SecurityFocus Linux Newsletter #153

SecurityFocus Linux Newsletter #153
------------------------------------
This Issue is Sponsored By: SecurityFocus staff

Want to keep up on the latest security vulnerabilities? Don't have time to
visit a myriad of mailing lists and websites to read the news? Just add
the new SecurityFocus RSS feeds to your freeware RSS reader, and see all
the latest posts for Bugtraq and the SF Vulnernability database in one
convenient place. Or, pull in the latest news, columnists and feature
articles in the SecurityFocus aggregated news feed, and stay on top of
what's happening in the community!

http://www.securityfocus.com/rss/index.shtml
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Demonstrating ROI for Penetration Testing (Part Four)
     2. SPECIAL ANNOUNCEMENT - RSS feeds
II. LINUX VULNERABILITY SUMMARY
     1. OpenSSL ASN.1 Parsing Vulnerabilities
     2. Silly Poker Local HOME Environment Variable Buffer Overrun V...
     3. Invision Power Board Insecure Permissions Vulnerability
     4. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
     5. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
     6. Inter7 VPopMail Configuration File Insecure Default Permissi...
     7. Conectiva Vixie-Cron Package Potential Denial Of Service Vul...
     8. XShisen '-KCONV' Local Buffer Overflow Vulnerability
     9. PrimeBase SQL Database Server Insecure Installation Temporar...
     10. PrimeBase SQL Database Server Insecure Default Binary Permis...
     11. JBoss HSQLDB Remote Command Injection Vulnerability
     12. XShisen 'XSHISENLIB' Local Buffer Overflow Vulnerability
     13. SuSE Linux SuSEWM Configuration File Insecure Temporary File...
     14. SuSE Linux JavaRunt Configuration File Insecure Temporary Fi...
     15. SLocate User-Supplied Database Heap Overflow Vulnerability
III. LINUX FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2003-10-03 to 2003-10-10.
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Sophos Anti-Virus
     2. F-Secure Policy Manager
     3. Gordano Messaging Suite
     4. LANDesk Management Suite 7
     5. ActiveScout Enterprise
     6. Immunity CANVAS
V. NEW TOOLS FOR LINUX PLATFORMS
     1. Devil-Linux v1.0-RC1
     2. NetMRG v0.10
     3. vnStat v1.2
     4. pasmal v0.4 beta
     5. MIMEDefang v2.38
     6. GKrellM v2.1.20 (GTK 2.0)
VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Demonstrating ROI for Penetration Testing (Part Four)
By Marcia Wilson

The last article in this series discusses the Penetration Testing process
and makes final assertions about how ROSI (Return on Security Investment)
can be shown.

http://www.securityfocus.com/infocus/1736

2. SPECIAL ANNOUNCEMENT

SecurityFocus is pleased to announce the relaunch of our RSS feeds.

http://www.securityfocus.com/rss/index.shtml


II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. OpenSSL ASN.1 Parsing Vulnerabilities
BugTraq ID: 8732
Remote: Yes
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8732
Summary:
Multiple vulnerabilities were reported in the ASN.1 parsing code in
OpenSSL.  OpenSSL does not directly implement ASN.1 but does use ASN.1
objects in X.509 certificates and various other cryptographic elements.
The following issues were reported:

Two flaws in the ASN.1 parser could lead to denial of service attacks.

The first bug may be exploited to cause an out of bounds read operation to
occur, most likely resulting in a denial of service.  This can be
triggered by a malformed or unusual ASN.1 tag value.  The second of the
described bugs occurs if an application is configured to ignore public key
decode errors (specifically the
X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY error).  This is reportedly
not a common configuration in production setups but some applications may
ignore decode errors for debugging reasons.  As a result, the impact and
exposure will vary depending on the targeted application and some
applications may be more vulnerable to attacks than others.  Remote
attackers can exploit this issue with a maliciously crafted SSL client
certificate.  CAN-2003-0543 and CAN-2003-0544 correspond to these two
denial of service issues.  The issues are reported to exist in SSLeay and
OpenSSL versions prior to 0.9.7c or 0.9.6k.

