SecurityFocus Linux Newsletter #157

SecurityFocus Linux Newsletter #157
------------------------------------
This Issue is Sponsored by: SpiDynamics

ALERT: Are you open to a Web Application Attack?- Free Product Trial
WebInspect employs threat agents to simulate attackers analyzing your web
server, formulating attacks and applying them to determine if
vulnerabilities exist.

Run a FREE Test of your Web Apps via our FREE 15 Day Product Trial that
delivers a comprehensive Vulnerability Report.
http://www.securityfocus.com/sponsor/SPIDynamics_linux-secnews_031110
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Oracle Row Level Security: Part 1
     2. Wireless Intrusion Detection Systems
     3. Security's Brewing Mess
II. LINUX VULNERABILITY SUMMARY
     1. Sun Java Installation File Corruption Vulnerability
     2. Cups Internet Printing Protocol Job Loop Denial Of Service V...
     3. Bugzilla Multiple Vulnerabilities
     4. Nullsoft SHOUTcast icy-name/icy-url Memory Corruption Vulner...
     5. Synthetic Reality SymPoll Cross-Site Scripting Vulnerability
     6. MPM Guestbook Cross-Site Scripting Vulnerability
     7. PHPKit Include.PHP Cross-Site Scripting Vulnerability
     8. PHPRecipeBook Unspecified Cross-Site Scripting/HTML Injectio...
     9. OpenSSL ASN.1 Large Recursion Remote Denial Of Service Vulne...
     10. CDE LibDTHelp DTHelpUserSearchPath Local Buffer Overflow Vul...
     11. OpenBSD Local Malformed Binary Execution Denial of Service V...
     12. X-CD-Roast Local Insecure File Creation Symlink Vulnerabilit...
     13. Linux Kernel Trojan Horse Vulnerability
     14. Ganglia gmond Malformed Packet Remote Denial of Service Vuln...
III. LINUX FOCUS LIST SUMMARY
     1. Relay control in qmail (Thread)
     2. [despammed] Re: Relay control in qmail (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Sophos Anti-Virus
     2. ActiveScout Enterprise
     3. Immunity CANVAS
     4. SecretAgent
     5. Cyber-Ark  Inter-Business Vault
     6. EnCase Forensic Edition
V. NEW TOOLS FOR LINUX PLATFORMS
     1. Pathalizer v0.6
     2. darkstat v2.6
     3. mod_parmguard v1.2
     4. SEPPL  v 0.2
     5. Nessus v2.0.9
     6. pmacct v0.5.2
VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Oracle Row Level Security: Part 1
By Pete Finnigan

This paper explores the row level security feature added to Oracle 8i and
above, and provides examples. One of the main uses of row level security
is to allow all of a company's data to be stored in one database for
different departments, or for a hosting company to store data for
different companies in one database. Part One.

http://www.securityfocus.com/infocus/1743

2. Wireless Intrusion Detection Systems
By Jamil Farshchi

This paper will describe the need for wireless intrusion detection,
provide an explanation of wireless intrusion detection systems, and
identify the benefits and drawbacks of a wireless intrusion detection
solution.

http://www.securityfocus.com/infocus/1742

3. Security's Brewing Mess
By Hal Flynn

What do low-level programming languages have in common with a scalding hot
cup of coffee? Nothing that a little Java won't cure.

http://www.securityfocus.com/columnists/196


II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. Sun Java Installation File Corruption Vulnerability
BugTraq ID: 8937
Remote: No
Date Published: Oct 31 2003
Relevant URL: http://www.securityfocus.com/bid/8937
Summary:
Sun Java implementations are reported to create temporary files in an
insecure manner when the software is installed.  A local attacker could
exploit this issue to corrupt files owned by the user installing the
software, most likely resulting in a denial of service.

The source of these issues is the Java unpack program and the
postinstaller.  The unpack program is reported to create /tmp/unpack.log.
The postinstaller creates /tmp/.mailcap1 and /tmp/.mime.types1.  It is
possible to exploit the vulnerability by placing a malicious symbolic link
in the temporary directory that is named after these files.  The symbolic
link must point to a file that is owned by the user who will be installing
Java (which is typically the root user).

It is not known if these issues could be exploited to write custom data to
files, which could result in privilege escalation, though it is deemed
unlikely that this is possible.

This issue was reported in Sun JRE and SDK 1.4.2 for Linux platforms.
Other versions and platforms may also be affected.

