SecurityFocus Linux Newsletter #158

SecurityFocus Linux Newsletter #158
------------------------------------
This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_linux-secnews_031117 and use
priority code SF4.
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Oracle Row Level Security: Part 2
     2. Banking Scam Revealed
     3. Electronic Voting Debacle
     4. Proposed: a Bounty for Bugs
II. LINUX VULNERABILITY SUMMARY
     1. IBM DB2 Multiple Command-line Format String Vulnerabilities
     2. IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulne...
     3. TerminatorX Command-line Format String Vulnerability
     4. TerminatorX Multiple Command-Line and Environment Buffer Ove...
     5. phpBB Profile.PHP SQL Injection Vulnerability
     6. WMAPM Privilege Escalation Vulnerability
     7. Conquest Unspecified Local Environment Variable Buffer Overf...
     8. Epic CTCP Nickname Server Message Buffer Overrun Vulnerabili...
     9. Bugzilla Javascript Buglists Remote Information Disclosure V...
     10. Winace UnAce Command Line Argument Buffer Overflow Vulnerabi...
     11. PureFTPd displayrate() Remote Denial of Service Vulnerabilit...
     12. Omega-RPG Environment Variable Buffer Overrun Vulnerability
     13. Opera Web Browser Opera: URI Handler Directory Traversal Vul...
     14. Spoofed Kernel Netlink Interface Message Denial of Service V...
     15. GNU Zebra / Quagga  Remote Denial of Service Vulnerability
     16. Clam AntiVirus E-mail Address Logging Format String Vulnerab...
     17. OpenSSH PAM Conversation Memory Scrubbing Weakness
III. LINUX FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2003-11-10 to 2003-11-17.
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Sophos Anti-Virus
     2. ActiveScout Enterprise
     3. Immunity CANVAS
     4. SecretAgent
     5. Cyber-Ark  Inter-Business Vault
     6. EnCase Forensic Edition
V. NEW TOOLS FOR LINUX PLATFORMS
     1. SILC (Secure Internet Live Conferencing)(Toolkit) v0.9.11
     2. NuFW v0.5.3
     3. OSIRIS v2.1.0
     4. Sentry Firewall CD-ROM v1.5.0-rc6(dev)
     5. Dazuko  v2.0.0-pre4
     6. OpenNA Linux v1.0
VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Oracle Row Level Security: Part 2
By Pete Finnigan

This paper explores the row level security feature added to Oracle 8i and
above, and provides examples. One of the main uses of row level security
is to allow all of a company's data to be stored in one database for
different departments, or for a hosting company to store data for
different companies in one database. Part Two.

http://www.securityfocus.com/infocus/1744

2. Banking Scam Revealed
By Secure Science Corporation

A detailed analysis of the recent "phishing" scam that targeted Citibank
customers. This paper describes the use of compromised hosts, Website
redirection and the specifics of a unique bulk-mailing tool that has been
repeatedly used in the recent rash of financial email scams.

http://www.securityfocus.com/infocus/1745

3. Electronic Voting Debacle
By Scott Granneman

Grave concerns over the security of electronic voting machines in the
United States means the heart of American democracy is at risk. ... >>

http://www.securityfocus.com/columnists/198

4. Proposed: a Bounty for Bugs
By Mark Rasch

Instead of paying hard cash to punish computer criminals, vendors should
reward grey hat hackers for responsibly finding and reporting the security
holes that make cyber attacks possible.

http://www.securityfocus.com/columnists/197


II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. IBM DB2 Multiple Command-line Format String Vulnerabilities
BugTraq ID: 8989
Remote: No
Date Published: Nov 07 2003
Relevant URL: http://www.securityfocus.com/bid/8989
Summary:
DB2 is the database implementation maintained and distributed by IBM. It
is available for the UNIX, Linux, and Microsoft Windows platforms. The
db2govd, db2start, and db2stop database components are typically installed
setuid.

Multiple format string vulnerabilities have been discovered within the IBM
DB2 database specifically within the aforementioned components. The
problems occur due to erroneous usage of format-based functions and could
potentially allow an attacker to gain elevated privileges on a local
system.

