SecurityFocus Microsoft Newsletter #161

SecurityFocus Microsoft Newsletter #161
----------------------------------------
This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_ms-secnews_031103
and use priority code SF4.
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Introduction to Nessus
     2. Reeducation Campaign
     3. Pretty Good at Gettin' By
II. MICROSOFT VULNERABILITY SUMMARY
     1. Microsoft Windows HTML Help API Privilege Escalation Vulnera...
     2. Microsoft Internet Explorer Local Resource Reference Vulnera...
     3. Opera Web Browser IFRAME Zone Restriction Bypass Vulnerabili...
     4. Atrium Software Mercur Mailserver POP3 AUTH Remote Buffer Ov...
     5. Multiple Advanced Poll PHP Vulnerabilities
     6. Rit Research Labs The Bat! User Directories Insecure Default...
     7. Sun Microsystems Java Virtual Machine Security Manager Denia...
     8. Macromedia Flash Player Flash Cookie Predictable File Locati...
     9. Les Visiteurs Multiple Remote File Include Vulnerabilities
     10. Fastream NetFile Error Message Cross-Site Scripting Vulnerab...
     11. Centrinity FirstClass HTTP Server Directory Disclosure Vulne...
     12. TelCondex SimpleWebserver HTTP Referer Remote Buffer Overflo...
III. MICROSOFT FOCUS LIST SUMMARY
     1. ICF Firewall - How can I do it? (Thread)
     2. IIS 6 features (Thread)
     3. AW: Coexistance of Windows 2000 and Windows 2003 (Thread)
     4. Win Server 2k3 Hardening (Thread)
     5. MD5 sums for Nachi and Blaster variants? (Thread)
     6. Terminal Services Auditing? (Thread)
     7. Coexistance of Windows 2000 and Windows 2003 (Thread)
     8. Event Log messages for failed logon attempts (Thread)
     9. SecurityFocus Microsoft Newsletter #160 (Thread)
     10. Auditing enabled but Logon Failures not showing up (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
     1. Local Account Password Manager
     2. Advanced Cisco Security Agent
     3. SecretAgent
     4. Typhon
     5. NGSSquirrel
     6. Squirrel For Oracle
V. NEW TOOLS FOR MICROSOFT PLATFORMS
     1. Enigmail v0.82.0
     2. GPA (GNU Privacy Assistant) v0.7.0
     3. Anti-Spam SMTP Proxy v1.0.6
     4. PipeACL tools v1.0
     5. Libnids 1.18
     6. Mod_security v 1.7
VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Introduction to Nessus
By Harry Anderson

This article describes the installation, configuration and features of the
latest version of Nessus, a powerful and free client-server based security
scanner.

http://www.securityfocus.com/infocus/1741

2. Reeducation Campaign
By Tim Mullen

Microsoft's best chance for regaining the revenue lost to security
concerns isn't in eliminating bugs, it's in teaching customers how to use
buggy software.

http://www.securityfocus.com/columnists/195

3. Pretty Good at Gettin' By
By George Smith

Whether it's a student slipping contraband past airport metal detectors,
or a researcher modeling an unstoppable computer virus -- demonstrations
just don't do justice to the real state of security.

http://www.securityfocus.com/columnists/194


II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. Microsoft Windows HTML Help API Privilege Escalation Vulnera...
BugTraq ID: 8884
Remote: No
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8884
Summary:
The Microsoft HTML Help API is the standard mechanism used by developers
of Windows software for providing and presenting "help" documents to
users.  It has been reported that the use of the Help API by applications
which run with elevated privileges may lead to an exploitable condition.

According to the report, the condition is present because of the way
Microsoft Internet Explorer is used as part of the help functionality.  It
is alleged that when the MSIE process is created, the privileges of the
application, if different from the user, are not lowered.  As a result, it
is reportedly possible for attackers to use the MSIE component to navigate
to the filesystem  and execute commands with the privileges of the
application from which the "help" interface was spawned.

Successful exploitation of this vulnerability is dependent on two
important factors:

The attacker must have local desktop access on the target host.  This may
be at the console or remotely (e.g. over terminal services).

