SecurityFocus Linux Newsletter # 145

SecurityFocus Linux Newsletter # 145
------------------------------------

This Issue is Sponsored by: KaVaDo
 
Your network firewall and IDS products do not prevent Web application 
attacks - the most common form of online exploitation- resulting in Web 
defacement, data theft, sabotage and fraud.
 
KaVaDo is the first and only company that provides a complete and 
integrated suite of Web application security products, allowing you to:
 - assess your entire Web environment with a Web Application Scanner, 
 - automatically set positive security policies for real-time protection, 
and
 - maintain such policies at the Application Firewall without compromising 
business performance.
 
For more information on KaVaDo and to download a FREE white paper on 
Security Policy Automation for Web Applications, please visit 
http://www.securityfocus.com/sponsor/KaVaDo_linux-secnews_030818
------------------------------------------------------------------------
I. FRONT AND CENTER
     1. Honeypot Farms
     2. The Sad Tale of a Security Whistleblower
II. LINUX VULNERABILITY SUMMARY
     1. Multiple Vendor OSF Distributed Computing Environment Denial...
     2. Red Hat Linux Up2Date GPG Signature Validation Vulnerability
     3. PostNuke Downloads / Web_Links Modules TTitle Cross-site Scr...
     4. Invision Power Board Admin.PHP Cross-Site Scripting Vulnerab...
     5. DCForum+ Subject Field HTML Injection Vulnerability
     6. Stellar Docs Path Disclosure Vulnerability
     7. Better Basket Pro Store Builder Remote Path Disclosure Vulne...
     8. PHPOutSourcing Zorum Cross-Site Scripting Vulnerability
     9. News Wizard Path Disclosure Vulnerability
     10. Distributed Shell Local HOME Environment Variable Buffer Ove...
     11. PHPOutsourcing Zorum Path Disclosure Vulnerability
     12. Netris Client-Side Buffer Overrun Vulnerability
     13. DistCC Insecure Temporary File Vulnerability
     14. PHP DLOpen Arbitrary Web Server Process Memory Vulnerability
     15. SurgeLDAP Path Disclosure Vulnerability
     16. SurgeLDAP User.CGI Cross-Site Scripting Vulnerability
     17. SurgeLDAP HTTP GET Denial Of Service Vulnerability
     18. SurgeLDAP Insecure Password Storage Vulnerability
     19. Xoops BBCode HTML Injection Vulnerability
     20. SGI IRIX NFSD XDR Decoding Remote Denial of Service Vulnerab...
     21. ECartis LIScript Arbitrary Variable Viewing Vulnerability
     22. Ecartis Multiple Buffer Overrun Vulnerabilities

III. LINUX FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2003-08-11 to 2003-08-18.

IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. NetSecure Web
     2. Zorp
     3. Kerio MailServer
     4. PureSight
     5. CyberFusion
     6. SecurPass Suite

V. NEW TOOLS FOR LINUX PLATFORMS
     1. Arno's IPTABLES Firewall Script v1.8.1BETA-3
     2. Graphical certification authority v0.4.5
     3. tinc 1.0.1
     4. Anti-Spam SMTP Proxy v1.0.0
     5. FWReport v1.1.5
     6. ulogd-php v0.7

VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Honeypot Farms
By Lance Spitzner
  
This article is about deploying and managing honeypots in large, 
distributed environments through the use of Honeypot Farms.

http://www.securityfocus.com/infocus/1720

2. The Sad Tale of a Security Whistleblower
By Mark Rasch 

Federal prosecutors in California went too far when they put a man in 
prison for warning people about a website security hole.

http://www.securityfocus.com/columnists/179

II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. Multiple Vendor OSF Distributed Computing Environment Denial...
BugTraq ID: 8371
Remote: Yes
Date Published: Aug 08 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8371
Summary:
The DCE (Distributed Computer Environment) is a set of distributed
computing standards maintained by Open Software Foundation.  Numerous
vendors provide DCE client and server implementations.

A vulnerability has been announced that may be exploited to cause a denial
of services in multiple vendor implementations based on the OSF DCE
standards.  The consequences of this vulnerability are that a remote
attacker may cause a server implementation to hang or crash.  Exploitation
of this issue can deny availability of DCE services to legitimate clients.