2. Cups Internet Printing Protocol Job Loop Denial Of Service V...
BugTraq ID: 8952
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8952
Summary:
CUPS is a freely available, open source UNIX printing utility.  It is
freely available for the Unix and Linux platforms.

A problem has been identified in the handling of requests via CUPS
Internet Printing Protocol (IPP).  Because of this, it is possible for an
attacker to deny service to legitimate users.

The specifics of the problem are not currently available.  It is known
that an attacker must have the ability to connect to the vulnerable
service on the IPP port, and that submitting a specially-crafted request
can result in a busy loop of the software.  This issue may be related to
Bugtraq ID 7637, and will be further updated when additional details
become available.

3. Bugzilla Multiple Vulnerabilities
BugTraq ID: 8953
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8953
Summary:
Bugzilla is a freely available, open source bug tracking software package.
It is available for Linux, Unix, and Microsoft Windows operating systems.

Multiple vulnerabilities has been reported to exist in the software.  The
issues include SQL injection, unauthorized privileges, and information
disclosure.

A SQL injection issue has been reported to be present in the nightly
statistics cron job called collectstats.pl.  A user with 'editproducts'
privileges which are usually granted to administrators may be to carry out
SQL injection attacks. This issue affects Bugzilla versions 2.16.3 and
earlier.

Another SQL injection vulnerability has been reported that may allow a
user with 'editkeywords' privileges which are usually granted to
administrators.  An attacker may be able to inject arbitrary SQL code in
the underlying database through the URL used to edit an existing keyword.
This issue affects Bugzilla versions 2.16.3 and earlier and 2.17.1 through
2.17.4.

A vulnerability has been reported that may allow users to retain
privileges that were previously granted.  This issue may occur when
products are being deleted.  If the 'usebuggroups' parameter was selected,
users may still be able to add others to the group that is being deleted.
If another group is created that reuses the group id from the group being
deleted, they may automatically inherit privileges granted to the group.
This vulnerability only allows users that had those privileges before to
retain them.  This issue affects Bugzilla versions 2.16.3 and earlier.

An information disclosure issue has been reported that may allow an
attacker to view restricted bugs stored in the database.  It has been
reported that if an attacker knows the e-mail address of a user who has
voted on a secure or restricted bug they may be able to view the summary
of the bug without having sufficient permissions.  This issue affects
Bugzilla versions 2.16.3 and earlier and 2.17.1 through 2.17.4.

Another information disclosure issue has been reported that may allow an
attacker to disclose component descriptions for a product without proper
authorization.  This issue affects Bugzilla versions 2.17.3 and 2.17.4.

4. Nullsoft SHOUTcast icy-name/icy-url Memory Corruption Vulner...
BugTraq ID: 8954
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8954
Summary:
Nullsoft SHOUTCast Server is used to broadcast Shoutcast music. It is
available for Unix and Linux operating systems, as well as Microsoft
Windows.

Nullsoft SHOUTcast Server is prone to a memory corruption vulnerability
that may lead to denial of service attacks or code execution.

Insufficient bounds checking of the icy-name and icy-url server commands
may allow a remote authenticated user to corrupt memory.  It has been
reported that the attacker must issue overly long arguments for both these
commands during a connection to the server.  Doing so will cause adjacent
regions of memory to be corrupted, which will mostly likely result in a
denial of service but could potentially be exploited to execute arbitrary
code.

This issue was reported in SHOUTcast 1.9.2 on Windows platforms.  Other
versions and platforms may also be affected.

5. Synthetic Reality SymPoll Cross-Site Scripting Vulnerability
BugTraq ID: 8956
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8956
Summary:
Sympoll is web-based voting booth software. It is implemented in PHP and
will run on most Unix and Linux variants as well as Microsoft Windows
operating systems.

A cross-site scripting vulnerability has been reported in the software.

The problem is reported to exist due to improper handling of user-supplied
data through the 'vo' parameter.  HTML and script code will be rendered in
a user's browser, therefore making it possible for an attacker to a
construct a malicious link containing HTML or script code that may be
rendered in a user's browser upon visiting that link. This attack would
occur in the security context of the site.

Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.

Sympoll version 1.5 is reported to be prone to this issue, however other
versions may be affected as well.

6. MPM Guestbook Cross-Site Scripting Vulnerability
BugTraq ID: 8958
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8958
Summary:
MPM Guestbook is a freely available web application.  It is implemented in
PHP and available for Unix/Linux variants as well as Microsoft Windows
platforms.