There must be an application which will invoke the HTML Help API with
elevated privileges.  System-level utilities such as personal firewall and
anti-virus software may be ideal targets for this attack.

2. Microsoft Internet Explorer Local Resource Reference Vulnera...
BugTraq ID: 8886
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8886
Summary:
Microsoft Internet Explorer is prone to an issue that may allow for
unauthorized access to local resources.  Internet Explorer version 6 SP1
imposed restrictions to limit remote sites from accessing local resources
via file:// or res:// URIs (or other variants).  It is reported that these
restrictions may be bypassed by adding an additional slash when specifying
a resource via one of these protocols.   The following example was
provided:

file:///c:/somefile.html

This could aid in exploitation of other vulnerabilities, such as issues
that permit an attacker to create files on a client system in a
predictable location.  Such content could then be referenced by an
attacker using these protocols.

The initial vulnerability analysis stated that the issue allowed for Zone
Restriction Bypass via malformed IFRAMES.  Additional technical
information has been provided that contradicts the initial analysis.  BID
8900 was created to describe the separate issue in Macromedia Flash.

If this issue were exploited in combination with other issues, it would
still be possible to cause arbitrary code to be executed on a client
system.  The pre-requisites of exploitation are that an attacker must have
a way to store malicious content on a client system in a predictable
location and then must exploit this issue to reference that content,
causing it to be executed in the context of the Local Zone.  Other attacks
may also be possible and attack vectors may exist in other applications
that depend on Internet Explorer.

Liu Die Yu has released conflicting information that states that this
issue occurs because the user is redirected into a local resource and then
the local resource is being refreshed.  It is reported that other
variations such as "file://" or "[DriveLetter]:\[...]" also work with this
exploit.  This is currently under investigation.

3. Opera Web Browser IFRAME Zone Restriction Bypass Vulnerabili...
BugTraq ID: 8887
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8887
Summary:
Opera is a web browser available for a number of platforms, including
Microsoft Windows, Linux and Unix variants and Apple MacOS.

A flaw in the Opera web browsers security model has been discovered that
could allow an attacker to access a users file system within the Local
Zone. The problem occurs when handling malformed HTML iframes which point
to local system locations. Exploitation of this vulnerability could result
in the exposure of sensitive data or could potentially lead to the
corruption of system critical files. Symantec has confirmed that the proof
of concept provided by the researcher effectively gains opens access to
the local file system, however it has not been confirmed whether the local
files may be modified.

It should be noted that due to the nature of this vulnerability it may
theoretically be possible to leverage the condition to execute arbitrary
code. However, Symantec is currently unaware if a method exists under
which Opera can be influenced to carry out this type of operation.

This vulnerability is believed to affect the latest release of Opera as
well as prior releases.

**UPDATE: The vendor has contacted Symantec and has stated that this is
not a vulnerability.  Symantec has not been able to reproduce the claims
made by the individual who reported this issue.  This record is being
retired, though it may be re-activated if further findings confirm
existence of the vulnerability.

4. Atrium Software Mercur Mailserver POP3 AUTH Remote Buffer Ov...
BugTraq ID: 8889
Remote: Yes
Date Published: Oct 25 2003
Relevant URL: http://www.securityfocus.com/bid/8889
Summary:
MERCUR Mailserver is a commercially available mail software solution
distributed and maintained by Atrium Software International. It is
available for the Microsoft Windows platform.

A problem has been reported in MERCUR Mailserver when handling the POP3
AUTH command. This problem may make it possible for an attacker crash the
service on a vulnerable system.

The problem is in the handling of long arguments to the AUTH command. When
a string of excessive length is supplied to the AUTH command via the PLAIN
option, the process becomes unstable. This is due to a boundary condition
error in the base64 decoding routine.

It is possible for an attacker to exploit this issue to execute arbitrary
instructions. Any instructions executed on a vulnerable host would be
executed with the privileges of the POP3 server process, which in a
typical implementation may execute with SYSTEM privileges.

5. Multiple Advanced Poll PHP Vulnerabilities
BugTraq ID: 8890
Remote: Yes
Date Published: Oct 25 2003
Relevant URL: http://www.securityfocus.com/bid/8890
Summary:
Advanced Poll is a freely available, open source PHP web application.  It
is available for the Unix, Linux, and Microsoft platforms.