The db2start and db2stop binaries are both prone to a format string bug
when handling a basic command-line argument, for example "./dbstart %x".
The db2govd binary is prone to the condition when handling parameters
passed as part of the 'validate garbage' and 'stop' options.

An attacker could potentially exploit one of these conditions by passing
specially calculated format string sequences to a target program. When
handled, the program may be controlled in such a way that arbitrary code
may be executed. All instructions executed would be run with the
privileges of the owner of the specific binary.

2. IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulne...
BugTraq ID: 8990
Remote: No
Date Published: Nov 07 2003
Relevant URL: http://www.securityfocus.com/bid/8990
Summary:
DB2 is the database implementation maintained and distributed by IBM. It
is available for the UNIX, Linux, and Microsoft Windows platforms. The
db2govd, db2start, and db2stop database components are typically installed
setuid/setgid.

IBM DB2 has been reported to be prone to multiple buffer overflow
vulnerabilities that present themselves in binaries that are shipped with
DB2. The vulnerabilities are likely caused due to a lack of sufficient
boundary checks performed on user-supplied command-line arguments before
they are copied into a reserved buffer in memory. By supplying data that
exceeds the size of the reserved memory buffer used to store command line
arguments, a local attacker may overflow the bounds of the affected buffer
and corrupt adjacent memory. Because this memory contains values that are
crucial to controlling program execution flow, the attacker may influence
the execution flow of the vulnerable binary into attacker-controlled
memory.

It has been reported that arguments between 65 and 9901 bytes in size may
trigger this issue in the respective vulnerable executables. Ultimately
this may lead to the execution of arbitrary attacker-supplied instructions
with elevated privileges.

Although this issue has been reported to affect IBM DB2 versions v7 and v8
other versions may also be affected.

3. TerminatorX Command-line Format String Vulnerability
BugTraq ID: 8992
Remote: No
Date Published: Nov 07 2003
Relevant URL: http://www.securityfocus.com/bid/8992
Summary:
TerminatorX is a freely available, open source music manipulation program.
It is available for the Linux platform.

It has been reported that TerminatorX may be prone to a format string
vulnerability when handling command-line parameters. Specifically, due to
the erroneous usage of a format-based function, it is possible to have
format specifiers passed as the '-f' file argument interpreted by the
program.

As a result, an attacker may be capable of exploiting the application in a
way to execute arbitrary code with elevated privileges. It should be noted
that TerminatorX is not installed setuid by default, however the author
recommends that users make the application setuid root.

4. TerminatorX Multiple Command-Line and Environment Buffer Ove...
BugTraq ID: 8993
Remote: No
Date Published: Nov 07 2003
Relevant URL: http://www.securityfocus.com/bid/8993
Summary:
terminatorX is a freely available, open source music manipulation program.
It is available for the Linux platform.

It has been reported that TerminatorX may be prone to multiple
vulnerabilities when handling command-line and environment variable data.
The problem specifically occurs due to insufficient bounds checking when
handling the LADSPA_PATH environment variable and the '-f' and '-r'
command-line parameters.

As a result, an attacker may be capable of exploiting the application in a
variety ways to execute arbitrary code with elevated privileges. It should
be noted that TerminatorX is not installed setuid by default, however the
author recommends that users make the application setuid root.

5. phpBB Profile.PHP SQL Injection Vulnerability
BugTraq ID: 8994
Remote: Yes
Date Published: Nov 08 2003
Relevant URL: http://www.securityfocus.com/bid/8994
Summary:
phpBB is an open-source web forum application that is written in PHP and
supported by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

A SQL injection vulnerability has been reported for phpBB systems.

phpBB, in some cases, does not sufficiently sanitize user-supplied input,
which is used when constructing SQL queries to execute on the underlying
database. As a result, it is possible to manipulate SQL queries. This may
allow a remote attacker to modify query logic or potentially corrupt the
database.

This vulnerability was reported to exist in the profile.php script file. A
remote attacker can exploit this vulnerability by manipulating the $u URI
parameter to modify SQL query logic.

SQL injection attacks may also potentially be used to exploit latent
vulnerabilities in the underlying database implementation.

