SecurityFocus Microsoft Newsletter #132

SecurityFocus Microsoft Newsletter #132
---------------------------------------

I. FRONT AND CENTER
     1. U.S. Information Security Law, Part 2
     2. The Reality of Perception
     3. SecurityFocus DPP Program
II. MICROSOFT VULNERABILITY SUMMARY
     1. Sambar Server File Disclosure Vulnerability
     2. Lilikoi Software Ceilidh Cross Site Scripting Vulnerability
     3. SAP DB RPM Install World Writable Binary Vulnerability
     4. Apple QuickTime Player Custom URL Vulnerability
     5. PHP-Nuke Block-Forums.PHP Subject HTML Injection Vulnerability
     6. PostNuke File Path Disclosure Vulnerability
     7. Snort Evasion Echo Flag Port Scan Vulnerability
     8. MyGuestBK Add.asp Cross Site Scripting Vulnerability
     9. MyGuestBK Unauthorized Admin Panel Access Vulnerability
     10. Multiple Name Server NXDomain Denial Of Service Vulnerability
     11. HP Instant TopTools Remote Denial Of Service Vulnerability
     12. Sambar Server Information Disclosure Vulnerability
     13. Sambar Server Multiple Cross Site Scripting Vulnerabilities
     14. PHP openlog() Buffer Overflow Vulnerability
     15. EZ Server Long Argument Local Denial Of Service Vulnerability
     17. PowerFTP FTP Command Buffer Overflow Denial Of Service...
     18. Apache Web Server Unspecified Denial Of Service Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
     1. LDAP V3 in Active Directory (Thread)
     2. Article Announcement: U.S. Information Security Law, Part 2...
     3. SecurityFocus Microsoft Newsletter #131 (Thread)
     4. Honeynet Scan of the Month for April released (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
     1. Sourcefire Intrusion Management System
     2. Luna CA
     3. NetLOCK
V.  NEW TOOLS FOR MICROSOFT PLATFORMS
     1. RainPortal v1.0
     2. Folder Password Expert v1.1
     3. ComLog v1.01
VI. SPONSOR INFORMATION




I. FRONT AND CENTER
-------------------
1. U.S. Information Security Law, Part 2
By Steven Robinson

This is the second part of a four-part series looking at U.S. information
security laws and the way those laws affect security professionals. In
this installment, we will look at the legal framework for security of an
enterprise's working environment from the perspective of information
security professionals, with particular emphasis on the protection of
communications.

http://www.securityfocus.com/infocus/1681

2. The Reality of Perception
By Tim Mullen

A new poll finds that seventy-seven percent of security professionals
believe Microsoft products are insecure. But a closer look at the survey
tells a far more interesting story.

http://www.securityfocus.com/columnists/152

3. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only
global early-warning system for cyber attacks - SecurityFocus DeepSight
Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml


II. BUGTRAQ SUMMARY
-------------------
1. Sambar Server File Disclosure Vulnerability
BugTraq ID: 7208
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7208
Summary:

Sambar Server is a multi-threaded web server which will run on Microsoft
Windows 9x/ME/NT/2000 operating systems.

Sambar Server does not properly validate input passed to iecreate.stm and
ieedit.stm.

By appending directory traversal sequences such as '../' to HTTP requests
for these applications, it is possible for a remote user to reveal the
contents of directories on the webserver.  Specifically, manipulating the
'url' URI parameter to include '../' sequences will return directory
contents to the remote user.

Information gathered in such a way may be used to launch further attacks
against the webserver.

This vulnerability was reported for Sambar Server 5.3b4 and earlier.

2. Lilikoi Software Ceilidh Cross Site Scripting Vulnerability
BugTraq ID: 7214
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7214
Summary:

Ceilidh is a content management system. It is available for a variety of
platforms including Microsoft Windows operating systems.

Ceilidh does not adequately filter some HTML code thus making it prone to
cross-site scripting attacks. It is possible for a remote attacker to
create a malicious link containing script code which will be executed in
the browser of a legitimate user.