MPM Guestbook is reported to be prone to a cross-site scripting
vulnerability.  This is due to insufficient sanitization of HTML from URI
parameters, which will be displayed in web pages that are dynamically
generated by the software.  In particular, the 'lng' URI parameter is not
filtered.

An attacker could exploit this issue by enticing a victim user to follow a
malicious link that includes HTML and script code as a value for the
vulnerable URI parameter.  The attacker-supplied code could be rendered in
the victim's browser in the context of the site hosting the software.
This could theoretically allow for theft of cookie-based authentication
credentials.  The attacker may also influence how the guestbook is
rendered to the user following the link, allowing for a variety of other
attacks.

7. PHPKit Include.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 8960
Remote: Yes
Date Published: Nov 02 2003
Relevant URL: http://www.securityfocus.com/bid/8960
Summary:
PHPKIT is content management software.  It is implemented in PHP and
available for Unix/Linux variants as well as Microsoft Windows.

PHPKIT is reported to be prone to a cross-site scripting vulnerability.
This is due to insufficient sanitization of HTML from URI parameters,
which will be displayed in web pages that are dynamically generated by the
software.  The issue exists in the 'include.php' script and is specific to
the 'contact_email' URI parameter.

An attacker could exploit this issue by enticing a victim user to follow a
malicious link that includes HTML and script code as a value for the
vulnerable URI parameter.  The attacker-supplied code could be rendered in
the victim's browser in the context of the site hosting the software.
This could theoretically allow for theft of cookie-based authentication
credentials.  The attacker may also influence how the site is rendered to
the user following the link, allowing for a variety of other attacks.

8. PHPRecipeBook Unspecified Cross-Site Scripting/HTML Injectio...
BugTraq ID: 8963
Remote: Yes
Date Published: Nov 03 2003
Relevant URL: http://www.securityfocus.com/bid/8963
Summary:
PHPRecipeBook is a web application for managing recipes.  It is
implemented in PHP and available for Unix/Linux and Microsoft Windows.

PHPRecipeBook 2.18 has been released to address an unspecified cross-site
scripting vulnerability.  This issue is likely due to insufficient
sanitization of HTML from URI parameters, which will be displayed in web
pages that are dynamically generated by the software.

An attacker could exploit this issue by enticing a user to follow a
malicious link.  This could theoretically allow for theft of cookie-based
authentication credentials or other attacks.

An attacker could possibly exploit this issue by enticing a victim user to
follow a malicious link that includes HTML and script code as a value for
the vulnerable URI parameter.  The attacker-supplied code could be
rendered in the victim's browser in the context of the site hosting the
software.  This could theoretically allow for theft of cookie-based
authentication credentials.  The attacker may also influence how the site
is rendered to the user following the link, allowing for a variety of
other attacks.

It should also be noted that the vendor has reported that HTML and script
code will now be sanitized (as of version 2.18) before being included in
recipes as a measure to mitigate against potential HTML injection attacks.
This could allow users to inject hostile HTML into a PHPRecipeBook site if
successfully exploited.

9. OpenSSL ASN.1 Large Recursion Remote Denial Of Service Vulne...
BugTraq ID: 8970
Remote: Yes
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8970
Summary:
OpenSSL is a freely available, open source implementation of Secure Socket
Layer tools.  It is available for the Unix, Linux, and Microsoft
platforms.

A problem has been identified in OpenSSL when handling specific types of
ASN.1 requests.  This may result in remote attackers creating a denial of
service condition.

The problem is in the handling of specific types of requests when handling
ASN.1 data that causes large recursion.  Though specifics of how this
occurs are not available, it has been reported that this can result in a
crash of OpenSSL.  This could potentially lead to an attacker crashing a
service that uses an implementation of the vulnerable software.

This issue is also known to affect numerous Cisco products.  It is
possible that other vendors will also be acknowledging this issue and
providing fixes.

10. CDE LibDTHelp DTHelpUserSearchPath Local Buffer Overflow Vul...
BugTraq ID: 8973
Remote: No
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8973
Summary:
Common Desktop Environment (CDE) is a commercially-available desktop
environment for the Unix and Linux operating systems.

A problem has been identified in CDE libDtHelp.  Because of this, it may
be possible for a local attacker to gain elevated privileges.