Another vulnerability related to ASN.1 parsing was reported in OpenSSL
0.9.7.  ASN.1 encodings that are rejected by the parser due to being
invalid may potentially trigger a memory management error.  In particular,
a double free may result due to an ASN.1 structure (ASN1_TYPE) being
deallocated incorrectly.  This reportedly could be leveraged to corrupt
stack memory.  In this manner, sensitive stack variables such as
instruction pointers could be overwritten with attacker-supplied values.
The issue could be exploited by remote attacks via a maliciously crafted
SSL client certificate.  This issue has been assigned CVE name
CAN-2003-0545.

An additional weakness was reported that may aid in exploitation of these
issues.  In some circumstances, a client may force a server to parse a
client certificate when one has not been specifically requested.  This
could even occur with server implementations that don't enable client
authentication.

Any applications which use the OpenSSL ASN.1 library to handle external
data may present an attack vector for these vulnerabilities.

These issues are pending further analysis and will be separated into
individual BIDs when analysis is complete.

It should be noted that only the k8, k9, and k91 images for Catalyst 6500
series switches and 7200 series Routers of the 12.2SX and 12.2SY release
trains are affected.

2. Silly Poker Local HOME Environment Variable Buffer Overrun V...
BugTraq ID: 8736
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8736
Summary:
Silly Poker is a simple poker card game developed for the Linux operating
system. It has been reported that on the Debian Linux distribution, the
sillypoker binary is installed setgid games by default.

*** It should be noted that new details released suggest that the
sillypoker binary is in fact not installed setgid games on Debian systems.
As such, the impact of this issue may be greatly limited.

A local buffer overrun vulnerability has been reported for Silly Poker.
The problem occurs due to insufficient bounds checking when handling
user-supplied data. As a result, an attacker may be capable of controlling
the execution flow of the sillypoker program and effectively executing
arbitrary code with elevated privileges.

Exploiting this condition may allow an attacker to gain group 'games'
privileges which could be used to modify sensitive information or could be
used to leverage attacks against other previously inaccessible utilities.

3. Invision Power Board Insecure Permissions Vulnerability
BugTraq ID: 8737
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8737
Summary:
Invision Power Board is web forum software. It is implemented in PHP and
is available for Unix and Linux variants and Microsoft Windows operating
systems.

Invision Power Board has been reported prone to a configuration issue that
could allow attackers with local interactive access to modify Invision
Power Board '.php' source files. The issue has been reported to present
itself because Invision Power Board does not correctly set permissions on
folders during the installation process. Specifically all folders are
created with group write permissions. Any local user who is a member of
the same group as Invision Power Board may make modifications to Invision
Power Board source files.

A local attacker may exploit this condition to execute arbitrary code with
the privileges of the web server.

It should be noted that although this vulnerability has been reported to
affect Invision Power Board versions 1.1.1 and 1.1.2, other versions might
also be affected.

4. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
BugTraq ID: 8742
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8742
Summary:
IBM DB2 is a commercial relational database implementation that is
available for a number of operating systems including Microsoft Windows
and Unix/Linux variants.

IBM DB2 includes the LOAD command, which allows for data located in files,
pipes or devices to be stored within a database table. It has been
discovered that the application fails to carry out sufficient bounds
checking when handling the LOAD command.

An attacker with 'Connect' privileges could exploit this vulnerability
remotely, likely by passing excessive data as an argument to the LOAD
command. This would allow for sensitive stack variables adjacent to the
affected memory buffer to be overrun. An attacker could leverage this
memory corruption to influence the execution flow of IBM DB2, possibly
redirecting execution into a malicious payload.

All code executed in this manner will be run with the privileges of the
IBM DB2 process. This is typically the 'Administrators' group on Microsoft
Windows environments and either the 'db2as' or 'db2inst1' users on Linux
systems.

It should be noted that IBM has confirmed that the affected code is shared
amongst IBM DB2 v7 and v8, making both vulnerable to this condition.

5. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
BugTraq ID: 8743
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8743
Summary:
DB2 is the database implementation maintained and distributed by IBM.  It
is available for the UNIX, Linux, and Microsoft Windows platforms.