Exact technical details are not known at this time but the issue is
believed to be caused by a null pointer deference, which would not be
exploitable to execute arbitrary code.  This BID will be updated
appropriately if further details become available.

This issue can be exposed via RPC services with some implementations.  

It should be noted that some of the vendors reported side-effects of
exploitation attempts for BID 8205 "Microsoft Windows DCOM RPC Interface
Buffer Overrun Vulnerability" may potentially trigger this issue in
affected implementations.  IBM also reported that this issue is an issue in
their RPC runtime implementation of DCE that can occur whenever a RPC
packet with invalid presentation context ID is received by a server. 
Scanning utilities for BID 8205 have also been reported to trigger this
issue in some implementations.  It is not known if this issue can also be
caused by attempts to exploit BID 8234 "Microsoft Windows 2000 RPC DCOM
Interface Denial of Service Vulnerability".

2. Red Hat Linux Up2Date GPG Signature Validation Vulnerability
BugTraq ID: 8372
Remote: No
Date Published: Aug 08 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8372
Summary:
up2date is the Red Hat Update Agent software that allows Red Hat Linux
users to connect to the Red Hat Network and download official updates and
fixes. up2date it intended to restrict installation of packages, it is
designed to allow installation of packages that are signed with the Red Hat
package signing key only.

It has been reported that the up2date tool does not sufficiently validate
GPG signatures on rpm packages downloaded from the Red Hat Network. This
issue may provide for the installation of a package, which does not posses
a GPG signature. 

It is not believed, however, that this vulnerability is easily exploited.
It has been illustrated that a local attacker would require that the
malicious package be hosted on the Red Hat Network, prior to installation.
To accomplish this the attacker would need to compromise Red Hat Network
servers.

3. PostNuke Downloads / Web_Links Modules TTitle Cross-site Scr...
BugTraq ID: 8374
Remote: Yes
Date Published: Aug 08 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8374
Summary:
PostNuke is a content management system implemented in PHP. It is available
for Windows, Linux and other Unix based systems.

A vulnerability concerning unsanitized data has been reported in the
software.  This problem is related to the Downloads and Web_Links modules,
specifically in the TTitle variable.  HTML and script code will not be
filtered from input to this variable before being displayed by the
vulnerable module.  Therefore it may be possible for an attacker to
construct a malicious link containing script code that could be executed on
the browser of a user who visits the link.  This would occur in the
security context of the site running PostNuke.

The vulnerability allows a victim to be prone to theft of cookie-based
credentials.  Other attacks can be possible as well.

4. Invision Power Board Admin.PHP Cross-Site Scripting Vulnerab...
BugTraq ID: 8381
Remote: Yes
Date Published: Aug 09 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8381
Summary:
Invision Board is web forum software. It is implemented in PHP and is
available for Unix and Linux variants and Microsoft Windows operating systems.

Invision Power Board admin.php script reported prone to a cross-site
scripting vulnerability.

The issue presents itself due to a lack of sufficient sanitization
performed by functions in the admin.php script on user-influenced 'adsess'
URI parameters. It has been reported that a remote attacker may construct a
malicious link to the admin.php script hosted on a remote site, and supply
arbitrary HTML code as a value for the 'adsess' URI parameter. If this link
is followed, the content of the 'adsess' parameter will be rendered in the
browser of the user who followed the link. 

This could permit the theft of cookie authentication credentials; other
attacks may also be possible.

5. DCForum+ Subject Field HTML Injection Vulnerability
BugTraq ID: 8384
Remote: Yes
Date Published: Aug 11 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8384
Summary:
DCForum+ is a web based conferencing system, designed to facilitate online
discussion. It is implemented in Perl and has few system dependencies,
making it available on most operating systems, including Linux, Windows and
most Unix variants. 

DCForum+ is prone to an HTML injection vulnerability. This issue is exposed
through the dcboard.php script. An attacker may exploit this issue by
including hostile HTML and script code in the subject field of posts to the
bulletin board. This is because the script that processes posts does not
sufficiently sanitize user input, allowing attackers to embed HTML and
script commands within the post. This code may be rendered in the web
browser of a user who views these areas of the site. This would occur in
the security context of the site hosting DCForum+. 

The attacker-supplied HTML and script code would be able to access
properties of the site, potentially allowing for theft of cookie-based
authentication credentials. An attacker could also exploit this issue to
control how the site is rendered to the user. 

