficiently sanitize
user-supplied input before it is included in database queries.
Exploitation could allow for SQL queries to be modified, potentially
allowing for unauthorized access, information disclosure or other
consequences. This would occur in the context of the teapop database
user.

2. ZKFingerD Multiple Format String Vulnerabilities
BugTraq ID: 8142
Remote: Yes
Date Published: Jul 08 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8142
Summary:

zkfingerd is a freely available, open source implementation of the RFC1288
protocol. It is available for the Unix and Linux operating systems.

A problem in zkfingerd may make it possible for a remote user to launch a
format string attack against the daemon. This may result in an attacker
gaining unauthorized access to system resources.

The problem is in the 'die.c' source file. Two instances of format string
vulnerabilities exist in the file that may allow an attacker to write to
arbitrary process memory and potentially execute code. Any code executed
through this vulnerability could potentially be carried out with the
privileges of the zkfingerd process.

3. SEMI/WEMI Insecure Temporary File Creation Vulnerability
BugTraq ID: 8115
Remote: No
Date Published: Jul 07 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8115
Summary:

SEMI is a library used to add MIME features to Emacs. WEMI is a branch of
the SEMI package using widgets.

SEMI/WEMI have been reported prone to an insecure temporary file creation
vulnerability. As a result, it may be possible for local attackers to
corrupt files owned by the user who is invoking a version of Emacs that is
linked to the vulnerable library.

An attacker could potentially exploit this issue by creating a symbolic
link in place of the temporary file that is created by the affected
application. Any actions performed by the vulnerable application when it
is executed will be performed on the linked file.

It should be noted that the impact of this vulnerability might be
exaggerated by the fact that attackers may potentially influence content
that will be added to the target file.

4. CCBill WhereAmI.CGI Remote Arbitrary Command Execution Vulnerability
BugTraq ID: 8095
Remote: Yes
Date Published: Jul 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8095
Summary:

whereami.cgi is a component of the billing system used by CCBill. It is
available for the Unix and Linux platforms.

A problem with the script may result in unauthorized access.

It has been reported that whereami.cgi distributed by CCBill does not
properly handle some types of input. Because of this, an attacker may be
able to gain access to a system with the privileges of the web server
process.

The problem is in the handling variables passed to the script. By passing
variables using the 'g' option of the script, it is possible to execute
commands on the underlying system. This could permit an attacker to
execute arbitrary commands.

5. Tower Toppler HOME Environment Variable Local Buffer Overflow Vulnerability
BugTraq ID: 8132
Remote: No
Date Published: Jul 08 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8132
Summary:

Tower Toppler is a freely available, open source game for Linux and
Microsoft operating systems.

A problem with the software may make elevation of privileges possible.

It has been reported that a buffer overflow exists in Tower Toppler. A
local user may be able to exploit this issue to execute code with the
privileges of the toppler program.

In some configurations, Toppler may be installed with setgid games
privileges. Exploitation of this vulnerability could give the attacker
group privileges of games.

6. Knoppix QT Insecure Temporary File Creation Vulnerability
BugTraq ID: 8139
Remote: No
Date Published: Jul 08 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8139
Summary:

Knoppix is a freely available, open source Linux operating system.

A problem has been identified in Knoppix that may allow an attacker to
exploit the insecure creation of a temporary file. This could result in a
denial of service attack, and potentially an elevation of privileges.

The problem is in the handling of temporary files when the QT libraries
are invoked. KDE is installed by default with Knoppix, and when the
window manager invokes the QT libraries, the libraries create the
predictable library names qt_plugins_3.0rc and qt_plugins_3.0rc.lock, both
with the privileges of the root user.

This problem may affect previous versions of the software.

7. GNU Chess Local Buffer Overflow Vulnerability
BugTraq ID: 8097
Remote: No
Date Published: Jul 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8097
Summary:

GNU Chess is a freely available chess program for a variety of Linux and
Unix variant systems.

A local buffer overflow has been reported for GNU Chess that may result in
an attacker potentially obtaining elevated privileges.

The vulnerability exists due to insufficient boundary checks performed on
some commandline options. Specifically, the length of the '-s' commandline
option is not properly verified.