A problem in IBM DB2 has been reported when specific queries are passed to
the INVOKE stored procedure.  Because of this, an attacker may be able to
gain unauthorized access to system resources.

The problem is in the checking of bounds on the INVOKE stored procedure.
By passing a maliciously crafted string to the procedure, it is possible
to overwrite sensitive regions of stack memory.  An attacker could take
advantage of this issue to execute code at an arbitrary location in memory
with the privileges of the database process.

This problem has been reported to occur in version 7.2 for Microsoft
Windows only.

6. Inter7 VPopMail Configuration File Insecure Default Permissi...
BugTraq ID: 8751
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8751
Summary:
vpopmail is a freely available, open source virtual domain handling
software package.  It is available for the Unix and Linux operating
systems.

A problem has been identified in the default configuration of vpopmail.
Because of this, an attacker may be able to gain access to potentially
sensitive information.

The problem is in the creation of the configuration file.  When vpopmail
is compiled with MySQL support, authentication data is stored in the
/etc/vpopmail.conf file.  This file is created with world-readable
permissions, which may reveal sensitive information such as authentication
credentials for the database.  An attacker could use these credentials to
potentially gain access to the database as the vpopmail database user.

This problem has been reported on Gentoo Linux, but may affect other
operating systems.

7. Conectiva Vixie-Cron Package Potential Denial Of Service Vul...
BugTraq ID: 8759
Remote: No
Date Published: Oct 03 2003
Relevant URL: http://www.securityfocus.com/bid/8759
Summary:
Vixie cron is an implementation of the popular UNIX program that runs
user-specified programs at periodic scheduled times.

The Conectiva Vixie-Cron package has been reported prone to a potential
denial of service vulnerability. The issue was introduced in a previous
Vixie-Cron package update that was designed to address the vulnerability
described in BID 2687. This package was found to introduce a problem
whilst using cron.allow and cron.deny, to control access to the crontab
application. It has been reported that if these files contain more than
one user the crontab program will fail.

A local attacker, who has the ability to write data into cron.allow and
cron.deny files, may instigate an efficient denial of service against the
crontab program.

Conectiva has addressed this issue by releasing an updated package; all
users are advised to apply the applicable packages as soon as possible.

8. XShisen '-KCONV' Local Buffer Overflow Vulnerability
BugTraq ID: 8770
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8770
Summary:
XShisen is a puzzle game that is played with 144 mahjong pieces.  The
software runs on the Linux platform and a Microsoft Windows binary is
available as well.

It has been reported that XShisen is prone to a buffer overflow issue that
may allow an attacker to gain unauthorized access to a host running the
vulnerable software.

The problem is present due to improper handling of user-supplied data from
'-KCONV' command line parameter.  A buffer overflow condition may be
caused by supplying more than 100 bytes of data.  The conditions are
present due to insufficient boundary checking. An attacker may leverage
the issues by exploiting an unbounded memory copy operation to overwrite
the saved return address/base pointer, causing the affected procedures to
return to an address of their choice.

Successful exploitation may allow an attacker to ultimately execute
arbitrary code in the context of the user who is running the vulnerable
software in order to gain unauthorized access to a system.

XShisen version 1.51 has been reported to be prone to these issue however
other versions may be affected as well.

9. PrimeBase SQL Database Server Insecure Installation Temporar...
BugTraq ID: 8771
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8771
Summary:
PrimeBase SQL Database Server is a database implementation that is
available for Unix/Linux variants as well as Microsoft Windows platforms.

PrimeBase SQL Database Server is reported to create temporary files in an
insecure manner during installation.  A malicious local user could take
advantage of this issue to cause files to be corrupted during the initial
database installation.  In particular, the following temporary file is
created during installation:

/tmp/PrimeBase.log

If a local attacker can anticipate the installation of PrimeBase, this
issue can be exploited by creating a symbolic link in place of the
temporary file that points to another file on the system.  When the
PrimeBase database is installed by root, the file pointed to by the
symbolic link will be corrupted.

Exploitation could result in destruction of data.  A potential for
privilege escalation attacks also exists if files can be corrupted with
custom data.

This issue was reported for PrimeBase running on Unix/Linux variants.