Several problems exist in Advanced Poll when handling input from remote
users.  Because of this, an attacker may be able to gain sensitive
information, include php files, or execute PHP code.

The following issues exist:

The comments.php file does not properly filter input in some fields.  If
magic_quotes_gpc=OFF has been set in PHP, an attacker could submit PHP
code in some fields to the script, which would execute the code on the
local host with the privileges of the web server process.

The following files allow the remote inclusion of arbitrary PHP files.
booth.php
poll_ssi.php
popup.php
index.php

(the above files are vulnerable with register_globals off or on)

admin_tpl_new.php
admin_tpl_misc_new.php
admin_templates_misc.php
admin_templates.php
admin_stats.php
admin_settings.php
admin_preview.php
admin_password.php
admin_logout.php
admin_license.php
admin_help.php
admin_embed.php
admin_edit.php
admin_comment.php

(the above files are vulnerable only with register_globals off)

An attacker could use this issue to reference PHP files on remote servers,
which would result in the execution of commands locally.

The file contained in misc/info.php allows a remote attacker to gain
information from the phpinfo() function.

6. Rit Research Labs The Bat! User Directories Insecure Default...
BugTraq ID: 8891
Remote: No
Date Published: Oct 25 2003
Relevant URL: http://www.securityfocus.com/bid/8891
Summary:
The Bat! is a commercially-available mail user agent, distributed and
maintained by Rit Research Labs.  It is available for the Microsoft
Windows platform.

A problem has been identified in the The Bat! e-mail client.  Because of
this, an attacker may be able to gain unauthorized access to potentially
sensitive information.

The problem is in the creation and maintenance of user directories.  When
a user is added and an account set up, the user's account is stored in the
following directory:

\Program Files\The Bat!\MAIL\USERACCT

USERACCT represents the username of a newly added user.  The Bat! does not
enforce proper access controls on these directories, making it possible
for an unauthorized user to read potentially sensitive information, such
as the user's e-mail archives.

7. Sun Microsystems Java Virtual Machine Security Manager Denia...
BugTraq ID: 8892
Remote: Yes
Date Published: Oct 26 2003
Relevant URL: http://www.securityfocus.com/bid/8892
Summary:
The Java Virtual Machine is a component of the Sun Microsystems Java
distributions.  It is available for Unix, Linux, and Microsoft Windows
platforms.

A problem has been reported in the Sun Microsystems Java Virtual Machine
that occurs when implementing the Security Manager.  Exploitation of this
condition can result in the crashing of the virtual machine itself.  The
specifics of the problem are not currently known.

Specific circumstances are not known in which exploitation of this issue
could occur.  The issue is, however, indicative of a problem in the
internals of the Java Virtual Machine.  It is conjectured that this is a
security issue, though this has not yet been confirmed.  This Bugtraq ID
will be further updated when further analysis and detail is available.

8. Macromedia Flash Player Flash Cookie Predictable File Locati...
BugTraq ID: 8900
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8900
Summary:
Macromedia Flash Player is reported to store Flash cookies (.sol files) in
a predictable location on client systems.  Specifically, Flash cookies
will be stored in the following location on the local filesystem:

%APPDATA%\Macromedia\Flash Player\YOURDOMAINNAME.TLD\YOURDOMAINNAME.sol

where %APPDATA% typically expands to C:/My
Documents/[username]/Application Data/.

Other attacks are possible given the ability to store content on a system
in a predictable location, such as referencing the content via a file://
URI (or some other variation).  This vulnerability is compounded by the
fact that an attacker could include HTML and script code in the cookie,
which may be interpreted by Internet Explorer or possibly other browsers.
In the example of Internet Explorer, such content would be interpreted in
the context of the Local Zone.

The issue could be exploited via a malicious web page that includes code
that sets a Flash cookie and then attempts to use some other means to
reference the cookie.  Successful exploitation would still require the
attacker to guess the local username of the victim.

This issue is reported to affect versions of the player for Microsoft
Windows operating systems.  Other versions may also be affected.
Macromedia Director MX is similarly affected.