It should be noted that although this vulnerability has been reported for
DCForum+ version 1.2, other versions might also be affected.

6. Stellar Docs Path Disclosure Vulnerability
BugTraq ID: 8385
Remote: Yes
Date Published: Aug 11 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8385
Summary:
Stellar Docs is a commercial web-based documentation management system.  It
is available for Unix and Linux variants.

Stellar Docs will disclose path information in an error page in response to
a request for an invalid request for a web resource.  This could disclose
information about the layout of the file system that could be useful in
further attacks against the system.  It should be noted the error output
indicates that a database function has failed, which may be due to a more
serious issue, such as SQL injection.

Though unconfirmed, this issue could be due to configuration, for example,
the software may output this information if debugging directives are enabled.

7. Better Basket Pro Store Builder Remote Path Disclosure Vulne...
BugTraq ID: 8386
Remote: Yes
Date Published: Aug 11 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8386
Summary:
Store Builder is an add-on program for the Better Basket Pro e-commerce
package.  It is available for the Unix and Linux platforms.

It has been reported that Better Basket Pro (BBPro) Store Builder may
reveal path information under some circumstances.  This may result a
directed attack against system resources.

The problem is in the error responses generated by the program.  When an
invalid request is placed to the program, Store Builder reveals information
about the installation path of the software.  This may give an attacker
information necessary in launching a more directed attack against system
resources.

8. PHPOutSourcing Zorum Cross-Site Scripting Vulnerability
BugTraq ID: 8388
Remote: Yes
Date Published: Aug 11 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8388
Summary:
Zorum is a commercially-available forum software package distributed and
maintained by PHPOutSourcing.  It is available for the Unix, Linux, and
Microsoft Windows platforms.

A cross-site scriping vulnerability has been reported in the index.php
script of PHPOutSourcing Zorum.  Because of this, an attacker may be able
to execute hostile HTML and script code in the browsers of target users who
follow a malicious link.

The problem is in the filtering of HTML and client-side script code by
index.php.  When attacker-supplied HTML or script code is passed to the
method variable of index.php in a malicious link, the code may be rendered
in the context of the site.  This could make it possible for an attacker to
steal cookie authentication credentials, or perform other malicious activities.

9. News Wizard Path Disclosure Vulnerability
BugTraq ID: 8389
Remote: Yes
Date Published: Aug 11 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8389
Summary:
News Wizard is a content management system.  It is implemented in PHP and
available for Linux/Unix variants.

News Wizard will disclose path information in an error page in response to
a request for an invalid request for a web resource.  This could disclose
information about the layout of the file system that could be useful in
further attacks against the system.

Though unconfirmed, this issue could be due to configuration.  For example,
the software may output this information if debugging directives are enabled.

10. Distributed Shell Local HOME Environment Variable Buffer Ove...
BugTraq ID: 8391
Remote: No
Date Published: Aug 11 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8391
Summary:
The Distributed Shell (dsh) is a shell designed to execute single commands
across multiple systems. It was developed for use on clustered systems and
is available for the Linux operating system.

A vulnerability has been discovered in dsh. The problem occurs due to
incorrect bounds checking within the programmer-defined 'asprintf()'
function. A call is made to the function as shown in the following piece of
code:

asprintf (&buf, "%s/.dsh/dsh.conf", getenv("HOME")

The bounds checking is then carried out by the following code snippet:

ssize_t buflen = 50 * strlen(fmt);

At this point of execution the 'fmt' variable, passed via a call to
'asprintf()' still contains "%s/.dsh/dsh.conf". However, by examining the
bounds checking code, it appears that the author incorrectly assumed that
the '%s' format specifier would have been interpreted, which is not the case.

As a result, the 'buflen' variable, later used as the size argument for
dynamically allocating the storage buffer, will only contain the length of
'50 * "%s/.dsh/dsh.conf"'. As such, if a HOME environment variable exists
which is greater in size then the aforementioned length, when the data is
copied into the buffer the dynamically allocated memory buffer via
vsnprintf(), it will be overrun, effectively resulting in the corruption of
heap-based memory management structures.

If the dsh utility were installed with the setuid bit enabled, it may be
possible for an attacker to exploit this issue to execute arbitrary
instructions with elevated privileges.

This vulnerability is said to affected dsh 0.24.

