SecurityFocus Microsoft Newsletter #192

SecurityFocus Microsoft Newsletter #192
----------------------------------------

This Issue is Sponsored By: SPI Dynamics

ALERT: "How Hackers Launch Blind SQL Injection Attacks- New White Paper
The newest web app vulnerability... Blind SQL Injection!
Even if your web application does not return error messages, it may still 
be open to a Blind SQL Injection Attack. Blind SQL Injection can deliver 
total control of your server to a hacker giving them the ability to read, 
write and manipulate all data stored in your backend systems! Download 
this *FREE* white paper from SPI Dynamics for a complete guide to 
protection! 

http://www.securityfocus.com/sponsor/SPIDynamics_ms-secnews_040607

------------------------------------------------------------------------
I. FRONT AND CENTER
     1. Wireless Attacks and Penetration Testing (part 1 of 3)
     2. Catching a Virus Writer
II. MICROSOFT VULNERABILITY SUMMARY
     1. MollenSoft Lightweight FTP Server Remote Buffer Overflow Vul...
     2. JPortal Print.php SQL Injection Vulnerability
     3. Microsoft Windows 2000 Domain Expired Account Security Polic...
     4. Sambar Server Multiple Vulnerabilities
     5. Rit Research Labs TinyWeb Server Unauthorized Script Disclos...
     6. PHP-Nuke Direct Script Access Security Bypass Vulnerability
     7. MIT Kerberos 5 KRB5_AName_To_Localname Multiple Principal Na...
     8. Tripwire Email Reporting Format String Vulnerability
     9. Trend Micro Scanning Engine Report Generation HTML Injection...
III. MICROSOFT FOCUS LIST SUMMARY
     1. Exchange Information Store Security?  Send As... (Thread)
     2. SecurityFocus Microsoft Newsletter #191 (Thread)
     3. Relative Security Provided by Cached Domain Credenti... (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
     1. SP I-NET
     2. secure2trust
     3. N-Stealth Security Scanner
     4. Softros LAN Messenger
     5. Network Time System
     6. Anon-Encrypt
V. NEW TOOLS FOR MICROSOFT PLATFORMS
     1. XArp 0.1
     2. Honeynet Security Console 1.0
     3. LogMonitor 1.0
     4. Ettercap v0.7.0 pre2
     5. Syhunt TS Security Scanner 6.7 Build 96
     6. yaSSL 0.1.0
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Wireless Attacks and Penetration Testing (part 1 of 3)
By Jonathan Hassell

This is the first of a three part series on penetration testing for 
wireless networks. This installment will detail common styles of attacks 
against wireless networks, introduce WEP key-cracking, and then discuss 
some recent developments in wireless security.

http://www.securityfocus.com/infocus/1783


2. Catching a Virus Writer
By Kelly Martin 

With the consumer WiFi explosion, launching a virus into the wild has 
never been easier and more anonymous than it is today.

http://www.securityfocus.com/columnists/246

II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. MollenSoft Lightweight FTP Server Remote Buffer Overflow Vul...
BugTraq ID: 10429
Remote: Yes
Date Published: May 28 2004
Relevant URL: http://www.securityfocus.com/bid/10429
Summary:
Lightweight FTP Server is prone to a remote buffer overflow vulnerability.  This vulnerability can potentially allow a remote attacker to execute arbitrary code in the context of the server process.  This issue presents itself due to a lack of sufficient boundary checks performed on CD command arguments.

Lightweight FTP Server version 3.6 is prone to this issue.

This issue is likely related to the issue previously described in BID 10409 (MollenSoft Lightweight FTP Server Remote Denial Of Service Vulnerability).  This BID will be updated or retired subsequent to further analysis.

2. JPortal Print.php SQL Injection Vulnerability
BugTraq ID: 10430
Remote: Yes
Date Published: May 28 2004
Relevant URL: http://www.securityfocus.com/bid/10430
Summary:
JPortal is reportedly affected by a remote SQL injection vulnerability in the print.inc.php script.  This issue is due to a failure of the application to properly sanitize user-supplied URI input before using it in an SQL query.

As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It may be possible for an attacker to disclose the administrator password hash by exploiting this issue.

3. Microsoft Windows 2000 Domain Expired Account Security Polic...
BugTraq ID: 10440
Remote: Yes
Date Published: May 31 2004
Relevant URL: http://www.securityfocus.com/bid/10440
Summary:
Windows 2000 domain controllers are reported prone to a weakness that may permit user accounts with expired passwords to logon to the domain.

This weakness may lead to a security policy violation. Where an administrator expires a users password to force them to modify it, or sets a weak password while creating the account. The user does not modify the password and can still logon to the affected domain. The administrator however believes that the password has been modified.

