SecurityFocus Microsoft Newsletter #174

SecurityFocus Microsoft Newsletter #174
----------------------------------------
This issue sponsored by: Tenable Network Security

Doing network vulnerability scanning? Did you have to ask for permission?
Did you have to beg for forgiveness from the admins you caused panic and
disruption to?  Try NeVO, the worlds only 100% passive vulnerability
scanner, from Tenable Network Security!

http://www.securityfocus.com/sponsor/TenableSecurity_ms-secnews_040202

For your 30 day demo please contact: [email protected]
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. The Soft Underbelly: Attacking the Client
     2. Digital Signatures and European Laws
     3. Worms Hit Home
     4. We are pleased to announce a new search engine on SecurityFocus.
II. MICROSOFT VULNERABILITY SUMMARY
     1. Finjan SurfinGate FHTTP Restart Command Execution Vulnerabil...
     2. Novell Netware Enterprise Web Server Multiple Vulnerabilitie...
     3. RhinoSoft Serv-U FTP Server MDTM Command Stack Overflow Vuln...
     4. Microsoft Windows XP Explorer Self-Executing Folder Vulnerab...
     5. mIRC DCC Get Dialog Denial Of Service Vulnerability
     6. Cherokee Error Page Cross Site Scripting Vulnerability
     7. TCPDump ISAKMP Decoding Routines Denial Of Service Vulnerabi...
     8. Microsoft Internet Explorer CLSID File Extension Misrepresen...
     9. Internet Security Systems BlackICE PC Protection Upgrade Fil...
     10. Internet Security Systems BlackICE PC Protection blackd.exe ...
     11. BRS WebWeaver ISAPISkeleton.dll Cross-Site Scripting Vulnera...
     12. Loom Software SurfNow Remote HTTP GET Request Denial Of Serv...
     13. Macromedia ColdFusion MX Security Sandbox Circumvention Vuln...
     14. Kerio Personal Firewall Local Privilege Escalation Vulnerabi...
III. MICROSOFT FOCUS LIST SUMMARY
     1. Controlling Admin Access (Thread)
     2. SMTP Service in private DMZ OK? (Thread)
     3. terminal server (Thread)
     4. Encrypt data - SQL Server 2000 (Thread)
     5. SecurityFocus Microsoft Newsletter #173 (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
     1. Proactive Windows Security Explorer
     2. Outpost Personal Firewall Pro 2.0
     3. Dekart Logon
     4. AppSentry
     5. AppDefend
     6. Airscanner Mobile AntiVirus Pro
V. NEW TOOLS FOR MICROSOFT PLATFORMS
     1. MUTE File Sharing  v0.2.2
     2. Airscanner Mobile AntiVirus Pro  v1.4
     3. WinRelay v2.0
     4. GNU Generic Security Service Library   v0.0.10
     5. OSIRIS v3.0.0
     6. mrtg v2.10.13
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. The Soft Underbelly: Attacking the Client
By Tom Vogt

This article discusses the lack of security inside many corporate networks
once hackers have breached the border perimeter and firewall. Client-based
attack vectors, malicious payloads and their potential impact to an
organization are also discussed.

http://www.securityfocus.com/infocus/1758

2. Digital Signatures and European Laws
By Mirella Mazzeo

This article discusses the security requirements for electronic
communications and commerce with European governments and many European-
based businesses. It will also give an overview of the current trends for
public key infrastructure in Europe, useful for any organization that does
business with the EU.

http://www.securityfocus.com/infocus/1756

3. Worms Hit Home
By Kelly Martin

The fact that each of us can only control and manage the patches and virus
definitions on machines within our own borders means little as we watch
the promulgation of malcode on millions of home machines outside of our
control.

http://www.securityfocus.com/columnists/216

4. We are pleased to announce a new search engine on SecurityFocus,
offering faster and more intuitive results. Features include site wide or
section specific searching by author, headline or entire document and
sorting by date, headline or URL.


II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. Finjan SurfinGate FHTTP Restart Command Execution Vulnerabil...
BugTraq ID: 9478
Remote: Yes
Date Published: Jan 23 2004
Relevant URL: http://www.securityfocus.com/bid/9478
Summary:
SurfinGate is a commercially available content filtering and application
firewall package. It is distributed by Finjan, and available for the Sun
Solaris and Microsoft Windows platforms.

Finjan SurfinGate is prone to a vulnerability that may permit remote
attackers to execute certain management commands (using the FHTTP
protocol) through the management control port (3141/TCP).  The source of
the vulnerability is insufficient authorization of remotely supplied
restart commands.  While it may be possible to filter access by untrusted
IPs to the control port, these commands could also be issued via the HTTP
proxy included in the software, so will appear to originate from the
localhost in this instance and could theoretically bypass access controls
for untrusted external IPs.