*** New information has been posted to bugtraq which suggests that this
issue is in fact not a legitimate vulnerability. As such, this BID will
subsequently be retired.

11. PHPOutsourcing Zorum Path Disclosure Vulnerability
BugTraq ID: 8396
Remote: Yes
Date Published: Aug 11 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8396
Summary:
Zorum is a freely available, open source PHP forum. It is available for
UNIX, Linux, and Microsoft operating systems.

It has been reported that the software is prone to a path disclosure
vulnerability.  This issue can be triggered by sending a malformed request
to the software, resulting in an error message that may disclose sensitive
information about the installation path to the attacker.

This information may aid an attacker in mapping out of the file system,
which can then be used to launch further attacks.

Though Zorum version 3.4 has been reported to be prone to this issue,
earlier versions may also be vulnerable.

12. Netris Client-Side Buffer Overrun Vulnerability
BugTraq ID: 8400
Remote: Yes
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8400
Summary:
Netris is a freely available network "Tetris" clone. It is available for
Unix and Linux variants.

A client-side buffer overrun vulnerability has been reported for Netris.
The issue is said to occur due to insufficient bounds checking when copying
a server greeting into an internal memory buffer. As a result, an attacker
could theoretically pose as a Netris server, and upon connection pass
excessive data to the client program. When this occurs, internal program
memory will be corrupted, potentially allowing for the execution of
arbitrary code with the privileges of the user invoking Netris.

This vulnerability affects Netris 0.5 and earlier.

13. DistCC Insecure Temporary File Vulnerability
BugTraq ID: 8402
Remote: No
Date Published: Aug 12 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8402
Summary:
distcc is a distributed compiler application for Linux/Unix variants. 
distcc acts as a compiler front-end that can distribute software builds
across multiple hosts.

distcc is reported to handle temporary files insecurely.  This could permit
attacks which cause sensitive files to be corrupted.  A local user may be
able to exploit this issue by creating malicious symbolic links.

Exploitation could result in destruction of critical files, causing a
denial of service.  Though unconfirmed, if a local attacker can corrupt
files with custom data, they may be able to gain elevated privileges.

14. PHP DLOpen Arbitrary Web Server Process Memory Vulnerability
BugTraq ID: 8405
Remote: No
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8405
Summary:
PHP is the Personal Home Page web application development suite.  It is
available for the Unix, Linux, and Microsoft platforms.

A problem has been reported in the dlopen function of PHP when used with
the Apache web server.  Because of this, an attacker may be able to gain
unauthorized access to potentially sensitive information.

The problem is in the ability to access the memory of the calling process.
 When a PHP script is executed by an Apache process, it is possible to dump
the contents of the Apache process memory to a text file.  This could be
used by an attacker to gain access to potentially sensitive information
which could include authentication credentials.  The function may also
permit other attacks, such as allowing an attacker to deliver different
content other than what the server is configured to serve.

15. SurgeLDAP Path Disclosure Vulnerability
BugTraq ID: 8406
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8406
Summary:
SurgeLDAP is an LDAP server implementation.  It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.
 
SurgeLDAP is prone to a path disclosure vulnerability.  It is possible to
gain access to sensitive path information by issuing an HTTP GET request
for an invalid resource.  This could help a remote attacker enumerate the
layout of the file system of the host running the vulnerable software,
which may be useful in further attacks against the host.

This issue exists in the web server component of SurgeLDAP.

16. SurgeLDAP User.CGI Cross-Site Scripting Vulnerability
BugTraq ID: 8407
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8407
Summary:
SurgeLDAP is an LDAP server implementation.  It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.

SurgeLDAP is prone to cross-site scripting attacks.  The issue exists in
the user.cgi script and is due to insufficient sanitization of data
supplied via URI parameters, which will be echoed back to users.  Remote
attackers may exploit this issue by enticing a user to visit a malicious
link that specifies hostile HTML and script code as a value for the 'cmd'
parameter of the vulnerable script.  This code may be rendered in the
user's browser when the link is visited.  This would occur in the context
of the server.

Successful exploitation may allow theft of cookie-based authentication
credentials or other attacks.

This issue exists in the web server component of SurgeLDAP.

17. SurgeLDAP HTTP GET Denial Of Service Vulnerability
BugTraq ID: 8408
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8408
Summary:
SurgeLDAP is an LDAP server implementation.  It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.