It should be noted that although this vulnerability has been reported to
affect phpBB version 2.0.5 and prior, it may also affect version 2.0.6.

6. WMAPM Privilege Escalation Vulnerability
BugTraq ID: 8995
Remote: No
Date Published: Nov 08 2003
Relevant URL: http://www.securityfocus.com/bid/8995
Summary:
wmapm is a Window Maker Dock App that is used as a battery power status
monitor for laptops.

wmapm has been reported prone to a local privilege escalation
vulnerability. The vulnerability has been conjectured to result from a
lack of relative path use while the vulnerable dock app is calling the
'apm' binary. As a result of this, a local attacker may manipulate local
path settings and have the setuid wmapm dock app erroneously invoke a
trojan binary that is located in a directory that the attacker has
permissions to write to.

The code contained in the invoked binary will be executed with the
privileges of the vulnerable wmapm app; this may ultimately result in
elevating the privileges of the attacker.

It has been reported that wmapm is setUID operator in FreeBSD if it is
compiled via the ports collection, alternatively if wmapm is compiled from
source on FreeBSD or Linux it is reportedly setUID root.

It should be noted that although this issue has been reported to affect
wmapm version 3.1, previous versions might also be affected.

7. Conquest Unspecified Local Environment Variable Buffer Overf...
BugTraq ID: 8996
Remote: No
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/8996
Summary:
conquest is a simple curses based strategy game developed for unix based
operating systems. It has been reported that on the Debian Linux
distribution, the conquest binary is setgid conquest.

A local buffer overrun vulnerability has been reported for conquest. The
problem occurs due to insufficient bounds checking when parsing
unspecified data contained in the user's environment. As a result, an
attacker may be capable of controlling the execution flow of the conquest
program and effectively executing arbitrary code with elevated privileges.

Exploiting this condition may allow an attacker to gain group 'conquest'
privileges that could be used to modify sensitive information or could be
used to leverage attacks against other previously inaccessible utilities.

8. Epic CTCP Nickname Server Message Buffer Overrun Vulnerabili...
BugTraq ID: 8999
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/8999
Summary:
Epic is a freely available IRC client for Unix and Linux variants.

A remotely exploitable buffer overrun has been reported in Epic.  This
issue may reportedly be exploited by a malicious server that supplies an
overly long nickname in a CTCP message.  It may be also be possible for a
malicious client to send such a message, but it is likely that the server
will limit the length.

Reportedly if a nickname of over 512 bytes is supplied in such a message,
the client may attempt to call alloca() with a negative number, which
could potentially result in corruption of stack memory.  In this manner,
it may be possible for a malicious IRC server to trigger this condition to
execute arbitrary code on the client system in the context of the client
user.

9. Bugzilla Javascript Buglists Remote Information Disclosure V...
BugTraq ID: 9001
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9001
Summary:
Bugzilla is a freely available, open source bug tracking system.  It is
available for the Unix, Linux, and Microsoft Windows platforms.

A problem exists in the handling of buglists by Bugzilla when the lists
are implemented with Javascript.  Because of this, a remote user may be
able to gain unauthorized access to sensitive information.

The problem is in the storage of information when placed in Javascript
arrays.  It is possible for a remote user to create a buglink in their
page that correctly reflects information about a bug, including details
which may be restricted from the public due to sensitivity of information.
This may result in unauthorized disclosure of information.

This problem has also been reported to affect bookmarklets.  The issue is
known to affect verion 2.7.15 only.

10. Winace UnAce Command Line Argument Buffer Overflow Vulnerabi...
BugTraq ID: 9002
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9002
Summary:
Winace is a file compression/decompression tool that was originally
developed for Microsoft Windows platforms. Winace was ported to Linux
platforms as UnAce.

UnAce has been reported to be prone to a buffer overflow vulnerability.
The issue presents itself when UnAce handles ace filenames that are
greater than 610 bytes in length including the ace file extension. When
this filename is passed to the UnAce utility as an argument for the 'e'
(extract command line switch), the string is copied into a reserved buffer
in memory. Data that exceeds the size of the reserved buffer will overflow
its bounds and will trample any saved data that is adjacent to the
affected buffer. Because variable that are crucial to controlling program
execution flow for UnAce are conjectured to be stored adjacent to the
affected buffer, an attacker may corrupt these values and influence UnAce
program execution flow into attacker controlled memory. Ultimately this
may lead to the execution of arbitrary instructions in the context of the
user who is running UnAce.