It has been reported that commands could be issued to restart the server,
most likely resulting in a denial of service.

2. Novell Netware Enterprise Web Server Multiple Vulnerabilitie...
BugTraq ID: 9479
Remote: Yes
Date Published: Jan 23 2004
Relevant URL: http://www.securityfocus.com/bid/9479
Summary:
Multiple vulnerabilities have been identified in Novell Netware Enterprise
Web Server that may allow an attacker to carry out cross-site scripting
attacks, disclose sensitive information, and load potentially malicious
files on a vulnerable server.

It has been reported that the software may be prone to multiple cross-site
scripting vulnerabilities that may allow a remote attacker to launch
cross-site scripting attacks. Reportedly, the software contains various
variables that are prone to these attacks due to insufficient sanitization
of user-supplied data.  Various proof of concepts including vulnerable
variables have been provided in the report.  Successful exploitation of
these issues may allow an attacker to steal cookie based authentication
credentials and carry out other attacks.

An information disclosure issue has been identified in the software as
well. It has been reported that a remote attacker may be able to view
sensitive data such as internal IP addresses and other unspecified server
information.  This attack may be carried out by accessing certain files
such as snoop.jsp, SnoopServlet, env.bas, and lcgitest.nlm.  Successful
exploitation of this issue may allow an attacker to gain access to
sensitive data that could be used to launch further attacks against a
system.

Another issue may allow an attacker to access directory listings on a
vulnerable server.  It has been reported that this issue may be exploited
by accessing various pages on a vulnerable server.  Successful
exploitation of this issue may allow an attacker to gain access to
sensitive data that could be used to launch further attacks against a
system.  A path disclosure issue may also exist in the software that may
allow an attacker to gain sensitive information about the file system that
could aid in launching more direct attacks against the system.  This issue
may be exploited via a malicious URI request including '\/' characters.

Finally, it has been reported that an attacker may be able to load
Microsoft Hypertext Template (.htt) files to a server.  This issue may
allow an attack to upload potentially malicious files to the server that
may corrupt other files.

These issues are reported to affect Netware Enterprise Web Server 5.1 and
6.0. Other versions may be affected as well.

These issues are currently undergoing further analysis. This cumulative
BID will be separated into individual entries when analysis is complete.

3. RhinoSoft Serv-U FTP Server MDTM Command Stack Overflow Vuln...
BugTraq ID: 9483
Remote: Yes
Date Published: Jan 24 2004
Relevant URL: http://www.securityfocus.com/bid/9483
Summary:
RhinoSoft Serv-U FTP Server is designed for use with Microsoft Windows
operating systems.

Serv-U FTP Server is reportedly prone to a stack-based buffer overflow.

When a 'site chmod' command is issued specifying a non-existant file, the
FTP server will call the following sprintf command to display an error
message:
sprintf(dst, "%s: No such file or directory.", filename);

The problem exists due to insufficient bounds checking on the 'dst'
variable.  The buffer assigned to this variable is 256 bytes.  If the
non-existant filename specified is greater than 256 bytes, the buffer will
be overrun, resulting in a failure of the FTP server.  It has been
conjectured that this vulnerability may be exploited to execute arbitrary
code in the security context of the Serv-U FTP Server process.

It is important to note that this issue could only be exploited on a
writeable directory on the FTP server.

This vulnerability was reported to affect all versions of Serv-U FTP
Server prior to 4.2.

4. Microsoft Windows XP Explorer Self-Executing Folder Vulnerab...
BugTraq ID: 9487
Remote: Yes
Date Published: Jan 26 2004
Relevant URL: http://www.securityfocus.com/bid/9487
Summary:
A vulnerability has been reported in Microsoft Windows XP that may result
in execution of malicious code in the context of the currently logged in
user.  The flaw exists in Windows Explorer and may allow for executable
content that is referenced from inside of a folder to be executed
automatically when the folder is accessed.  It has been demonstrated that
an HTML folder that includes malicious scripting can call an arbitrary
executable, which could be self-contained in the folder.

It should be noted that the folder must exist on the vulnerable system,
though it is possible that remote attackers could entice users to open a
malicious folder via e-mail or by hosting it on a website.  For example, a
remote attacker could include the malicious folder in an archive, which a
user may then download and then open.  In this case, exploitation would
occur when the folder inside the archive is accessed by the victim user.

This vulnerability poses a security risk since it is assumed that opening
a folder is a safe action and that executable content cannot be run when a
folder is accessed.  A locally based attacker could use this issue to gain
elevated privileges on a system by placing the malicious folder in a
location that will expectedly be accessed by another user.  Remote
attackers who can entice a user to download and access the malicious
folder could exploit this issue to gain unauthorized remote access to a
vulnerable system in the context of the victim user.  Additionally, it has
been reported that this issue may be exploitable remotely if the malicious
folder is accessed from an SMB share.