The problem is in the handling of data in the DTHELPUSERSEARCHPATH
environment variable.  Due to insufficient bounds checking, it is possible
to corrupt system memory, potentially overwriting sensitive values.  As a
result, it may be possible for a local attacker to execute arbitrary code.

Applications linked against libDtHelp are typically installed with setuid
root privileges.  An attacker taking advantage of this issue could
therefore potentially gain administrative access on a vulnerable system.

This issue may be related to Bugtraq ID 7730, although this has not been
confirmed by Symantec.

11. OpenBSD Local Malformed Binary Execution Denial of Service V...
BugTraq ID: 8978
Remote: No
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8978
Summary:
iBCS2 (Intel Binary Compatibility Specification 2) is a binary
compatibility format designed commonly used by SCO and ISC binaries. ELF
is the executable and linkable format which is the default binary format
used on Unix and Linux operating systems.

The OpenBSD has recently fixed a vulnerability in the OpenBSD kernel when
handling iBCS2 binaries. The problem occurs within the ibcs2_exec.c source
file and is due to insufficient sanity checks before allocating memory via
malloc(), using the xe_segsize binary parameter.

The precise technical details regarding this issue are currently unknown,
however it is believed that a segment table size (xe_segsize) value
greater than the maximum allowable number of segments (16) could
potentially cause malloc() to fail and under some circumstances return 0.

Because sufficient checks of the return value of malloc() are not carried
out, an unexpected value may be used in future calculations, effectively
triggering a kernel panic.

An additional issue was also addressed in exec_elf.c that could
potentially result in a kernel panic. This particular problem also
involved insufficient checks before calling malloc(), in this case with
the ELF program header size value as an argument. If a malicious binary
with a malformed size were handled, this may cause an unexpected
calculation in the code, effectively triggering a kernel panic.

The OpenBSD team has addressed this issue by verifying the size of the two
size values prior to calling the malloc() function.

An attacker could exploit this condition by constructing a malicious iBCS2
or ELF binary. It should be noted that, in the case of an iBCS2 binary,
support for the format would explicitly need to supported by the kernel
configuration.

*** November 5, 2003 - New information discovered by the researcher
suggests that the implications of this vulnerability could in fact be
higher then initially anticipated. As such, it is believed that successful
exploitation of this issue under some conditions could potentially lead to
code execution within the context of the kernel. This has been conjectured
due to varying crashes observed when triggering the condition. Due to the
lack of details regarding this possiblity, the status of this BID will
remain the same until more information is available.

12. X-CD-Roast Local Insecure File Creation Symlink Vulnerabilit...
BugTraq ID: 8983
Remote: No
Date Published: Nov 04 2003
Relevant URL: http://www.securityfocus.com/bid/8983
Summary:
X-CD-Roast is a freely available CD burning utility available for Linux
and Unix based systems.

X-CD-Roast has been reported prone to an insecure file creation
vulnerability that may be exploited to corrupt arbitrary files. The issue
has been reported to present itself because X-CD-Roast will follow
symbolic links when writing certain specific files. The problem is also
conjectured to be exaggerated as a result of a lack of sufficient access
controls set by X-CD-Roast on the files that it creates and employs.

Ultimately a local user may exploit this condition by creating a symbolic
link in the place of the vulnerable X-CD-Roast file. The malicious
symbolic link will point to an arbitrary file on the system. When an
unsuspecting user invokes X-CD-Roast the file linked by the symbolic link
will be corrupted, the file corruption will occur only if the user
invoking X-CD-Roast has sufficient privileges to write to the target file.
A local user may leverage this condition to corrupt arbitrary files
triggering a system wide denial of service or potentially elevating their
system privileges.

13. Linux Kernel Trojan Horse Vulnerability
BugTraq ID: 8987
Remote: No
Date Published: Nov 05 2003
Relevant URL: http://www.securityfocus.com/bid/8987
Summary:
It has been announced that a file 'kernel/exit.c' was modified on the
kernel.bkbits.net Linux Kernel CVS tree by a malicious party. The file
'kernel/exit.c' was modified to include trojan horse code that would
potentially allow a local user to elevate privileges.

Specifically, when '__WCLONE|__WALL' is passed to the sys_wait4() function
in a sufficient manner a malicious procedure in the trojaned kernel
'current->uid = 0' is performed to elevate the malicious user to uid '0'
or root system privileges.

It is not currently known what version of the Linux kernel is affected by
this issue. This BID will be updated as further information regarding this
issue is disclosed.