An attacker can exploit this vulnerability by invoking /usr/bin/gnuchess
with an overly long '-s' commandline option, consisting of at least 662
bytes. This will result in the overflow condition and the corruption of
sensitive memory with attacker-supplied values.

Successful exploitation may result in the execution of attacker-supplied
code. To be exploited for elevated privileges, the software must be
setuid or setgid. Since GNU Chess is used as a back-end for some
chess-related software, a situation could arise where it is invoked with
user-supplied arguments by another program.

8. X-Face-EL Insecure Temporary File Creation Vulnerability
BugTraq ID: 8116
Remote: No
Date Published: Jul 07 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8116
Summary:

x-face-el is a decoder for Emacs that decodes images that are included
inline in X-Face email headers.

x-face-el has been reported prone to an insecure temporary file creation
vulnerability. As a result, it may be possible for local attackers to
corrupt files owned by the user who is invoking Emacs and x-face-el.

It should be noted that the impact of this vulnerability might be
exaggerated by the fact that attackers may potentially influence content
that will be added to the target file.

9. IglooFTP PRO Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 8117
Remote: Yes
Date Published: Jul 07 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8117
Summary:

IglooFTP PRO is an FTP client that is designed for Linux and Microsoft
Windows platforms.

IglooFTP PRO for Windows platforms has been reported prone to multiple
buffer overrun vulnerabilities.

The issue likely presents itself due do a lack of sufficient bounds
checking performed on data that is later copied into a reserved internal
memory buffer. If an attacker supplies excessive data (>=1028 bytes) in a
manner sufficient to trigger the condition, data greater than the size of
the assigned buffer may corrupt adjacent memory. Because adjacent memory
has been reported to contain a saved instruction pointer, it is possible
for an attacker to influence the execution flow of the vulnerable FTP
client and execute arbitrary instructions.

Remote arbitrary code execution has been confirmed.

It should be noted that although this vulnerability has been reported to
affect IglooFTP PRO version 3.8 for Windows platforms, other versions
might also be affected.

10. Macromedia ColdFusion MX Remote Development Service File Disclosure Vulnerability
BugTraq ID: 8109
Remote: Yes
Date Published: Jul 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8109
Summary:

ColdFusion MX is the application server for developing and hosting
infrastructure distributed by Macromedia. It is available as a standalone
product for Unix, Linux, and Microsoft Operating Systems.

Remote Development Service (RDS) is a way to facilitate secure remote
access to ColdFusion MX servers. This service is used by developers to
access databases, files and other data sources. By default, the RDS
service has SYSTEM level privileges.

A vulnerability has been reported for the RDS service that may allow an
attacker to obtain unauthorized access to a data residing on a ColdFusion
MX server. The vulnerability is due to the way that authentication is done
when communicating with a ColdFusion MX server.

Specifically, RDS requires a password to authenticate a remote developer.
However, it is possible for a remote user to configure their web site
properties to access files residing on the vulnerable server.

Any information obtained in this manner may be used by an attacker to
launch further attacks against a vulnerable system.

11. Macromedia ColdFusion MX Remote Development Service Default Null Password Vulnerability
BugTraq ID: 8110
Remote: Yes
Date Published: Jul 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8110
Summary:

ColdFusion MX is the application server for developing and hosting
infrastructure distributed by Macromedia. It is available as a standalone
product for Unix, Linux, and Microsoft Operating Systems.

It has been reported that, by default, the RDS service uses a blank
password for authentication.

This could allow an unauthenticated user to access the vulnerable
ColdFusion MX server.

12. TerminatorX XLocaleDIR Environment Variable Buffer Overflow Vulnerability
BugTraq ID: 8148
Remote: No
Date Published: Jul 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8148
Summary:

terminatorX is a freely available, open source music manipulation program.
It is available for the Linux platform.

A problem has been reported in terminatorX when processing the XLOCALEDIR
environment variable. Because of this, an attacker may be able to gain
elevated privileges.

The problem is in the handling of long strings. When a large amount of
data is placed in the XLOCALEDIR environment variable, a boundary
condition error occurs that could result in the overwriting of sensitive
process memory. Because of vendor recommendation to install this program
with setuid root privileges, it may be possible for a local user to
execute code with the privileges of the root user.