An attacker can exploit this vulnerability by manipulating URI parameters
for the testcgi.exe script, included in the Ceilidh installation, to
include malicious HTML code. Any attacker-supplied code will be executed
within the context of the website running Ceilidh.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. The attacker may hijack the session of the legitimate by using
cookie-based authentication credentials. Other attacks are also possible.

This vulnerability was reported for Ceilidh 2.70 and earlier.

3. SAP DB RPM Install World Writable Binary Vulnerability
BugTraq ID: 7242
Remote: No
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7242
Summary:

SAP DB is a free enterprise level database available for Microsoft
Windows, Linux, Solaris, AIX, Tru64, and HP-UX platforms.

When SAP DB is installed using RPM packages, insecure permissions are left
on two binaries.

After performing the installation, the lserver and dbmsrv binaries have
'777' permissions.  This allows any user on the system to write to the
binaries.

It should be noted that this vulnerability only exists when SAP DB is
installed using RPM packages.  Installing SAP DB from tgz packages will
leave these binaries with '755' permissions.

4. Apple QuickTime Player Custom URL Vulnerability
BugTraq ID: 7247
Remote: Yes
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7247
Summary:

QuickTime Player is the media player distributed by Apple for QuickTime
Media Files.  This problem affects the player on the Microsoft Windows
platform.

A problem in the software may make remote code execution possible.

It has been reported that the QuickTime Player does not properly handle
some types of URLs.  Because of this, a remote attacker may be able to
execute arbitrary commands on the vulnerable system.

Few technical details are available concerning this vulnerability.  It is
known that for an attack to be successful, a user must load a
maliciously-crafted URL into the QuickTime Player.  It is also known that
loading the URL results in the execution of arbitrary code as the
QuickTime user.

Initial reports indicate that this issue is a buffer overrun
vulnerability.  If this is the case, it would be possible for the attacker
to place malicious instructions in the URL supplied to the target user.
When the URL is loaded into the player, the instructions contained in the
URL would be executed with the privileges of the user invoking QuickTime.
This vulnerability has been reported to affect QuickTime on only the
Microsoft Windows platform.

5. PHP-Nuke Block-Forums.PHP Subject HTML Injection Vulnerability
BugTraq ID: 7248
Remote: Yes
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7248
Summary:

PHP-Nuke is a web-based portal system. Implemented in PHP, it is available
for a range of systems, including Unix, Linux, and Microsoft Windows.

The PHP-Nuke 'block-Forums.php' script does not sufficiently sanitize data
supplied via form fields, making it prone to HTML injection attacks.  In
particular, the subject field is not sanitized of HTML tags.  This could
allow for execution of hostile HTML and script code in the web client of a
user who visits a web page that contains the malicious code.  This would
occur in the security context of the site hosting the software.

Exploitation could allow for theft of cookie-based authentication
credentials or other attacks.

6. PostNuke File Path Disclosure Vulnerability
BugTraq ID: 7218
Remote: Yes
Date Published: Mar 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7218
Summary:

PHP-Nuke is a web based Portal system. Implemented in PHP, it is available
for a range of systems, including Unix, Linux, and Microsoft Windows.

Multiple path disclosure vulnerabilities have been reported in various PHP
scripts used by PHP-Nuke. The issue occurs when a request is made which
includes invalid URI 'file' parameters to the 'Stats' or 'Members_List'
pages.

The affected scripts do not provide sufficient error handling for this
circumstance and as such, may display an error page containing sensitive
information path information. Access to sensitive filesystem information
may aid an attacker in launching further attacks against a target system.

7. Snort Evasion Echo Flag Port Scan Vulnerability
BugTraq ID: 7220
Remote: Yes
Date Published: Mar 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7220
Summary:

Snort is a freely available, open source intrusion detection system.  It
is available for Unix, Linux, and Microsoft Windows platforms.

It has been reported that a vulnerability exists in the default
configuration of Snort.  Due to this issue it is possible for a user to
evade detection while performing some types of scans.