5. mIRC DCC Get Dialog Denial Of Service Vulnerability
BugTraq ID: 9492
Remote: Yes
Date Published: Jan 26 2004
Relevant URL: http://www.securityfocus.com/bid/9492
Summary:
mIRC is a chat client for the IRC protocol, designed for Microsoft Windows
based operating systems.

A vulnerability has been reported to exist in mIRC that may allow a remote
attacker to crash a vulnerable mIRC client. The condition is most likely
present due to insufficient boundary checking performed on 'DCC GET'
requests.

It has been reported that the issue will present itself only in certain
circumstances. Specifically, the victim must have a minimized "DCC GET"
dialog; this dialog must then be opened to "GET" a file that is named with
a filename of excessive length. This will reportedly cause a violation in
the affected software resulting in a crash.

Although unconfirmed, due to the nature of this vulnerability it has been
conjectured that a remote attacker may potentially lever this issue to
have arbitrary code executed in the context of the affected mIRC client.

It should be noted that although mIRC version 6.12 has been reported to be
prone to this issue, other versions might be affected as well.

6. Cherokee Error Page Cross Site Scripting Vulnerability
BugTraq ID: 9496
Remote: Yes
Date Published: Jan 26 2004
Relevant URL: http://www.securityfocus.com/bid/9496
Summary:
Cherokee is a web server distributed under the GNU public license.  It is
available for numerous platforms, including Microsoft Windows and
Unix/Linux variants.

Cherokee has been reported to contain a cross-site scripting
vulnerability.  This issue is due to the server failing to check and
filter user-supplied strings issued to the server in a web request, which
are then included directly in error output.

An attacker can exploit this issue by crafting a URI link containing the
malevolent HTML or script code, and enticing a user to follow it.  If this
link were followed, the hostile code may be rendered in the web browser of
the victim user. This would occur in the security context of the affected
web server and may allow for theft of cookie-based authentication
credentials or other attacks.

7. TCPDump ISAKMP Decoding Routines Denial Of Service Vulnerabi...
BugTraq ID: 9507
Remote: Yes
Date Published: Jan 27 2004
Relevant URL: http://www.securityfocus.com/bid/9507
Summary:
tcpdump is a freely available, open source network monitoring tool. It is
available for the Unix, Linux, and Microsoft Windows operating systems.

A vulnerability has been identified in the software that may allow a
remote attacker to cause a denial of service condition in the software.
The issue occurs due to the way tcpdump decodes Internet Security
Association and Key Management Protocol (ISAKMP) packets.  A remote
attacker may cause the software to enter an infinite loop by sending
malformed ISAKMP packets resulting in a crash or hang.

Although unconfirmed, due to the nature of this issue, an attacker may
leverage the issue by exploiting an unbounded memory copy operation to
overwrite the saved return address/base pointer, causing an affected
procedure to return to an address of their choice. Successful exploitation
of this issue may allow an attacker to execute arbitrary code with the
privileges of the tcpdump process in order to gain unauthorized access.

tcpdump versions prior to 3.8.1 have been reported to be prone to this
issue.

8. Microsoft Internet Explorer CLSID File Extension Misrepresen...
BugTraq ID: 9510
Remote: Yes
Date Published: Jan 27 2004
Relevant URL: http://www.securityfocus.com/bid/9510
Summary:
A vulnerability has been reported in Microsoft Internet Explorer that may
allow files to be misrepresented to client users.

The following proof-of-concept example was released which specifies the
CLSID for HTML applications as a file extension and includes an additional
file name and extension after the CLSID:

malware.{3050f4d8-98B5-11CF-BB82-00AA00BDCE0B}fun_ball_gites_pie_throw%2Empeg

The browser appears to present the content to the user as the file name
and type specified after the CLSID, when the actual content type is
determined by the CLSID (which specifies an HTML application).  It is not
known at this time where the security flaw lies but it has been
demonstrated that such a filename may be used to misrepresent the file
type.  The dot to separate the additional file extension may need to be
URL-encoded (%2E) for exploitation to be successful, though this has not
been confirmed.

This issue could be exploited to disguise executable content in the form
of an HTML application (HTA) file as a file type that may appear innocuous
to a victim user.  The file will appear to be of an attacker-specified
type in the file download dialog presented to the user.  The user may then
download/open that file under the assumption it is safe, which could
result in execution of malicious code on the client system in the context
of the victim user.  It should also be noted that the file name may be
prepended by '...' in the download dialog, to abbreviate the malicious
file name and CLSID extension in the prefix.

This issue could be exploited via a malicious web page or possibly through
e-mail.