SurgeLDAP is prone to a denial of service vulnerability that may occur when
an overly long HTTP GET request is sent to the server.  Though unconfirmed,
this may result in memory corruption, which may be further exploitable to
execute arbitrary code.  It is reported that an HTTP GET request of 501 or
more characters will trigger this condition.  

This issue exists in the web server component of SurgeLDAP.

18. SurgeLDAP Insecure Password Storage Vulnerability
BugTraq ID: 8409
Remote: No
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8409
Summary:
SurgeLDAP is an LDAP server implementation.  It is available for a number
of platforms including Microsoft Windows and Linux/Unix variants.

SurgeLDAP does not adequately secure password credentials.  These
credentials will be stored on the system hosting the server in plaintext
and could be exposed to users with local access to the system.  On
Microsoft Windows, these credentials are reported to be stored in the
'user.dat' file in the program directory.

19. Xoops BBCode HTML Injection Vulnerability
BugTraq ID: 8414
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8414
Summary:
Xoops is open-source, freely available web portal software written in
object-oriented PHP. It is back-ended by a MySQL database and will run on
most Unix and Linux distributions.

BBCode is a basic restricted implementation of HTML that is used to control
the appearance of text in user-supplied Xoops entries.

Xoops BBCode has been reported prone to an HTML injection vulnerability. It
has been reported that an attacker may inject malicious script into areas
of Xoops where BBCode is rendered, for example News entries, bulletin board
posts or private messages. This issue is due to a lack of sufficient
sanitization performed on user supplied BBCode tags. The [color], [size]
and [font] BBCode tags are reported vulnerable. Injected code may be
rendered in the web browser of a user who views vulnerable areas of the
site. This would occur in the security context of the site hosting Xoops
and its related modules.

Redirection attacks using CSS and vbscript, exploiting this vulnerability
have been demonstrated. Although unconfirmed, theft of cookie-based
authentication credentials and other attacks may also be possible.

Although this vulnerability has been reported to affect Xoops version <=
1.3.x. The issue has been reported exploitable via the News, Private
Messages and NewBB Xoops modules.

20. SGI IRIX NFSD XDR Decoding Remote Denial of Service Vulnerab...
BugTraq ID: 8415
Remote: Yes
Date Published: Aug 13 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8415
Summary:
XDR (External Data Representation) is a protocol governing the platform
independent description and encoding of data, in this particular case it is
used in conjunction with the SGI IRIX nfsd daemon, used to share system
based resources across a network. NFS uses XDR to describe the format of
its data.

SGI has announced a vulnerability in the IRIX nfsd daemon which may make it
prone to remote denial of service attacks. The issue is said to occur when
nfsd attempts to handle malformed packets which cause XDR decoding errors.

Although it has not been confirmed, there is a possibility that this
vulnerability is in someway related to the 
Linux Kernel 2.4 XDR Packet Handler For NFSv3 Remote Denial Of Service
Vulnerability described in BID 8298.

Successful exploitation of this vulnerability would allow a remote attacker
to trigger a system panic on an affected host.

21. ECartis LIScript Arbitrary Variable Viewing Vulnerability
BugTraq ID: 8420
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8420
Summary:
ECartis is a freely available, open source mailing list manager.  It is
available for the Unix and Linux platforms.

A problem in the handling of user-supplied input has been reported in
ECartis.  Because of this, an attacker may be able to gain access to
unauthorized and potentially sensitive information.

The problem is in the handling of requests sent via e-mail for specific
functions and variables.  By supplying specially malformed requests, it is
possible to make ECartis disclose data or perform actions that may be
restricted and sensitive in nature.  Multiple instances of this type of
issue were reported to exist in the software.

22. Ecartis Multiple Buffer Overrun Vulnerabilities
BugTraq ID: 8421
Remote: Yes
Date Published: Aug 14 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8421
Summary:
ECartis is a freely available, open source mailing list manager.  It is
available for the Unix and Linux platforms.

Multiple buffer overrun vulnerabilities have been reported for Ecartis 1.0.
The problems occur due to a variety of problems within the code, and each
appears to be a result of insufficient bounds checking when copying the
contents of e-mail into internal memory buffers.

One such problem occurs within the smtp_body_822bis() function, located in
the stmp.c source file, which is designed to copy data from a src buffer
into a destination buffer. However, the function does not include a size
parameter, which may allow for the destination to be overrun. As a result
of this issue, any later implementation of this function may result in a,
potentially exploitable, buffer overrun.