10. PrimeBase SQL Database Server Insecure Default Binary Permis...
BugTraq ID: 8772
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8772
Summary:
PrimeBase SQL Database Server is a database implementation that is
available for Unix/Linux variants as well as Microsoft Windows platforms.

The PrimeBase SQL Database Server binary is installed with world-writeable
permissions by default.  This binary is typically installed as
/usr/local/primebase.  A local attacker could take advantage of this issue
to execute arbitrary code by replacing or modifying the binary,
potentially allowing for privilege escalation.  If the binary is modified
or replaced, it will be executed when the database is restarted.

This issue was reported for PrimeBase running on Unix/Linux variants.

11. JBoss HSQLDB Remote Command Injection Vulnerability
BugTraq ID: 8773
Remote: Yes
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8773
Summary:
JBoss is a freely available, open source Java Application server. It is
distributed and maintained by JBoss Group and is available for a number of
platforms including Microsoft Windows and Unix/Linux variants.

A remote command injection vulnerability has been reported in JBoss.  The
issue is reportedly exposed via the HSQLDB component, which is a SQL
database server that manages JMS connections.  A number of unspecified
flaws cause this condition, including programming errors in the sun.*
classes, logic errors in the org.apache.* classes of the JDK and the
default configuration settings.  As a result, it is possible to pass
commands to the HSQLDB component via the port it listens on.  It should be
noted that the port may vary between versions, by default it is 1701/TCP
for version 3.2.1 and 1476/TCP for 3.0.8.

It has been reported that this issue could be exploited to mount a number
of attacks, including execution of database commands, denial of service
attacks, log manipulation, information disclosure and execution of
operating system commands on some supported platforms.

This issue is reported to exist with JBoss 3.2.1/3.0.8 on any Java
1.4.x-enabled platforms.  Other versions may be similarly affected.

The consequences may vary depending on the capabilities of the underlying
operating system, but it is believed that this could be exploited to
execute arbitrary operating system commands on Windows 2000 and XP
systems.

12. XShisen 'XSHISENLIB' Local Buffer Overflow Vulnerability
BugTraq ID: 8776
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8776
Summary:
XShisen is a puzzle game that is played with 144 mahjong pieces.  The
software runs on the Linux platform and a Microsoft Windows binary is
available as well.

It has been reported that XShisen is prone to a buffer overflow issue that
may allow an attacker to gain unauthorized access to a host running the
vulnerable software.

The problem present in 'XSHISENLIB' envrionment variable is due to
improper handling of user-supplied data.  A buffer overflow condition may
be caused by supplying more than 100 bytes of data.  The conditions are
present due to insufficient boundary checking. An attacker may leverage
the issues by exploiting an unbounded memory copy operation to overwrite
the saved return address/base pointer, causing the affected procedures to
return to an address of their choice.

Successful exploitation may allow an attacker to ultimately execute
arbitrary code in the context of the user who is running the vulnerable
software in order to gain unauthorized access to a system.

XShisen version 1.51 has been reported to be prone to these issue however
other versions may be affected as well.

13. SuSE Linux SuSEWM Configuration File Insecure Temporary File...
BugTraq ID: 8778
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8778
Summary:
SuSEConfig is a component of the SuSE Linux operating system.  It is
designed to be a standardized configuration tool to SuSE operating
systems.

A problem exists in the SuSEWM configuration file used by SuSEConfig.
Because of this, it may be possible for a local attacker to gain elevated
privileges.

The problem is in the handling of temporary files.  When the configuration
file is executed by SuSEConfig, the predictable temporary file
/tmp/susewm.$$ is created, where $$ signifies an arbitrary value.
Improper file creation checks make it possible for an attacker to
symbolically link a predicted file name to a sensitive system file.  Upon
execution of SuSEConfig, the contents of the file at the end of the
symbolic link will be modified.

The reported impact is privilege escalation, though the method through
which this is gained is unclear.  This BID will be further updated as more
information becomes available.

14. SuSE Linux JavaRunt Configuration File Insecure Temporary Fi...
BugTraq ID: 8779
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8779
Summary:
SuSEConfig is a component of the SuSE Linux operating system.  It is
designed to be a standardized configuration tool to SuSE operating
systems.