If UnAce is associated with a specific file type in for example an
Internet browser, clicking on a malicious ace filename may be sufficient
to result in the execution of arbitrary instructions on an affected host.

11. PureFTPd displayrate() Remote Denial of Service Vulnerabilit...
BugTraq ID: 9003
Remote: Yes
Date Published: Nov 10 2003
Relevant URL: http://www.securityfocus.com/bid/9003
Summary:
PureFTPd is an FTP server based on Troll-FTPd and designed with a focus on
security. It is available for the BSD and Linux operating systems.

A denial of service vulnerability has been discovered in PureFTPd. The
problem occurs within the displayrate() function. When data returned from
the realpath() function is subsequently tested for a specific value, it
may be possible to trigger a procedure, which will ultimately cause
PureFTPd to crash.

Specifically, the realpath() function is passed two variables, name and
resolved_path. The resolved name is stored in resolved_path, which is then
tested for a zero byte as shown below:

if (resolved_path[sizeof_resolved_path - 1U] != 0)

If this condition is met, PureFTPd will enter an infinite for loop,
continuously writing a zero value to a pointer incremented each iteration.
This will ultimately result in an attempt to write to unpaged memory,
effectively triggering a segmentation violation and thus a denial of
service.

It should be noted that PureFTPd will typically fork a new process for
each new connection to the FTP service, specifically when running as a
standalone server, however it has not been confirmed whether this is
always the case.

If forking children is the only behavior under all configurations, this
condition may not have any implications beyond closing the session of a
malicious user. This BID will be updated, as further details regarding
this information are made available.

*** November 10, 2003 - The vendor has confirmed that the condition occurs
only within the individual session under which the condition occurs.
Furthermore, additonal details made available by the vendor state that
realpath() is designed in such a way that only a specific amount of data
can be filled. As such, the aforementioned test will always always fail.
As a result of this new information, this BID will subsequently be
retired.

12. Omega-RPG Environment Variable Buffer Overrun Vulnerability
BugTraq ID: 9016
Remote: No
Date Published: Nov 11 2003
Relevant URL: http://www.securityfocus.com/bid/9016
Summary:
omega-rpg is a game for Linux/Unix variants.

omega-rpg is prone to a locally exploitable buffer overrun.  This is due
to insufficient bounds checking of environment variables, which will be
copied into an internal buffer.  By supplying an environment variable of
excessive length, it is possible to corrupt memory with attacker-supplied
values, potentially allowing the attacker to control execution flow of the
program and execute arbitrary code.  omega-rpg may be installed setgid,
which could allow for execution of arbitrary code in the context of group
'games' if this issue were successfully exploited.

13. Opera Web Browser Opera: URI Handler Directory Traversal Vul...
BugTraq ID: 9021
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9021
Summary:
Opera is a web browser available for a number of platforms, including
Microsoft Windows, Linux and Unix variants and Apple MacOS.

Opera uses an internal URI handler called 'Opera:' or 'about:' to display
help files and other documentation.  Common uses for this command include
"opera:history",  "opera:plugins", "opera:cache", and "opera:drives".  A
vulnerability has been reported to exist in the software that may allow an
attacker to access information outside the intended directories for help
files and documentation. The problem exists due to insufficient
sanitization of user-supplied data through the 'Opera:' URI handler. The
issue may allow an attacker to traverse the client file system by using
'..%5c' or '..%2f' character sequences.

Successful exploitation of this vulnerability may allow an attacker to
gain access to sensitive information that may be used to launch further
attacks against a vulnerable system.

It has been reported that this issue may be exploited with another issue
described in BID 9019 to drop files onto a client system in a predictable
location and cause these files to be executed.

Opera Web Browser versions 7.21 and prior are reported to be prone to this
issue.  This issue was reported to exist in Windows versions of the web
browser.  It is not known if versions for other platforms are similarly
affected.