Other issues have been reported within the unhtml.c and unmime.c source
files. All issues located in these files appear to occur due insufficient
bounds checking before transferring data between pointers.

Successful exploitation of this vulnerabilities may result in a remote
denial of service. Also, although it has not yet been confirmed, due to the
nature of these vulnerabilities, it is theoretically possible that an
attacker may be capable of exploiting the overruns to execute arbitrary
instructions. It should be noted that due to the nature of e-mail
protocols, successfully exploiting this issue may be difficult due to a
restricted character set.

III. LINUX FOCUS LIST SUMMARY
-----------------------------
NO NEW POSTS FOR THE WEEK 2003-08-11 to 2003-08-18.

IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. NetSecure Web
By: NetSecure Software
Platforms: AIX, BSDI, Linux, Solaris, Windows NT
Relevant URL:
http://www.netsecuresoftware.com/netsecurenew/Products/NetSecureWeb/netsecureweb.html
Summary: 

NetSecure Web enables you to create Internet services guaranteeing full
protection of your information system network.

* Total access to internal database server 
* Fully transparent for internal and external users
* Preserves your private network from intrusion
* Ensures that only authorized requests are delivered
* Easy installation and operation

2. Zorp
By: Balabit IT Security Ltd.
Platforms: Linux
Relevant URL: http://www.balabit.com/products/zorp/
Summary: 

Zorp is a proxy firewall suite making it possible to finetune proxy
decisions (with its built in script language), to fully analyze complex
protocols (like SSH with several forwarded TCP connections), to use outband
authentication techniques (unlike common practices where proxy
authentication had to be hacked into the protocol). Combined the power
explained above, source code is provided under the GNU/GPL.

3. Kerio MailServer
By: Kerio Technologies Inc.
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.kerio.com/us/kms_home.html
Summary: 

Kerio MailServer represents a new generation of mail servers designed for
corporate networks. To help combat increasing security threats, Kerio
MailServer offers a wide range of features to keep email from being
intercepted, infected by computer viruses, or sent as spam

4. PureSight
By: iCognito
Platforms: Linux, Solaris, Windows 2000, Windows NT
Relevant URL: http://www.icognito.com/products/ps.shtml
Summary: 

PureSight Home is a powerful tool that helps parents and other concerned
users embrace technology in their homes while safeguarding the family from
intentional or accidental viewing of inappropriate content.

PureSight Home provides maximal protection from objectionable materials on
the web without the need for costly and time-consuming updates. Easily
installed and customized, the password-protected tool can be readily set
and modified according to parental preferences. 

5. CyberFusion
By: Proginet Corp
Platforms: AIX, HP-UX, Linux, OS/390, Solaris, SunOS, Windows 2000, Windows
95/98, Windows NT, Windows XP
Relevant URL: http://www.proginetuk.co.uk/products/cyberfusion/cyberfusion.htm
Summary: 

CyberFusion enables secure, reliable, scalable, automated and comprehensive
end-to-end management for secure file transfer across an extensive range of
disparate computing platforms, including all mainframes and client/server
environments.   
 
CyberFusion also provides extensive auditing, reporting and monitoring of
activity. Secure file transfers for data backup, data recovery, disaster
recovery, data archiving, data warehouse and other purposes are all easily
enabled using the many features which offer much more than basic secure FTP
(SFTP) or Secure Shell (SSH).  
 
Standard FTP software is not the cheap option it appears when total cost of
ownership (TCO) is properly examined and the improved computer security is
taken into account. 

6. SecurPass Suite
By: Proginet Corp
Platforms: AIX, AS/400, HP-UX, Linux, Netware, OS/2, OS/390, RACF, Solaris,
True64 UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.proginetuk.co.uk/products/securpass-home.htm
Summary: 

SecurPass suite may be installed together or stand-alone.

SecurPass-Sync Password Synchronisation in the enterprise across multiple
platforms & applications to enhance security & save helpdesk costs. Users
have the same password to all applications & on all platforms with any
change in one always propagated to all. Security is enhanced by enforcing
better policies, removes the likelihood of users writing down passwords,
users may be revoked, resumed or deleted instantly from all points of
entry. SecurPass-Sync offers the advantages of single sign-on without the
costs & complexities in implementation and with benefits typically seen
within a few weeks. 