4. Sambar Server Multiple Vulnerabilities
BugTraq ID: 10444
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10444
Summary:
Sambar Server is reportedly prone to multiple vulnerabilities.  These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.  

These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default.  An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.

Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.

5. Rit Research Labs TinyWeb Server Unauthorized Script Disclos...
BugTraq ID: 10445
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10445
Summary:
TinyWeb Server is affected by an unauthorized script disclosure vulnerability.  This issue is due to an input validation error that allows malicious users to bypass standard web server rules.

This issue will allow an attacker to download or view scripts residing in the 'cgi-bin' directory.

This issue is reported to affect TinyWeb 1.92, it is likely that other versions are also vulnerable.

6. PHP-Nuke Direct Script Access Security Bypass Vulnerability
BugTraq ID: 10447
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10447
Summary:
PHP-Nuke is affected by a direct script access security vulnerability.  This issue is due to a failure to properly validate the location and name of the file being accessed.

This issue will allow an attacker to gain access to sensitive scripts such as the 'admin.php' script.  The attacker may be able to exploit this unauthorized access to carry out attacks against the affected application.

7. MIT Kerberos 5 KRB5_AName_To_Localname Multiple Principal Na...
BugTraq ID: 10448
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10448
Summary:
Kerberos 5 is prone to multiple boundary condition errors that exist in the krb5_aname_to_localname() and helper functions and are due to insufficient bounds checking performed on user-supplied data. 

An additional boundary condition issue also exists in the krb5_aname_to_localname() function. The condition is reported to present itself in the explicit mapping functionality of the krb5_aname_to_localname() as an off-by-one.

These conditions may be theoretically exploitable to execute arbitrary code remotely in the context of the affected service.

It is reported that explicit mapping or rules-based
mapping functionality of krb5_aname_to_localname() must be enabled for these vulnerabilities to be present. Additionally it is necessary that the principal name used by the attacker to exploit the issue be listed in the explicit mapping list.

These vulnerabilities are reported to affect all releases of MIT Kerberos 5, up to and including version krb5-1.3.3.

8. Tripwire Email Reporting Format String Vulnerability
BugTraq ID: 10454
Remote: Yes
Date Published: Jun 03 2004
Relevant URL: http://www.securityfocus.com/bid/10454
Summary:
Tripwire is affected by an email reporting format string vulnerability.  This issue is due to a failure to properly inplement a formatted string function.

This vulnerability will allow for execution of arbitrary code on a system running the affected software. This would occur in the security context of the user invoking the vulnerable application; typically the superuser.

**Update - It is reported that this issue only presents itself when the MAILMETHOD is sendmail.

9. Trend Micro Scanning Engine Report Generation HTML Injection...
BugTraq ID: 10456
Remote: Yes
Date Published: Jun 03 2004
Relevant URL: http://www.securityfocus.com/bid/10456
Summary:
Trend Micro's scanning engine is reportedly affected by an HTML injection vulnerability in its report generation feature. This issue is due to a failure to properly sanitize user-supplied before including it in a HTML report.

It has been speculated that the offending HTML alert reports run from the local zone on the affected computer, although this has not been verified.

This issue may be exploited by a remote attacker to execute arbitrary HTML or script code on an affected computer; potentially resulting in unauthorized access. Other attackers are also possible.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Exchange Information Store Security?  Send As... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/365052

2. SecurityFocus Microsoft Newsletter #191 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/364918

3. Relative Security Provided by Cached Domain Credenti... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/364873

IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. SP I-NET
By: Unisys
Platforms: Windows 95/98, Windows NT
Relevant URL: http://www.unisys.com/sp-security
Summary: 

Designed for business-to-business communications requiring trusted relationships, SP I-NET ensures confidentiality of data, authenticates the identity of the involved parties, and ensures the privacy of their communication.

2. secure2trust
By: Avoco Secure 
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.avocosecure.com/html_pages/products_service.html
Summary: 

secure2trust gives you the power to create documents that remain under your corporate control throughout their entire existence. Even if you allow another party to have a copy of your original document you can be sure that the copy will always have your original controls as part of its properties. The digital rights options which will control printing, copying, viewing, etc give you persistent and secure digital asset protection and intellectual property control. Digital rights mechanisms are the only way to ensure document integrity in a persistent way for both inter and intra company communications.

3. N-Stealth Security Scanner
By: N-Stalker
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.nstalker.com/products/nstealth/
Summary: 

N-Stealth is a vulnerability-assessment product that scans web servers to identify security problems and weaknesses that might allow an attacker to gain privileged access. The software comes with an extensive database of over 30,000 vulnerabilities and exploits. N-Stealth® is more actively maintained than the network security scanners and consequently has a larger database of vulnerabilities.