The problem is in the detection of specifically crafted packets.  When a
port scan is initiated with the TCP SYN, FIN, and ECN flags set, the
default configuration of snort will not register these packets as an IDS
event.  This could permit an attacker to gather information on network
resources that could be used for more organized attack against systems.

This problem has been reported in version 1.9.1, though earlier versions
may be affected.

8. MyGuestBK Add.asp Cross Site Scripting Vulnerability
BugTraq ID: 7211
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7211
Summary:

MyGuestBK is freely available guestbook software. It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

It has been reported that MyGuestBK does not sufficiently filter
user-supplied URI parameters from the 'message' variable on the MyGuestBK
Information Server 'add.asp' page.

As a result of this reported deficiency, it may be possible for a remote
attacker to create a malicious link containing script code that will be
executed in the browser of a legitimate user. All code will be executed
within the context of the website running MyGuestBK Server.

This may allow for theft of cookie-based authentication credentials and
other attacks.

9. MyGuestBK Unauthorized Admin Panel Access Vulnerability
BugTraq ID: 7213
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7213
Summary:

MyGuestBK is freely available guestbook software. It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

It has been reported that an attacker may access arbitrary myGuestBK
administrative functions through the MyGuestBK administration panel
without prior authorization.

This vulnerability is likely due to misconfigured directory permissions
for the 'admin' directory. Typically, the contents of this directory
should be restricted to trusted individuals only.

10. Multiple Name Server NXDomain Denial Of Service Vulnerability
BugTraq ID: 7217
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7217
Summary:

DNS is the RFC-specified domain name system.  It exists in multiple
implementations for UNIX, Linux, and Microsoft Windows.

A problem in the implementation of some name servers could lead to denial
of service attacks.

It has been reported that an issue in the handling of some types of DNS
requests exists.  Because of response codes sent for some queries, an
attacker could abuse this handling problem to deny name resolution to
users of one name server to hosts of another domain.

The problem is in the handling of NXDOMAIN responses.  When certain
responses are received by a name server, such as NXDOMAIN (RCODE 3), the
name server will attempt no further resolution of the host for which the
response was received until the negative cache expires.  An attacker could
exploit this issue in some circumstances to make a host unresolvable via
DNS.

Caching DNS resolvers may also be prone to this issue.

This issue is likely to occur most frequently in IPv6/IPv4 dual stack
implementations.

11. HP Instant TopTools Remote Denial Of Service Vulnerability
BugTraq ID: 7246
Remote: Yes
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7246
Summary:

Instant TopTools is a remote system monitoring software package
distributed by HP.  Instant TopTools is available for Unix, Linux, and
Microsoft operating systems.

A problem with the software could make a denial of service possible.

It has been reported that Instant TopTools does not properly handle some
types of requests.  Because of this, a remote user could potentially deny
service to a host using the vulnerable software.

The problem is in the handling of the Instant TopTools calling itself.
When a request is issued where the Instant TopTools hpnst.exe program
calls itself, the program enters a loop, and begins consuming resources.
Multiple requests will render the vulnerable host unusable, requiring a
reboot to resume normal function.

This problem has been reported to affect Instant TopTools on the Microsoft
Windows platform.  Other platforms may also be affected.

12. Sambar Server Information Disclosure Vulnerability
BugTraq ID: 7207
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7207
Summary:

Sambar Server is a multi-threaded web server which will run on Microsoft
Windows 9x/ME/NT/2000 operating systems.

An information disclosure vulnerability has been reported for Sambar
Server. The vulnerability exists in the 'environ.pl' and 'testcgi.exe'
files in Sambar Server's cgi-bin directory.

An attacker can exploit this vulnerability by making a request for either
of these files. This will result in Sambar Server returning potentially
sensitive information.

An attacker can use the information obtained in this manner to launch
further attacks against a vulnerable host.

This vulnerability was reported for Sambar Server 5.3b4 and earlier.

13. Sambar Server Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 7209
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7209
Summary:

Sambar Server is a multi-threaded web server which will run on Microsoft
Windows 9x/ME/NT/2000 operating systems.