14. Ganglia gmond Malformed Packet Remote Denial of Service Vuln...
BugTraq ID: 8988
Remote: Yes
Date Published: Nov 06 2003
Relevant URL: http://www.securityfocus.com/bid/8988
Summary:
Ganglia Monitoring Daemon (gmond) is cluster monitoring software available
for a wide variety of Unix-based operating systems, as well as Linux.

When a user transmits a packet to the gmond service, advertising a metric,
a hashing function handles the packet. The advertisement packet, when
transmitted from an official client, will include a name string that will
be a minimum of 2 bytes; 1 character followed by a NULL byte. The hashval
function, located within the lib/hash.c source file, parses the string
name and attempts to calculate the hash value within a for loop. The
calculated value is then used as an index into a specific array of hashes.

A vulnerability has been discovered in this procedure that could
potentially result in a denial of service condition. The problem occurs
when a malformed packet from a modified client or custom program is
transmitted with a 1 byte name string. When the hashval function handles
this packet, due to the unexpected name string size, the calculated value
will not be run through a modulus operation designed to ensure the value
is a legitimate index. As a result, a 1 byte number of greater size than a
valid index could potentially cause an unexpected calculation or invalid
pointer dereference.

It has been reported that due to this miscalculation, the gmond service
will crash when attempting to lock access to the hash entry by locking the
data at the calculated pointer. This would effectively result in a denial
of service condition.

This vulnerability is said to affected gmond version 2.5.3 however, other
versions may also be affected.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Relay control in qmail (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/343656

2. [despammed] Re: Relay control in qmail (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/343654


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Sophos Anti-Virus
By: Sophos
Platforms: AIX, DOS, FreeBSD, HP-UX, Linux, MacOS, Netware, OS/2, Solaris,
UNIX, VMS, Windows 3.x, Windows 95/98, Windows NT
Relevant URL: http://www.sophos.com/products/sav/
Summary:

Sophos Anti-Virus is a unique solution to the virus problem, providing
true cross-platform protection in a single, fully integrated product. The
network-centric design provides a host of benefits for the protection of
servers, workstations and portables. Sophos's ground-breaking architecture
maximises protection, while minimising performance and administrative
overheads.

2. ActiveScout Enterprise
By: ForeScout Technologies
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.forescout.com/enterprise.html
Summary:

ActiveScout Enterprises actively protects a network with multiple access
points. In addition to the identification of attackers and automatic
action to stop them, this solution offers full management capabilities,
from configuration and reporting, to the sharing of threat information
between multiple deployed scouts.

3. Immunity CANVAS
By: Immunity, Inc.
Platforms: Linux, Windows 2000
Relevant URL: http://www.immunitysec.com/CANVAS/
Summary:

Immunity CANVAS is 100% pure Python, and every license includes full
access to the entire CANVAS codebase. Python is one of the easiest
languages to learn, so even novice programmers can be productive on the
CANVAS API, should they so chose.

Immunity CANVAS is both a valuable demonstration tool for enterprise
information security teams or system adminstrators, and an advanced
development platform for exploit developers, or people learning to become
exploit developers.

4. SecretAgent
By: Information Security Corporation (ISC)
Platforms: Linux, MacOS, UNIX, Windows 2000, Windows 95/98, Windows NT,
Windows XP
Relevant URL: http://www.infoseccorp.com/products/secretagent/contents.htm
Summary:

SecretAgent is a file encryption and digital signature utility, supporting
cross-platform interoperability over a wide range of platforms: Windows,
Linux, Mac OS X, and UNIX systems.

It's the perfect solution for your data security requirements, regardless
of the size of your organization.

Using the latest recognized standards in encryption and digital signature
technology, SecretAgent ensures the confidentiality, integrity, and
authenticity of your data.