4. Softros LAN Messenger
By: Softros Systems Inc.
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://messenger.softros.com
Summary: 

Softros Messenger is a secure network messaging software application for corporate LANs (local area networks). It does not require a server and is very easy to install and use. Softros Messenger comes with a variety of handy features, like message notification alarms, personal or group messaging, and intuitive interface. Softros Messenger offers strong encryption options for all incoming and outgoing messages, guaranteeing no unauthorized person ever reads personal correspondence. The program is very stable when running under any Windows operating system and in any TCP/IP network, regardless of its size. Also Softros Messenger correctly identifies and works under Windows NT/2000/XP limited user accounts (without administrative privileges).

5. Network Time System
By: Softros Systems Inc.
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://nts.softros.com/
Summary: 

Network Time System - Secure, fast and accurate time sync software across entire network.

6. Anon-Encrypt
By: RiserSoft Corporation
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://risersoft.com/anon-encrypt.php
Summary: 

Surf the Internet Totally Anonymous, and Fully Encrypted with our Internet Explorer Pluging!

V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. XArp 0.1
By: Christoph Mayer
Relevant URL: http://www.chrismc.de
Platforms: Windows 2000, Windows XP
Summary: 

XArp is a graphical tool to monitor the ARP cache. It periodically requests the local ARP cache and reports changes in the IP to MAC mapping. Thus it can be used to recognize ARP poisoning which is used to prepare 'man in the middle' attacks on switched networks.

2. Honeynet Security Console 1.0
By: Activeworx, Inc.
Relevant URL: http://www.activeworx.org
Platforms: Windows 2000, Windows XP
Summary: 

Honeynet Security Console is an analysis tool to view events on your personal honeynet. It gives you the power to view events from Snort, TCPDump, Firewall, Syslog and Sebek logs. It also allows you to correlate events from each of these data types to have a full grasp of the attackers' actions.

3. LogMonitor 1.0
By: Adam Richard/SécurIT Informatique Inc.
Relevant URL: ftp://ftp.digitalvoodoo.org/pub/mirrors/securit/Logmon10free.zip
Platforms: Windows 2000, Windows NT, Windows XP
Summary: 

LogMonitor is a log analysis console.  It is 75% based on LogIDS, excepted for the GUI which is a complete makeover.  Instead of focusing on network location, LogMonitor presents the data in a set of floating windows grouped by application, which may be a more intuitive interface to some people.  The analysis is performed by defining the fields of each log we are monitoring, and then by using these fields to define rules as to what is important data or not.

4. Ettercap v0.7.0 pre2
By: ALoR <[email protected]>
Relevant URL: http://ettercap.sourceforge.net/
Platforms: FreeBSD, Linux, MacOS, NetBSD, Windows 2000, Windows NT, Windows XP
Summary: 

Ettercap is a network sniffer/interceptor/logger for ethernet LANs. It supports active and passive dissection of many protocols (even ciphered ones, like SSH and HTTPS). Data injection in an established connection and filtering on the fly is also possible, keeping the connection synchronized. Many sniffing modes were implemented to give you a powerful and complete sniffing suite. Plugins are supported. It has the ability to check whether you are in a switched LAN or not, and to use OS fingerprints (active or passive) to let you know the geometry of the LAN.

5. Syhunt TS Security Scanner 6.7 Build 96
By: Syhunt
Relevant URL: http://www.syhunt.com/section.php?id=scanner
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary: 

Syhunt TS Security Scanner is able to find the unfindable, not only known vulnerabilities, but also potential new ones.  The new version can identify and exploit vulnerabilities in a matter of minutes and is a key tool for security professionals and administrators.

6. yaSSL 0.1.0
By: tao51
Relevant URL: http://freshmeat.net/projects/yassl/?branch_id=48050&release_id=160245
Platforms: Linux, POSIX, Windows 2000, Windows NT, Windows XP
Summary: 

The yaSSL software package is a fast, dual-licensed implementation of SSL. It includes SSL client libraries and an SSL server implementation. It supports multiple APIs, including those defined by SSL and TLS. It also supports an OpenSSL compatibility interface.

VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.
    
VII. SPONSOR INFORMATION
-----------------------

This Issue is Sponsored By: SPI Dynamics

ALERT: "How Hackers Launch Blind SQL Injection Attacks- New White Paper
The newest web app vulnerability... Blind SQL Injection!
Even if your web application does not return error messages, it may still 
be open to a Blind SQL Injection Attack. Blind SQL Injection can deliver 
total control of your server to a hacker giving them the ability to read, 
write and manipulate all data stored in your backend systems! Download 
this *FREE* white paper from SPI Dynamics for a complete guide to 
protection! 

http://www.securityfocus.com/sponsor/SPIDynamics_ms-secnews_040607

------------------------------------------------------------------------