Sambar Server does not adequately filter some HTML code thus making it
prone to cross-site scripting attacks. It is possible for a remote
attacker to create a malicious link containing script code which will be
executed in the browser of a legitimate user.

An attacker can exploit this vulnerability by manipulating URI parameters
several pages, included in the Sambar installation, to include malicious
HTML code. Any attacker-supplied code will be executed within the context
of the website running Sambar Server.

This vulnerability affects several files that exist in the
'/sysuser/docmgr/', '/syshelp/cscript/', '/syshelp/', '/netutils/',
'/isapi/', '/cgi-bin/', '/samples/' and '/wwwping' directories.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. The attacker may hijack the session of the legitimate by using
cookie-based authentication credentials.

This vulnerability was reported for Sambar Server 5.3b4 and earlier.

14. PHP openlog() Buffer Overflow Vulnerability
BugTraq ID: 7210
Remote: No
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7210
Summary:

PHP is a freely available, open source web scripting language package. It
is available for Microsoft Windows, Linux, and Unix operating systems.

A buffer overflow has been reported in PHP version 4.3.1 on the Microsoft
Windows operating system. The problem occurs in the openlog() function and
can be triggered by passing excessive data as the 'string ident'. This
argument is used to prepend a string to logged data however, passing a
string containing roughly 1500 bytes of data will cause a buffer to be
overrun.

The exploitation of this vulnerability may allow an attacker to trigger a
denial of service.

Although unconfirmed, it may also be possible for an attacker to leverage
an attack to execute arbitrary code within the PHP interpreter.

This vulnerability was reported for PHP 4.3.1. It is likely that other
versions are affected.

15. EZ Server Long Argument Local Denial Of Service Vulnerability
BugTraq ID: 7243
Remote: Yes
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7243
Summary:

EZ Server is a freely available FTP and HTTP server.  It is available for
the Microsoft Operating System.

A problem with the software may make a denial of service possible.

It has been reported that the EZ Server software does not sufficiently
handle strings of excessive length in some circumstances.  Because of
this, a remote attacker may be able to deny service to legitimate users of
the system.

The problem is in the handling of arguments to FTP commands.  An argument
issued with an FTP command that is of excessive length may cause the
server to crash.  This vulnerability was reportedly reproduced using a
minimum of 1994 bytes of data with FTP commands such as cd and ls.

This vulnerability may be a memory corruption issue, and potentially an
exploitable buffer overrun.  If this is the case, it is possible for an
attacker with login access to the vulnerable FTP server to execute code
with the privileges of the server software.

16. Oracle JDBC Daylight Savings Time Timestamp Weakness
BugTraq ID: 7241
Remote: No
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7241
Summary:

The JDBC thin driver is a component of the Oracle Database.  Oracle is
available for Unix, Linux, and Microsoft operating systems.

A problem with the software may lead to log inconsistency.

It has been reported that the JDBC thin driver distributed with Oracle
databases does not sufficiently handle some timestamps.  Because of this,
transaction times in Oracle logs and databases may be inaccurate.

The problem is in the handling of daylight savings time.  It has been
reported that errors occur during the hour in which daylight savings time
occurs.  Timestamps entered by the driver may be inaccurate, and could
thus lead to a loss of integrity of log files.

17. PowerFTP FTP Command Buffer Overflow Denial Of Service Vulnerability
BugTraq ID: 7251
Remote: Yes
Date Published: Apr 01 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7251
Summary:

PowerFTP server is a shareware ftp server available for the Microsoft
Windows platform. It is distributed and maintained by Cooolsoft.

A buffer overflow vulnerability has been reported for PowerFTP. This
vulnerability occurs when overly long values are supplied for some FTP
commands. Specifically, the 'ls' and 'cd' commands are vulnerable to
exploitation.

An attacker can exploit this vulnerability by connecting to a vulnerable
system and sending an overly long value, consisting of at least 1994
characters, to either the 'ls' or 'cd' commands. This will trigger the
overflow condition and will cause PowerFTP to crash thereby resulting in a
denial of service.