It should be noted that, by default, terminatorX is not installed with
privileges.

13. GKrellM Mailwatch Plugin From Header Remote Buffer Overflow Vulnerability
BugTraq ID: 8118
Remote: Yes
Date Published: Jul 06 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8118
Summary:

GKrellM is the GTK Monitors suite. It is available for the Linux
platform.

It has been reported that the Mailwatch plugin for GKrellM is vulnerable
to a remotely exploitable buffer overflow. This may permit the execution
of arbitrary code with the privileges of the GKrellM program.

The problem is in the handling of long strings contained in the From
header of e-mails. By sending an e-mail with a From header that contains
558 or more characters as the e-mail user name to a user of GKrellM with
the Mailwatch plugin, it is possible to overwrite sensitive process
memory. This vulnerability could be exploited to execute arbitrary
instructions on behalf of the attacker.

14. MyServer Malformed URI Denial Of Service Vulnerability
BugTraq ID: 8120
Remote: Yes
Date Published: Jul 07 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8120
Summary:

MyServer is a web server implementation for a number of platforms,
including Microsoft Windows operating systems and Linux.

MyServer has been reported to be prone to denial of service attacks when
handling certain malformed URIs. This issue may be due to a flaw in the
CGI parser, causing the server to crash when some invalid CGI parameters
are supplied. This could be exploited to deny availability of web
services to legitimate users.

This issue was reported in myServer 0.4.2 on Microsoft Windows platforms.
Other versions may also be affected.

15. Apache Web Server Type-Map Recursive Loop Denial Of Service Vulnerability
BugTraq ID: 8138
Remote: No
Date Published: Jul 08 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8138
Summary:

Apache is a freely available web server. It is available for a variety of
platforms including the Unix, Linux and Microsoft Windows operating
systems.

Apache content negotiation functionality reported prone to a denial of
service vulnerability.

The issue may present itself, if an attacker has the ability to create a
malicious type-map file. The attacker may craft the type-map file in a
manner sufficient to cause the vulnerable server to fall into an infinite
loop. It has been reported that the Apache server will exponentially
consume resources in such circumstance. Effectively denying service to
other legitimate system users.

16. CPanel Admin Interface HTML Injection Vulnerability
BugTraq ID: 8119
Remote: Yes
Date Published: Jul 07 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8119
Summary:

cPanel is a multi-platform web hosting control panel that allows a user to
manage their hosted account through a web-based interface. It is
available for Unix and Linux variants.

cPanel is prone to an HTML injection vulnerability. It is possible for
remote attacks to include hostile HTML and script code in requests to
cPanel, which will be logged. When logs are viewed by an administrative
user, the injected code could be rendered in their browser in the context
of the site hosting cPanel. HTML may be injected into the 'Error Log' and
'Latest Visitors' pages. This is due to insufficient sanitization of HTML
and script code when logging client requests.

Exploitation of this issue could permit theft of administrative
cookie-based authentication credentials. The attacker will also be able
to exert control over how affected pages are rendered, which could permit
log spoofing or other attacks.

17. UnrealIRCD OperServ Raw Join Denial Of Service Vulnerability
BugTraq ID: 8131
Remote: Yes
Date Published: Jul 08 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8131
Summary:

UnrealIRCD is an IRC implementation that is available for a number of
platforms including Linux/Unix variants and Microsoft Windows operating
systems.

It is reported UnrealIRCD may crash under some circumstances when a client
sends a raw message to operserv. This may occur when a raw message is
used when requesting to join a channel. This will allegedly cause the
server to segfault, resulting in a potential denial of service. It is not
known if this condition could be exploited to corrupt memory and execute
arbitrary code.

It should be noted that other IRC daemon implementations may be similarly
affected, especially in cases where raw message code is shared with other
implementations or derived from the same source.

The vulnerability is reported to exist in the m_join() function, which is
included in the 's_user.c' source file. It should be noted that other IRC
daemon implementations may be similarly affected, especially in cases
where raw message code is shared with other implementations or derived
from the same source.