14. Spoofed Kernel Netlink Interface Message Denial of Service V...
BugTraq ID: 9027
Remote: No
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9027
Summary:
The Linux kernel includes the use of an optional netlink driver, which
when used creates the netlink device. This device can be used to allow a
channel between the kernel and userland applications for the transfer of
data and other information. This data can be transferred through the use
of netlink datagrams and messages.

The glibc getifaddrs() function is designed to store a linked list of the
local systems network interfaces.

GNU Zebra is an open source implementation of TCP/IP routing software.  It
supports BGP-4, RIPv1, RIPv2 and OSPFv2 protocols. Quagga is a routing
software suite which was derived from GNU Zebra.

The Red Hat iproute package contains a variety of IP-based networking
utilities.

Applications which make use of the kernel netlink interface are said to be
prone to denial of service attacks.

It has been reported that applications implementing the use of the
getifaddrs() function may be prone to denial of service conditions. The
problem is said to occur due to the way spoofed netlink messages are
handled by the function. Due to this handling, it is said that a malformed
message transmitted to the process may in fact trigger a denial of
service.

The above condition is confirmed to occur on Red Hat 9 systems, however it
is not currently known if other operating systems or glibc versions are
directly affected.

Red Hat has stated that GNU Zebra, Quagga and iproute are also affected by
this vulnerability due to the way they interact with the netlink
interface; exploitation may result in a denial of service.

It is not currently known whether this condition is a problem within the
kernel netlink interface itself or if each application is implementing the
use of code which fails to properly handle specific netlink events. This
BID will be updated, as further information is made available.

15. GNU Zebra / Quagga  Remote Denial of Service Vulnerability
BugTraq ID: 9029
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9029
Summary:
GNU Zebra is an open source implementation of TCP/IP routing software.  It
supports BGP-4, RIPv1, RIPv2 and OSPFv2 protocols. Quagga is a routing
software suite which was derived from GNU Zebra.

A vulnerability has been reported to be present in the software that may
allow a remote attacker to a cause a denial of service condition in the
software.  The issue is reported to occur if an attacker attempts to
connect to the Zebra or Quagga telnet management port while a password is
enabled.

The problem specifically occurs due to an invalid (typically NULL) pointer
dereference. This occurs because the vty layer fails to verify whether a
Telnet sub-negotation is currently in progress prior to handling an end
negotiation marker (SE). This will likely occur if the SE is received at
an unexpected time.

Successful exploitation of this issue may allow an attacker who passes a
malformed Telnet command to the server, to cause the software to behave in
an unstable manner leading to a crash or hang.

All versions of GNU Zebra are said to be vulnerable to this issue.  All
versions of Quagga prior to 0.96.4 are also vulnerable.

16. Clam AntiVirus E-mail Address Logging Format String Vulnerab...
BugTraq ID: 9031
Remote: Yes
Date Published: Nov 12 2003
Relevant URL: http://www.securityfocus.com/bid/9031
Summary:
Clam AntiVirus is an anti-virus product for Linux and Unix derived
operating systems.

Clam AntiVirus is prone to a format string vulnerability when logging
e-mail addresses.  This is due to incorrect usage of the syslog() function
to log e-mail addresses.  As a result, attackers may supply their own
format specifiers in e-mail addresses.  Remote attackers may be required
to craft an e-mail that may generate a loggable event, such as including
an AV test string in the message, to exploit this issue.

This vulnerability may be exploited to overwrite arbitrary locations in
memory with attacker-supplied values, resulting in execution of arbitrary
code. Denial of service attacks are also possible.  This will occur in the
context of the clamav user or root, depending on how the software is
invoked.

This issue only affects the clamav-milter component of versions later than
clamav-0.54, which include syslogging functionality.

17. OpenSSH PAM Conversation Memory Scrubbing Weakness
BugTraq ID: 9040
Remote: No
Date Published: Nov 13 2003
Relevant URL: http://www.securityfocus.com/bid/9040
Summary:
OpenSSH is a freely available, open source implementation of the Secure
Shell protocol.  It is available for the Unix, Linux, and Microsoft
platforms.