5. Cyber-Ark  Inter-Business Vault
By: Cyber-Ark
Platforms: Linux, Windows 2000, Windows NT, Windows XP
Relevant URL:
http://www.cyber-ark.com/datasecuritysoftware/inter-business_vault.htm
Summary:

Based on Cyber-Ark Software's Vaulting Technology, the Inter-Business
Vault, an information security solution that enables organizations to
safely overcome traditional network boundaries in order to securely share
business information among customers, business partners, and remote
branches. It provides a seamless, LAN-like experience over the Internet
that includes all the security, performance, accessibility, and ease of
administration required to allow organizations to share everyday
information worldwide. To learn more about these core attributes of the
Inter-Business Vault click on the relevant link below:

6. EnCase Forensic Edition
By: Guidance Software Inc.
Platforms: DOS, FreeBSD, Linux, MacOS, NetBSD, OpenBSD, PalmOS, Solaris,
UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL:
http://www.guidancesoftware.com/products/EnCaseForensic/index.shtm
Summary:

EnCase Forensic Edition Version 4 delivers the most advanced features for
computer forensics and investigations. With an intuitive GUI and superior
performance, EnCase Version 4 provides investigators with the tools to
conduct large-scale and complex investigations with accuracy and
efficiency. Guidance Software?s award winning solution yields completely
non-invasive computer forensic investigations while allowing examiners to
easily manage large volumes of computer evidence and view all relevant
files, including "deleted" files, file slack and unallocated space.

The integrated functionality of EnCase allows the examiner to perform all
functions of the computer forensic investigation process. EnCase's
EnScript, a powerful macro-programming language and API included within
EnCase, allows investigators to build customized and reusable forensic
scripts.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Pathalizer v0.6
By: Arnout Engelen
Relevant URL: http://pathalizer.bzzt.net
Platforms: FreeBSD, Linux, POSIX
Summary:

Pathalizer is a tool for visualizing the paths most users take when
browsing a Web site. This information can be used to decide how to improve
the navigation of the site, and for determining wihch parts are most worth
improving and keeping up to date. It generates a directed, weighed graph
from an Apache log, but could easily be modified to analyze any list of
events.

2. darkstat v2.6
By: Emil Mikulic
Relevant URL: http://members.optushome.com.au/emikulic/net/darkstat/
Platforms: Linux, Solaris
Summary:

Darkstat is an ntop-workalike network statistics gatherer. Built to be
faster and smaller than ntop, it uses libpcap to capture network traffic
and serves up Web page reports of statistics such as data transferred by
host, port, and protocol. It also has a neat bandwidth usage graph.

3. mod_parmguard v1.2
By: Jerome Delamarche
Relevant URL: http://www.trickytools.com/php/mod_parmguard.php
Platforms: Linux
Summary:

Apache module that intercepts the requests and rejects those which are not
compliant with the constraints expected by the scripts. Use a XML
Configuration file that describe the type and allowed values for the
parameters. Released with automated tools that help the Administrator
building the XML Configuration file.

4. SEPPL  v 0.2
By: Mezcalero
Relevant URL: http://0pointer.de/lennart/projects/seppl/
Platforms: Linux, POSIX
Summary:

SEPPL is both a protocol definition and a software implementation of a new
encryption layer for IPv4. It is extremely leightweight and easy to use.
It is implemented for the Linux kernel and makes use of netfiler and the
Linux CryptoAPI. It is intended as a software replacement for WEP but may
be used on non-wireless lans as well. It even fits for VPN solutions.

5. Nessus v2.0.9
By: Renaud Deraison <[email protected]>
Relevant URL: http://www.nessus.org/
Platforms: FreeBSD, IRIX, Linux, NetBSD, OpenBSD, Solaris
Summary:

Nessus is a remote security scanner for Linux, BSD, Solaris, and other
Unices. It is multi-threaded and plug-in-based, has a GTK interface, and
performs over 500 remote security checks. It allows for reports to be
generated in HTML, XML, LaTeX, and ASCII text, and suggests solutions for
security problems.

6. pmacct v0.5.2
By: Paolo Lucente
Relevant URL: http://www.ba.cnr.it/~paolo/pmacct/
Platforms: Linux, OpenBSD
Summary:

pmacct is a network tool to gather IP traffic information (source address,
bytes counter, and number of packets). Data is stored in an in-memory
table whose content could be retrieved by a client program via a local
stream-oriented connection. Gathering packets off the wire is done using
the pcap library and one or more network interfaces in promiscuous mode.


VI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: SpiDynamics

ALERT: Are you open to a Web Application Attack?- Free Product Trial
WebInspect employs threat agents to simulate attackers analyzing your web
server, formulating attacks and applying them to determine if
vulnerabilities exist.

Run a FREE Test of your Web Apps via our FREE 15 Day Product Trial that
delivers a comprehensive Vulnerability Report.
http://www.securityfocus.com/sponsor/SPIDynamics_linux-secnews_031110
------------------------------------------------------------------------