A problem exists in the JavaRunt configuration file used by SuSEConfig.
Because of this, it may be possible for a local attacker to gain elevated
privileges.

The problem is in the handling of temporary files.  When the configuration
file is executed by SuSEConfig, the predictable temporary file
/tmp/.java_wrapper is created.  Improper file creation checks make it
possible for an attacker to symbolically link the predicted file name to a
sensitive system file.  Upon execution of SuSEConfig, the contents of the
file at the end of the symbolic link will be corrupted, potentially with
attacker-supplied data.  Exploitation could permit privilege escalation.

The reported impact is privilege escalation, though the method through
which this is gained is unclear.  This BID will be further updated as more
information becomes available.

15. SLocate User-Supplied Database Heap Overflow Vulnerability
BugTraq ID: 8780
Remote: No
Date Published: Oct 06 2003
Relevant URL: http://www.securityfocus.com/bid/8780
Summary:
slocate is the Secure Locate program. It is available for various UNIX and
Linux operating systems, and is maintained by public domain.

It has been reported that a vulnerability exists in the handling of
user-supplied databases by slocate.  Because of this, an attacker may be
able to gain elevated privileges.

The problem is a heap-based off-by-one condition.  Because of this, it is
possible for an attacker to potentially overwrite memory management
structures with attacker-supplied values.  This could allow an attacker to
execute code with the privileges of the slocate program, typically
installed with setgid privileges of the slocate group.

This problem may be related to the issue identified in Bugtraq ID 7629.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
NO NEW POSTS FOR THE WEEK 2003-10-03 to 2003-10-10.


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Sophos Anti-Virus
By: Sophos
Platforms: AIX, DOS, FreeBSD, HP-UX, Linux, MacOS, Netware, OS/2, Solaris,
UNIX, VMS, Windows 3.x, Windows 95/98, Windows NT
Relevant URL: http://www.sophos.com/products/sav/
Summary:

Sophos Anti-Virus is a unique solution to the virus problem, providing
true cross-platform protection in a single, fully integrated product. The
network-centric design provides a host of benefits for the protection of
servers, workstations and portables. Sophos's ground-breaking architecture
maximises protection, while minimising performance and administrative
overheads.

2. F-Secure Policy Manager
By: F-Secure Corporation
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.f-secure.com/products/policy-man/index.shtml
Summary:

With F-Secure Policy Manager, your system administrator can manage all the
critical security applications from antivirus protection to file and
network encryption from one single console. The administrator can
automatically and remotely install, configure and update the applications.
It is possible to manage the security applications on almost any device
and across the enterprise so that even the security of mobile workers'
laptops is guaranteed. In addition to all this, the administrator can
easily monitor the network by generating extensive reports on the security
status of the network.

3. Gordano Messaging Suite
By: Gordano
Platforms: AIX, Linux, Solaris, Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.gordano.com/
Summary:

Gordano's Messaging Suite provides robust and secure email, instant and
SMS messaging for small, medium and large businesses.

4. LANDesk Management Suite 7
By: LANDesk Software
Platforms: AIX, HP-UX, Linux, MacOS, Solaris, Windows 2000, Windows 95/98,
Windows NT, Windows XP
Relevant URL: http://www.landesk.com/products/ilms/
Summary:

LANDesk Management Suite 7 is a comprehensive, integrated management
solution that's easy to use. Enabling proactive management of desktops,
server and mobile devices across heterogeneous IT environments.
 - Keep up with security patches and virus updates
 - Efficiently install and maintain software on the desktop
 - Decrease software license costs and respond to audits
 - Reduce the cost of helpdesk support
 - Discover and manage hardware and software assets
 - Migrate many users and their profiles to new operating systems

5. ActiveScout Enterprise
By: ForeScout Technologies
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.forescout.com/enterprise.html
Summary:

ActiveScout Enterprises actively protects a network with multiple access
points. In addition to the identification of attackers and automatic
action to stop them, this solution offers full management capabilities,
from configuration and reporting, to the sharing of threat information
between multiple deployed scouts.