This issue was originally covered by BID 8886 but has been determined to
be a distinct issue in Macromedia Flash.  BID 8886 was also updated with
additional technical details describing a new issue in Internet Explorer.
The original report for these issues was a proof-of-concept provided by
Mindwarper which exploited both of the issues simultaneously.

Andreas Sandblad has also demonstrated that it is possible to circumvent
the requirement of guessing the local username of the victim by exploiting
BID 7826.

9. Les Visiteurs Multiple Remote File Include Vulnerabilities
BugTraq ID: 8902
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8902
Summary:
Les Visiteurs is a freely available, open source web site statistics
script.  It is written in PHP, and available for the Unix, Linux, and
Microsoft platforms.

A problem has been reported in the handling of some types of input by Les
Visiteurs.  Because of this, an attacker may be able to execute arbitrary
commands on the system.

The problem is in the handling of include files.  The config.inc.php and
new-visitor.inc.php scripts do not sufficiently validate include variables
at multiple locations within the script.  An attacker could supply a
remote location containing a malicious file and execute commands on the
host with the privileges of the web server.

10. Fastream NetFile Error Message Cross-Site Scripting Vulnerab...
BugTraq ID: 8908
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8908
Summary:
Fastream NetFile is a FTP and web server for Microsoft Windows Platforms.

A vulnerability has been reported to present in the software that may
allow a remote attacker to execute HTML or script code in a user's
browser.

It has been reported that the problem arises when a non-exisiting URL is
requested.  The software returns a "404 Not Found" error message to the
user containing the URL. The problem exists due to insufficient
sanitization of this URL, therefore making it possible for an attacker to
a construct a malicious link containing HTML or script code that may be
rendered in a user's browser. The script code would run in the context of
the site.

Successful exploitation of this attack may allow an attacker to steal
cookie-based authentication information that could be used to launch
further attacks.

NetFile FTP/Webserver Version 6.0.3.588 has been reported to be prone to
this issue, however other versions may be affected as well.

11. Centrinity FirstClass HTTP Server Directory Disclosure Vulne...
BugTraq ID: 8920
Remote: Yes
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8920
Summary:
FirstClass is a commercially available suite of network service utilities
available from Centrinity. It is available primarily for the Microsoft
Windows platform. Versions exist for Apple platforms as well.

A vulnerability has been reported to exist in the FirstClass HTTP server
that may allow a remote attacker to gain sensitive information through the
server root and user web directories.

The problem presents itself when "/Search" is appended to the URL of the
server which directs the user to a file search form.  The attacker may
then be able to access information about the directories by selecting all
options in the form and leaving the filename field blank.

**Conflicting reports have been submitted concerning this issue.  It has
been reported that universal access to server root and user web
directories is granted by default in order to accommodate ease of use.  No
sensitive information is placed in these directories by default.  If
needed, users may protect private portions of the web site by employing
FirstClass' ACL protected
containers called conferences.  It has also been reported that the search
utility may be easily disabled by accessing "Unauthenticated Users"
privilege group located in the "Groups" folder.

Successful exploitation of this issue result in disclosure of sensitive
information which may be useful in further attacks against the system.

This problem has been reported to exist in FirstClass 7.1. It is possible
that other versions are affected as well.

12. TelCondex SimpleWebserver HTTP Referer Remote Buffer Overflo...
BugTraq ID: 8925
Remote: Yes
Date Published: Oct 29 2003
Relevant URL: http://www.securityfocus.com/bid/8925
Summary:
TelCondex SimpleWebServer is a Web server designed for use with the
Microsoft Windows operating systems.

A vulnerability has been reported to exist in the software that may allow
a remote attacker to gain unauthorized access by executing arbitrary code
on a vulnerable system. The condition is present due to insufficient
boundary checking.

The problem is reported to exist due to the HTTP referer header. It has
been reported that an attacker may be able to crash the server by sending
700 bytes of data through the HTTP referer header and overwrite the return
address on the stack with 704 bytes.  The issue presents itself due to
insufficient bounds checking of HTTP referer variable. A remote attacker
may ultimately exploit this issue remotely and execute arbitrary code in
the context of the user who is running the vulnerable software. This issue
could be exploited to allow an attacker to gain unauthorized access to the
vulnerable system.