This issue is similar to BID 8130 but is being assigned a separate BID
because it does seem like Anope Services is sharing the same vulnerable
code with UnrealIRCD.

18. Apache Web Server FTP Proxy IPV6 Denial Of Service Vulnerability
BugTraq ID: 8135
Remote: Yes
Date Published: Jul 08 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8135
Summary:

Apache is a freely available web server. It is available for a variety of
platforms including the Unix, Linux and Microsoft Windows operating
systems.

A denial of service vulnerability has been reported by the vendor to
affect the FTP proxy component of Apache. It has been reported that an
attacker may specify a target server that possesses an IPV6 address. This
may result in a denial of service to other legitimate users. The issue
reportedly presents itself, because the proxy server fails to create an
IPV6 socket.

Explicit technical details regarding this vulnerability are not currently
known, this BID will be updated as further details are disclosed.

19. Macromedia Apache Web Server Encoded Space Source Disclosure Vulnerability
BugTraq ID: 8136
Remote: Yes
Date Published: Jul 08 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8136
Summary:

ColdFusion and JRun are web application delivery software packages
available for the Unix, Linux, and Microsoft Windows platform.

It has been reported that an issue exists in Macromedia ColdFusion and
JRun that could allow an attacker to gain unauthorized access to
potentially sensitive information. This may result in an attacker gaining
access to system resources.

The problem is in the disclosure of sensitive information contained in
ColdFusion and Java Servlet Pages. By placing a request ending in an
encoded space to the Apache Web Server packaged with ColdFusion MX and/or
JRun, it is possible for the attacker to view the source of the web
scripts hosted on the system.

It should be noted that this problem affects ColdFusion and JRun only on
the Microsoft Windows platforms.

20. Anope Services OperServ Raw Join Denial Of Service Vulnerability
BugTraq ID: 8130
Remote: Yes
Date Published: Jul 08 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8130
Summary:

Anope Services is an IRC implementation for Unix/Linux variants.

It is reported Anope Services may crash under some circumstances when a
client sends a raw message to operserv. This may occur when a raw message
is used when requesting to join a channel. This will allegedly cause the
server to segfault, resulting in a potential denial of service. It is not
known if this condition could be exploited to corrupt memory and execute
arbitrary code.

The vulnerability is reported to exist in the do_raw() function, which
exists in the 'operserv.c' source file. It should be noted that other IRC
daemon implementations may be similarly affected, especially in cases
where raw message code is shared with other implementations or derived
from the same source.

This issue appears similar to BID 8131, but is being assigned a separate
BID because it does seem like Anope Services is sharing the same
vulnerable code with UnrealIRCD.

21. Apache Web Server Prefork MPM Denial Of Service Vulnerability
BugTraq ID: 8137
Remote: Yes
Date Published: Jul 08 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8137
Summary:

Apache is a freely available web server. It is available for a variety of
platforms including the Unix, Linux and Microsoft Windows operating
systems.

Apache may be run as a non-threaded, pre-forking server via the prefork
MPM (Multi-Processing Module).

The Apache Software Foundation has reported a vulnerability in the prefork
MPM that could result in a temporary denial of service condition. This
condition is known to occur when an accept() call on a rarely accessed
port returns certain errors.

Further technical details are not available at the time of writing. This
BID will be updated appropriately when additional technical information
becomes available.

22. SKK/DDSKK Insecure Temporary Files Vulnerability
BugTraq ID: 8144
Remote: No
Date Published: Jul 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8144
Summary:

skk and ddskk are Kana to Kanji conversion programs for use with Emacs.
They are available for Unix and Linux variants.

skk and ddskk do not create temporary files in a secure manner. This
could permit local attackers to mount file corruption attacks against
sensitive or critical files owned by other users. This would occur in the
context of the user invoking the vulnerable utility. If files can be
corrupted with custom data, this may allow for privilege escalation
attacks. Otherwise, it may be possible to cause a denial of service by
overwriting critical files.

23. XBlockOut XBL Display Local Buffer Overrun Vulnerability
BugTraq ID: 8145
Remote: No
Date Published: Jul 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8145
Summary:

XBL (XBlockOut) is a game developed for Linux and Unix variant operating
systems.