6. Immunity CANVAS
By: Immunity, Inc.
Platforms: Linux, Windows 2000
Relevant URL: http://www.immunitysec.com/CANVAS/
Summary:

Immunity CANVAS is 100% pure Python, and every license includes full
access to the entire CANVAS codebase. Python is one of the easiest
languages to learn, so even novice programmers can be productive on the
CANVAS API, should they so chose.

Immunity CANVAS is both a valuable demonstration tool for enterprise
information security teams or system adminstrators, and an advanced
development platform for exploit developers, or people learning to become
exploit developers.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Devil-Linux v1.0-RC1
By: Heiko Zuerker <[email protected]>
Relevant URL: http://www.devil-linux.org/download.htm
Platforms: Linux
Summary:

Devil-Linux is a special Linux distribution which is used for
firewalls/routers. The goal of Devil-Linux is to have a small,
customizable, and secure Linux system. Configuration is saved on a floppy
disk, and it has several optional packages.

2. NetMRG v0.10
By: Brady Alleman
Relevant URL: http://www.netmrg.net/
Platforms: Linux
Summary:

NetMRG is a network monitoring, reporting, and graphing system. Using
MySQL, PHP, C++, pthreads, and RRDTOOL, it is capable of monitoring
thousands of variables on five-minute intervals. Graph templating allows
network admins to begin monitoring devices with minimal overhead. NetMRG
is also capable of responding to programmable events, such as variables
exceeding accepted tolerances. It can accommodate server hosting and
Internet service provider environments with different users allowed to
view only their own equipment's graphs.

3. vnStat v1.2
By: Vergo
Relevant URL: http://torus.lnet.lut.fi/vnstat/
Platforms: Linux
Summary:

vnStat is a console-base network traffic monitor that keeps a log of daily
and monthly network traffic for the selected interface. However, it isn't
a packet sniffer. The traffic information is analyzed from the /proc
-filesystem, so that vnStat can be used without root permissions.

4. pasmal v0.4 beta
By: James Meehan
Relevant URL: http://www.sourceforge.net/projects/pasmal/
Platforms: Linux, POSIX
Summary:

pasmal is a TCP/IP packet authentication system. When it receives a
sequence of ICMP or TCP packets to any port (open/closed), it will issue a
command on the server.

5. MIMEDefang v2.38
By: David F. Skoll
Relevant URL: http://www.mimedefang.org/
Platforms: Linux, Perl (any system supporting perl), UNIX
Summary:

MIMEDefang is a flexible MIME e-mail scanner designed to protect Windows
clients from viruses. It can alter or delete various parts of a MIME
message according to a very flexible configuration file. It can also
bounce messages with unnaceptable attachments. MIMEDefang works with
Sendmail 8.11's new "Milter" API, which gives it much more flexibility
than procmail-based approaches.

6. GKrellM v2.1.20 (GTK 2.0)
By: Bill Wilson
Relevant URL: http://www.gkrellm.net/
Platforms: FreeBSD, Linux, NetBSD, OpenBSD, Solaris, SunOS
Summary:

GKrellM is a GTK-based stacked monitor program that charts SMP CPUs,
disks, load, active net interfaces, and internet connections. There are
also builtin monitors for memory and swap, file systems with mount/umount
feature, mailbox checking including POP3 and IMAP, clock/calendar, laptop
battery, sensors (temperatures, voltages, and fans), and uptime. It has
LEDs for the net monitors and an on/off button and online timer for PPP.
There is a GUI popup for configuration, plugin extensions can be
installed, and many themes are available. It also features a client/server
monitoring capability.


VI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored By: SecurityFocus staff

Want to keep up on the latest security vulnerabilities? Don't have time to
visit a myriad of mailing lists and websites to read the news? Just add
the new SecurityFocus RSS feeds to your freeware RSS reader, and see all
the latest posts for Bugtraq and the SF Vulnernability database in one
convenient place. Or, pull in the latest news, columnists and feature
articles in the SecurityFocus aggregated news feed, and stay on top of
what's happening in the community!

http://www.securityfocus.com/rss/index.shtml
------------------------------------------------------------------------