Successful exploitation of this issue may allow an attacker to cause a
denial of service condition or execute arbitrary code in the context of
the web server in order to gain unauthorized access to a vulnerable
system.

SimpleWebServer version 2.12.30210 Build 3285 has been reported to be
prone to this issue, however other versions may be affected as well.


III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. ICF Firewall - How can I do it? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342977

2. IIS 6 features (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342939

3. AW: Coexistance of Windows 2000 and Windows 2003 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342748

4. Win Server 2k3 Hardening (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342746

5. MD5 sums for Nachi and Blaster variants? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342743

6. Terminal Services Auditing? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342742

7. Coexistance of Windows 2000 and Windows 2003 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342741

8. Event Log messages for failed logon attempts (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342581

9. SecurityFocus Microsoft Newsletter #160 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342558

10. Auditing enabled but Logon Failures not showing up (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/342509


IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. Local Account Password Manager
By: Foghorn Security
Platforms: Windows NT
Relevant URL: http://www.foghornsecurity.com/foghorn/lapm.html
Summary:

LAPM allows the administrator to organize all the workstations and member
server machines from one or more domains into logical groups - ie.
"marketing", "web services", "accounting", etc.. Each logical group is
assigned a "knowledge key" by the administrator. LAPM uses the knowledge
key to generate and apply a unique local administrator password for each
host in that group.

2. Advanced Cisco Security Agent
By: Cisco Systems
Platforms: Solaris, Windows 2000, Windows NT, Windows XP
Relevant URL:
http://www.cisco.com/en/US/products/sw/secursw/ps5057/index.html
Summary:

The advanced Cisco Security Agent product provides threat protection for
server and desktop computing systems, also known as endpoints. The Cisco
Security Agent goes beyond conventional host and desktop security
solutions by identifying and preventing malicious behavior before it can
occur, thereby removing potential known and unknown ("Day Zero") security
risks that threaten enterprise networks and applications. The Cisco
Security Agent aggregates and extends multiple endpoint security functions
by providing host intrusion prevention, distributed firewall, malicious
mobile code protection, operating system integrity assurance, and audit
log consolidation all within a single agent package.

3. SecretAgent
By: Information Security Corporation (ISC)
Platforms: Linux, MacOS, UNIX, Windows 2000, Windows 95/98, Windows NT,
Windows XP
Relevant URL: http://www.infoseccorp.com/products/secretagent/contents.htm
Summary:

SecretAgent is a file encryption and digital signature utility, supporting
cross-platform interoperability over a wide range of platforms: Windows,
Linux, Mac OS X, and UNIX systems.

It's the perfect solution for your data security requirements, regardless
of the size of your organization.

Using the latest recognized standards in encryption and digital signature
technology, SecretAgent ensures the confidentiality, integrity, and
authenticity of your data.

4. Typhon
By: Next Generation Security Software Limited (NGSSoftware)
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.ngssoftware.com/products/typhon.htm
Summary:

Typhon III includes automated Web Application checking for bugs such as
SQL Injection and Cross Site Scripting.

Typhon III is not simply just another security assessment tool; it's an
intelligent vulnerability scanner that has been designed & developed by
the worlds leading vulnerability researchers (who between them have
discovered over 200 vulnerabilities).

5. NGSSquirrel
By: Next Generation Security Software Limited (NGSSoftware)
Platforms: Windows 2000, Windows XP
Relevant URL: http://www.nextgenss.com/products/ngssquirrel.htm
Summary:

NGSSQuirreL is the most comprehensive security-auditing tool specifically
designed for Microsoft SQL Server currently available.

NGSSQuirreL is more than simply an auditing tool with its capacity for
database server lockdown SQL scripts.

6. Squirrel For Oracle
By: Next Generation Security Software Limited (NGSSoftware)
Platforms: Windows 2000, Windows XP
Relevant URL: http://www.nextgenss.com/products/squirrelfororacle.htm
Summary:

NGSSQuirreL for Oracle is the most comprehensive security-auditing tool
specifically designed for an Oracle Database Server. NGSSQuirreL for
Oracle performs the fullest audit of business risk currently available in
any Oracle scanner.