XBL is prone to a locally exploitable buffer overrun condition. This is
due to insufficient bounds checking of data supplied via the '-display'
command line option. By supplying data of excessive length it may be
possible to corrupt adjacent regions of memory with attacker-supplied
data. This could potentially be leveraged to execute code with elevated
privileges. XBL is typically installed setgid 'games'.

24. TerminatorX Home Environment Variable Buffer Overflow Vulnerability
BugTraq ID: 8147
Remote: No
Date Published: Jul 09 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8147
Summary:

terminatorX is a freely available, open source music manipulation program.
It is available for the Linux platform.

A problem has been reported in terminatorX when processing the HOME
environment variable. Because of this, an attacker may be able to gain
elevated privileges.

The problem is in the handling of long strings. When a large amount of
data is placed in the HOME environment variable, a boundary condition
error occurs that could result in the overwriting of sensitive process
memory. Because of vendor recommendation to install this program with
setuid root privileges, it may be possible for a local user to execute
code with the privileges of the root user.

It should be noted that, by default, terminatorX is not installed with
privileges.

III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Stealthy Linux Key Logger (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/328708

2. LIDS on production server anyone?? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/327830

IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. NetOp Remote Control
by CrossTec Corporation
http://www.crossteccorp.com/netopremote/index.html
Platforms: DOS, Linux, OS/2, Windows 2000, Windows 95/98, Windows CE,
Windows NT, Windows XP
Summary:

With New NetOp Remote Control v7.5 you can easily reach any Windows,
Linux, Sun Solaris or legacy OS/2 and DOS PC from your desktop or even via
any Internet connected PC via our new IE browser Guest. View the remote
PC's screen, control its keyboard and mouse, synchronize files, inventory
its hardware and software, launch applications or chat with someone at the
remote PC -- just as if you were seated at that computer.

2. StoneGate High Availability Firewall
by Stonesoft
http://www.stonesoft.com/products/main/StoneGate
Platforms: Linux, Solaris, Windows 2000, Windows NT
Summary:

StoneGate provides the first fully scalable, high security and high
performance firewall and VPN solution for business critical applications.
StoneGate is the first firewall to provide secure connections and load
balancing between multiple ISPs to ensure continuous network connectivity.

3. WatchGuard SOHO 2.2
by WatchGuard Technologies
http://www.watchguard.com/products/soho.html
Platforms: Linux, MacOS, UNIX, Windows 95/98, Windows NT
Summary:

WatchGuard SOHO 2.2 provides powerful protection and a host of new
features and benefits for small offices, home offices, telecommuters and
Internet distributed enterprises. WatchGuard SOHO provides these security
features: - Stateful packet filtering firewall technology - Broadband
Internet sharing for up to 50 users - LiveSecurity Service included for
the first year - IPSec VPN standard with the SOHO|tc and optional with
SOHO 10 user license - WebBlocker option.

V. NEW TOOLS FOR LINUX PLATFORMS
---------------------------------
1. pkdump v0.96.1
by dsmoker
Relevant URL:
http://pkdump.sourceforge.net/pkdumpage.html
Platforms: Linux, POSIX
Summary:

pkdump detects TCP and UDP port scans and connection attempt from foreign
hosts over the Internet.

2. Quick Spam Filter v0.7.4
by Andrew Wood
Relevant URL:
http://www.ivarch.com/programs/qsf.shtml
Platforms: Linux, POSIX
Summary:

Quick Spam Filter is a small, fast spam filter that works by learning to
recognise the words that are more likely to appear in spam than non-spam.
It is intended to be used in a procmail recipe to mark email as being
possible spam.

3. pam_dotfile v0.5
by Mezcalero
Relevant URL:
http://www.stud.uni-hamburg.de/users/lennart/projects/pam_dotfile/
Platforms: Linux, UNIX
Summary:

pam_dotfile is a PAM module which allows users to have more than one
password for a single account, each for a different service. This is
desirable because many users have objections to using the same password
for (as an example) an IMAP4 mailbox and SSH access.

VI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: KaVoDo

Your network Firewall and IDS products do not prevent Web application
exploits - the most common form of online attack - resulting in Web
defacement, data theft, sabotage and fraud.