Although unconfirmed, it may be possible to exploit this vulnerability to
run attacker-supplied code with the privileges of PowerFTP.

This vulnerability was reported for PowerFTP 2.25.

18. Apache Web Server Unspecified Denial Of Service Vulnerability
BugTraq ID: 7254
Remote: Yes
Date Published: Apr 02 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7254
Summary:

Apache is a freely available web server. It is available for a variety of
platforms including the Unix, Linux and, Microsoft Windows operating
systems.

A vulnerability has been reported for the Apache web server that will
result in a denial of service condition. This vulnerability only affects
Apache 2.0 series web servers.  It is not known if this affects Apache
running on only specific platforms, or Apache on all platforms.

Further details of this vulnerability are currently unknown. This BID will
be updated as more information becomes available.


III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. LDAP V3 in Active Directory (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/317367

2. Article Announcement: U.S. Information Security Law, Part 2 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/317062

3. SecurityFocus Microsoft Newsletter #131 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/316879

4. Honeynet Scan of the Month for April released (Thread)
Relevant URL:

http://online.securityfocus.com/archive/88/317100


IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. Sourcefire Intrusion Management System
by Sourcefire
Platforms: N/A
Relevant URL:
http://www.securityfocus.com/www.sourcefire.com/products/products.htm
Summary:

Sourcefire Intrusion Management System (IMS) delivers all of the
capabilities needed to proactively defend against intruders. Unlike
current intrusion detection systems, Sourcefire offers a comprehensive
system that gives one granular flexibility, scalability, and complete data
management. Sourcefire IMS offers the best protection and allows users to
customize every aspect of the system to suit their specific environment
and security needs.

2. Luna CA
by Chrysalis-ITS
Platforms: HP-UX, Solaris, Windows NT
Relevant URL:
http://www.chrysalis-its.com/trusted_systems/luna_ca3.htm
Summary:

LunaCA is a security solution that offloads sensitive cryptographic
processing from host computers or servers which act as CAs or trusted
third parties in a Public-Key Infrastructure.

3. NetLOCK
by Netlock Technologies, Inc.
Platforms: AIX, HP-UX, MacOS, Netware, Solaris, Windows 95/98, Windows NT
Relevant URL:
http://www.netlock.com/product.html
Summary:

NetLOCK comprises a suite of software modules, including NetLOCK Manager,
NetLOCK Agent, NetLOCK Gateway, and NetLOCK Auditor. NetLOCK works at the
operating system network layer -- below the transport layer of TCP/IP and
IPX protocols. It provides communication security, data confidentiality,
device-level authentication, access control, and data integrity all
automatically and behind-the-scenes, as configured by the administrator.


V.  NEW TOOLS FOR MICROSOFT PLATFORMS
-------------------------------------
1. RainPortal v1.0
by Florent DEFONTIS
Relevant URL:
http://www.securesphere.net/html/projects_rainp.php
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

RainPortal was designed to secure your private messages while talking on
IRC networks. As long as you have RainPortal running and the person you
are talking to also, all your private messages will be strongly encrypted
while passing on the server.

2. Folder Password Expert v1.1
by Olaf Laturner
Relevant URL:
http://www.folder-password-expert.com
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

Folder Password Expert is a software tool that lets you restrict access to
the folders that contain your sensitive data. When folders are password
protected and locked, their contents cannot be read, copied, modified or
deleted. To access the locked folders, you must supply the correct
password.

3. ComLog v1.01
by Adam Richard
Relevant URL:
http://iquebec.ifrance.com/securit/
Platforms: Windows 2000, Windows NT
Summary:

ComLog is a command prompt logger for Windows NT/2K, that takes the place
of cmd.exe and redirects commands to a renamed cmd.exe for execution.
ComLog can be used in a variety of ways, be it to monitor network users
command prompt usage, or to monitor commands typed by a cracker via an
abused IIS server or via a netcat tunnel. Sessions are kept in
random-named text files in a fake windows directory in order to try to
hide its presence. ComLog log files can be centralized and monitored in
real-time with LogAgent.


VI. SPONSOR INFORMATION
-----------------------