SecurPass-Reset Password Reset - user self-reset of passwords without
helpdesk intervention in the enterprise to enhance security & save help
desk calls in multi or single-platform environments. Resets are enabled via
a browser-based self-help utility in accordance with enterprise security
standards that ensure type & numbers of questions fit the needs. Users
re-enable their own accounts if they have forgotten their passwords &
accidentally get locked out. Enterprise & user efficiency is increased &
the significant reduction in helpdesk calls will ensure a rapid ROI.

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Arno's IPTABLES Firewall Script v1.8.1BETA-3
By: Arno
Relevant URL: http://rocky.molphys.leidenuniv.nl
Platforms: Linux, POSIX
Summary: 

Arno's Iptables firewall is a script which was originally derived from
Seven's iptables script. One of the biggest differences is that this script
also has support for ADSL modems. It also features stealth scan detection,
extensive user-definable logging with rate limiting to prevent log
flooding, masquerading and port forwarding (NAT), optimizing the throughput
of your connection, protection against SYN/ICMP flooding, and much more.
It's easy to configure and highly customizable. It includes a filter script
(fwfilter) to make your firewall log more readable.

2. Graphical certification authority v0.4.5
By: chris
Relevant URL: http://www.hohnstaedt.de/xca.html
Platforms: Linux, POSIX
Summary: 

Graphical certification authority is an interface for managing RSA keys and
certificates, and the creation and signing of PKCS#10 requests. It uses the
OpenSSL library and a Berkeley DB for key and certificate storage. It
supports importing and exporting keys and PEM DER PKCS8 certificates,
signing and revoking of PEM DER PKCS12, and the selection of x509v3
extensions. A tree view of certificates is presented. 

3. tinc 1.0.1
By: guus <[email protected]>
Relevant URL: http://tinc.nl.linux.org/
Platforms: Linux
Summary: 

tinc is a Virtual Private Network (VPN) daemon that uses tunneling and
encryption to create a secure private network between multiple hosts on the
Internet. This tunneling allows VPN sites to share information with each
other over the Internet without exposing any information.

4. Anti-Spam SMTP Proxy v1.0.0
By: John Hanna
Relevant URL: http://assp.sourceforge.net/
Platforms: BSDI, Linux, MacOS, Os Independent, OS/2, Perl (any system
supporting perl), POSIX, Windows 2000, Windows NT
Summary: 

The Anti-Spam SMTP Proxy (ASSP) Server project aims to create an open
source platform independent SMTP Proxy server which implements whitelists
and Bayesian filtering to help stop unsolicited commercial email (UCE).
Anti-spam tools should be adaptive to new spam and customized for each
site?s email patterns. This easy to use tool works with any mail transport
and achieves these goals requiring no operator intervention after the
initial setup phase. 

5. FWReport v1.1.5
By: einhverfr
Relevant URL: http://sourceforge.net/projects/fwreport/
Platforms: Linux
Summary: 

FWReport is a log parser and reporter for IPTables. It generates daily and
monthy summaries of the log files, allowing the admin to free up
substantial time, maintain better control over security of the network, and
reduce unnoticed attacks.

6. ulogd-php v0.7
By: regit
Relevant URL: http://home.regit.org/ulogd-php.html
Platforms: Linux, POSIX
Summary: 

ulogd-php is a php interface for the MySQL plugin for the ulogd netfilter
log daemon. It displays hosts that recently broke packets on your firewall
and the last ports that were probed. A simple search function allows
packets to be searched by host or by a given port. 

VI. SPONSOR INFORMATION
-----------------------

This Issue is Sponsored by: KaVaDo
 
Your network firewall and IDS products do not prevent Web application 
attacks - the most common form of online exploitation- resulting in Web 
defacement, data theft, sabotage and fraud.
 
KaVaDo is the first and only company that provides a complete and 
integrated suite of Web application security products, allowing you to:
 - assess your entire Web environment with a Web Application Scanner, 
 - automatically set positive security policies for real-time protection, 
and
 - maintain such policies at the Application Firewall without compromising 
business performance.
 
For more information on KaVaDo and to download a FREE white paper on 
Security Policy Automation for Web Applications, please visit 
http://www.securityfocus.com/sponsor/KaVaDo_linux-secnews_030818
------------------------------------------------------------------------