An issue has been reported in the OpenSSH implementation of PAM
conversation functions.  Applications which use PAM modules for
authentication are required to include conversation routines to manage
communications between the application and the PAM module, providing a
means to prompt users for passwords or provide other functionality which
relies on PAM.  When a remote user connects to an OpenSSH server and
prematurely cancels the connection through a function such as Control-C,
OpenSSH does not correctly respond.  It has been reported that OpenSSH
ends the session with the pam_end() function rather than returning
PAM_CONV_ERR, which is the correct behavior according to the Linux-PAM
developer documentation.  As a result, PAM will not handle the aborted
conversation correctly and subsequently fail to scrub memory.  The direct
consequence is that sensitive information in memory is more likely to end
up in swap space or core dumps.

This problem may expose authentication credentials to recovery should an
attacker have sufficient privileges on the system to view core dumps or
system memory.  This issue may also expose other vulnerabilities in PAM
modules due to unpredictable behavior that could potentially lead to
stability issues and the compromise of sensitive credentials, information,
or privileges.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
NO NEW POSTS FOR THE WEEK 2003-11-10 to 2003-11-17.


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Sophos Anti-Virus
By: Sophos
Platforms: AIX, DOS, FreeBSD, HP-UX, Linux, MacOS, Netware, OS/2, Solaris,
UNIX, VMS, Windows 3.x, Windows 95/98, Windows NT
Relevant URL: http://www.sophos.com/products/sav/
Summary:

Sophos Anti-Virus is a unique solution to the virus problem, providing
true cross-platform protection in a single, fully integrated product. The
network-centric design provides a host of benefits for the protection of
servers, workstations and portables. Sophos's ground-breaking architecture
maximises protection, while minimising performance and administrative
overheads.

2. ActiveScout Enterprise
By: ForeScout Technologies
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.forescout.com/enterprise.html
Summary:

ActiveScout Enterprises actively protects a network with multiple access
points. In addition to the identification of attackers and automatic
action to stop them, this solution offers full management capabilities,
from configuration and reporting, to the sharing of threat information
between multiple deployed scouts.

3. Immunity CANVAS
By: Immunity, Inc.
Platforms: Linux, Windows 2000
Relevant URL: http://www.immunitysec.com/CANVAS/
Summary:

Immunity CANVAS is 100% pure Python, and every license includes full
access to the entire CANVAS codebase. Python is one of the easiest
languages to learn, so even novice programmers can be productive on the
CANVAS API, should they so chose.

Immunity CANVAS is both a valuable demonstration tool for enterprise
information security teams or system adminstrators, and an advanced
development platform for exploit developers, or people learning to become
exploit developers.

4. SecretAgent
By: Information Security Corporation (ISC)
Platforms: Linux, MacOS, UNIX, Windows 2000, Windows 95/98, Windows NT,
Windows XP
Relevant URL: http://www.infoseccorp.com/products/secretagent/contents.htm
Summary:

SecretAgent is a file encryption and digital signature utility, supporting
cross-platform interoperability over a wide range of platforms: Windows,
Linux, Mac OS X, and UNIX systems.

It's the perfect solution for your data security requirements, regardless
of the size of your organization.

Using the latest recognized standards in encryption and digital signature
technology, SecretAgent ensures the confidentiality, integrity, and
authenticity of your data.

5. Cyber-Ark  Inter-Business Vault
By: Cyber-Ark
Platforms: Linux, Windows 2000, Windows NT, Windows XP
Relevant URL:
http://www.cyber-ark.com/datasecuritysoftware/inter-business_vault.htm
Summary:

Based on Cyber-Ark Software's Vaulting Technology, the Inter-Business
Vault, an information security solution that enables organizations to
safely overcome traditional network boundaries in order to securely share
business information among customers, business partners, and remote
branches. It provides a seamless, LAN-like experience over the Internet
that includes all the security, performance, accessibility, and ease of
administration required to allow organizations to share everyday
information worldwide. To learn more about these core attributes of the
Inter-Business Vault click on the relevant link below:

6. EnCase Forensic Edition
By: Guidance Software Inc.
Platforms: DOS, FreeBSD, Linux, MacOS, NetBSD, OpenBSD, PalmOS, Solaris,
UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL:
http://www.guidancesoftware.com/products/EnCaseForensic/index.shtm
Summary:

EnCase Forensic Edition Version 4 delivers the most advanced features for
computer forensics and investigations. With an intuitive GUI and superior
performance, EnCase Version 4 provides investigators with the tools to
conduct large-scale and complex investigations with accuracy and
efficiency. Guidance Software?s award winning solution yields completely
non-invasive computer forensic investigations while allowing examiners to
easily manage large volumes of computer evidence and view all relevant
files, including "deleted" files, file slack and unallocated space.