V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. Enigmail v0.82.0
By: Patrick
Relevant URL: http://enigmail.mozdev.org/thunderbird.html
Platforms: Linux, MacOS, POSIX, UNIX, Windows 2000, Windows 3.x, Windows
95/98, Windows CE, Windows NT, Windows XP
Summary:

Enigmail is a "plugin" for the mail client of Mozilla and Netscape 7.x
which allows users to access the authentication and encryption features
provided by the popular GnuPG software. Enigmail can encrypt/sign mail
when sending, and can decrypt/authenticate received mail. It can also
import/export public keys. Enigmail supports both the inline PGP format
and the PGP/MIME format, which can be used to encrypt attachments.
Enigmail is cross-platform, although binaries are supplied only for a
limited number of platforms. Enigmail uses inter-process communication to
execute GPG to carry out encryption/authentication.

2. GPA (GNU Privacy Assistant) v0.7.0
By: Bernhard Reiter
Relevant URL: http://www.gnupg.org/(en)/related_software/gpa/index.html
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

The GNU Privacy Assistant is a graphical frontend to GnuPG and may be used
to manage the keys and encrypt/decrypt/sign/check files. It is much like
Seahorse.

3. Anti-Spam SMTP Proxy v1.0.6
By: John Hanna
Relevant URL: http://assp.sourceforge.net/
Platforms: BSDI, Linux, MacOS, Os Independent, OS/2, Perl (any system
supporting perl), POSIX, Windows 2000, Windows NT
Summary:

The Anti-Spam SMTP Proxy (ASSP) Server project aims to create an open
source platform independent SMTP Proxy server which implements whitelists
and Bayesian filtering to help stop unsolicited commercial email (UCE).
Anti-spam tools should be adaptive to new spam and customized for each
site's email patterns. This easy to use tool works with any mail transport
and achieves these goals requiring no operator intervention after the
initial setup phase.

4. PipeACL tools v1.0
By: Bindview <[email protected]>
Relevant URL:
http://razor.bindview.com/tools/desc/pipeacltools1.0-readme.html
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

The PipeACL tools package contains two separate tools for viewing and
configuring Win32 named pipe ACLs (Access Control Lists). The pipeacl
untility allows you to dump various settings of a named pipe, including
the Owner, Group, Sacls (System access control lists), and Dacls
(Discretionary access control lists). The pipeaclui untility allows you to
view and apply permissions to a specified named pipe. These changes are
made in the Dacls of the named pipe itself.

5. Libnids 1.18
By: Rafal Wojtczuk, [email protected]
Relevant URL: http://www.packetfactory.net/Projects/Libnids/
Platforms: FreeBSD, Linux, NetBSD, OpenBSD, Windows 2000, Windows NT
Summary:

Libnids is an implementation of an E-component of Network Intrusion
Detection Systems. It emulates the IP stack of Linux 2.0.x. Libnids offers
IP defragmentation, TCP stream reassembly, and TCP port scan detection.
The most valuable feature of libnids is reliability. A number of tests
were conducted which proved that libnids predicts behaviour of protected
Linux hosts as closely as possible. Libnids is highly configurable in
run-time and offers a convenient interface. Currently it compiles on Linux
glibc systems and *BSD. Using libnids, one has convenient access to data
carried by a TCP stream, no matter how artfully obscured by an attack.
Added support to capture packets on all interfaces, including loopback,
added ability to refrain from setting promisc flag, added ability to
disable tcp processing, libc5 support, alpha platform support, and bug
fixes.

6. Mod_security v 1.7
By: Ivan Ristic
Relevant URL: http://www.modsecurity.org
Platforms: FreeBSD, Linux, Solaris, Windows 2000, Windows NT, Windows XP
Summary:

ModSecurity is an open source intrusion detection and prevention engine
for web applications. It operates embedded into the web server, acting as
a powerful umbrella - shielding applications from attacks. ModSecurity
supports Apache (both branches) today, with support for Java-based servers
coming soon.


VI. SPONSOR INFORMATION
-----------------------
This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_ms-secnews_031103
and use priority code SF4.
------------------------------------------------------------------------