The integrated functionality of EnCase allows the examiner to perform all
functions of the computer forensic investigation process. EnCase's
EnScript, a powerful macro-programming language and API included within
EnCase, allows investigators to build customized and reusable forensic
scripts.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. SILC (Secure Internet Live Conferencing)(Toolkit) v0.9.11
By: Priikone
Relevant URL: http://silcnet.org/
Platforms: Linux, UNIX
Summary:

SILC (Secure Internet Live Conferencing) is a protocol which provides
secure conferencing services in the Internet over insecure channels. SILC
superficially resembles IRC, although they are very different internally.
The purpose of SILC is to provide secure conferencing services. Strong
cryptographic methods are used to secure all traffic. The SILC is
delivered as SILC Client for end users, SILC Server for system
administrators, and SILC Toolkit for application developers.

2. NuFW v0.5.3
By: regit
Relevant URL: http://www.nufw.org
Platforms: Linux, POSIX
Summary:

NuFW is a set of daemons providing filtering of packets at the user level.
On the client side, users have to run a client that sends authentication
packets to the gateway. On the server side, the gateway associates userids
to packets, thus enabling the possibility to filter packets on a user
basis. Furthermore, the server architecture is done to use external
authentication source such as an LDAP server.

3. OSIRIS v2.1.0
By: The Shmoo Group
Relevant URL: http://osiris.shmoo.com
Platforms: BSDI, FreeBSD, Linux, MacOS, OpenBSD, UNIX, Windows 2000,
Windows NT, Windows XP
Summary:

Osiris is a host integrity management system that can be used to monitor
changes to a network of hosts over time and report those changes back to
the administrator(s). Currently, this includes monitoring any changes to
the filesystems. Osiris takes periodic snapshots of the filesystem and
stores them in a database. These databases, as well as the
configurations and logs, are all stored on a central management host.
When changes are detected, Osiris will log these events to the system
log and optionally send email to an administrator. In addition to files,
Osiris has preliminary support for the monitoring of other system
information including user lists, file system details, kernel modules,
and network interface configurations (not included with in this beta
release).

4. Sentry Firewall CD-ROM v1.5.0-rc6(dev)
By: Obsid
Relevant URL: http://www.SentryFirewall.com/
Platforms: Linux
Summary:

Sentry Firewall CD-ROM Version 1.0 is a Linux based bootable CD-ROM
suitable for use as an inexpensive and easy to maintain Firewall or
IDS(Intrusion Detection System) Node. The system is designed to be
immediately configurable for a variety of different operating environments
via a configuration file located on a floppy disk or a local hard drive.

5. Dazuko  v2.0.0-pre4
By: John Ogness
Relevant URL: http://www.dazuko.org/
Platforms: FreeBSD, Linux
Summary:

This project provides a kernel module which provides 3rd-party
applications with an interface for file access control. It was originally
developed for on-access virus scanning. Other uses include a file-access
monitor/logger or external security implementations. It operates by
intercepting file-access calls and passing the file information to a
3rd-party application. The 3rd-party application then has the opportunity
to tell the kernel module to allow or deny the file-access. The 3rd-party
application also receives information about the file, such as type of
access, process ID, user ID, etc.

6. OpenNA Linux v1.0
By: OpenNA - NOC
Relevant URL: http://www.openna.com/products/os/download-os.htm
Platforms: Linux
Summary:

OpenNA Linux is a highly secure, very fast, and modern Linux operating
system. It is intended for those who want to install and run a Linux
server for mission critical tasks in a high security environment.


VI. SPONSOR INFORMATION
-----------------------
This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_linux-secnews_031117 and use
priority code SF4.
------------------------------------------------------------------------