This issue was reported in Internet Explorer 6.0.  Earlier versions of the
browser may also be affected.

9. Internet Security Systems BlackICE PC Protection Upgrade Fil...
BugTraq ID: 9513
Remote: No
Date Published: Jan 28 2004
Relevant URL: http://www.securityfocus.com/bid/9513
Summary:
Internet Security Systems BlackICE PC Protection is a firewall/IDS
implementation for desktop systems running Microsoft Windows.

BlackICE PC Protection is reported to install various .ini files with
insecure permissions after an upgrade.  This may allow non-administrative
users to modify or replace these files, facilitating other attacks.  This
could affect various security properties as configuration information for
the software may be altered by an unauthorized user.  There is also a
buffer overrun that exists in the software when parsing various directives
included in .ini files, as described in BID 9514.  This additional issue
could be exploited once the permissions have been lowered.

The following files are reported to have lowered permissions after an
upgrade:
blackice.ini
firewall.ini
protect.ini
sigs.ini

It should be noted that exploitation of other latent vulnerabilities, such
as those described in BID 8577 could create a situation where a remote
attacker could place a hostile .ini on the local file system that is
designed to weaken the security provided by the software or exploit the
buffer overrun described in BID 9514.  It has also been reported that the
Application Protection feature, if enabled, will prevent various files
associated with the software from unauthorized modification.

This issue has been reported to occur when the software is upgraded to
version 3.6.cbz.  It is not known if other upgrades present the same
security risk.

10. Internet Security Systems BlackICE PC Protection blackd.exe ...
BugTraq ID: 9514
Remote: No
Date Published: Jan 28 2004
Relevant URL: http://www.securityfocus.com/bid/9514
Summary:
Internet Security Systems BlackICE PC Protection is a firewall/IDS
implementation for desktop systems running Microsoft Windows.

It is reported that BlackICE PC Protection is prone to a locally
exploitable buffer overrun when handling excessive input in certain
configuration directives for various .ini files included with the
software.  While these files are allegedly not writeable by
non-administrative users in the default install, it has been reported that
they may be globally writeable by all system users after a software
upgrade (as described in BID 9513).

The issue is reportedly exposed when a 'packetLog.fileprefix=' directive
of 217+ bytes in length is included in the blackice.ini file.  This will
allow the attacker to influence the contents of various system registers
such as EIP and ECX, effectively permitting the attacker to control
execution flow of the blackd.exe process.

Given the ability of a local attacker to modify the contents of these
files, it will be possible to execute arbitrary with SYSTEM privileges
since  the blackd.exe process runs in SYSTEM context.

This issue could also be exploited remotely if an attacker can exploit
other vulnerabilities to cause a malicious version of a .ini file to be
placed on the local system.  This might occur through exploitation of
latent vulnerabilities in Internet Explorer, such as those described in
BID 8577.

11. BRS WebWeaver ISAPISkeleton.dll Cross-Site Scripting Vulnera...
BugTraq ID: 9516
Remote: Yes
Date Published: Jan 28 2004
Relevant URL: http://www.securityfocus.com/bid/9516
Summary:
BRS WebWeaver is an HTTP/FTP server implementation for Microsoft Windows
platforms.

BRS WebWeaver has been reported prone to a cross-site scripting
vulnerability.  The issue is known to exist in the ISAPISkeleton.dll
script.  Arguments supplied to this script in web requests will be output
in dynamically generated web pages without adequate sanitization of HTML
and script code.  As a result, an attacker may create a malicious link to
the vulnerable server that includes embedded HTML and script code.  If
this link is followed by a victim user, hostile code embedded in the link
may be rendered in the user's browser in the context of the server.

Successful exploitation could permit theft of cookie-based authentication
credentials.  The attacker could also theoretically influence how server
pages will be rendered to the victim user, allowing for other attacks.

This issue could affect various web applications hosted on the server,
since these web applications could be in the same domain as the server and
therefore hostile script code may be able to access properties of these
applications.

This issue was reported in BRS WebWeaver 1.07.  Earlier versions may also
be affected.

12. Loom Software SurfNow Remote HTTP GET Request Denial Of Serv...
BugTraq ID: 9519
Remote: Yes
Date Published: Jan 28 2004
Relevant URL: http://www.securityfocus.com/bid/9519
Summary:
SurfNOW is a commercially-available proxy software package designed to
obscure identity and protect privacy on the Internet.  It is available for
the Microsoft Windows platform.

A problem has been identified in the handling of specific types of
requests by SurfNOW.  Upon receiving specially crafted requests, it is
possible for a remote attacker to crash a vulnerable implementation,
denying service to the user.

The problem is in the handling of excessive data in HTTP header fields.
An attacker with access to the proxy server can potentially submit a
request of excessive length, causing the server to become unstable.  It
has been reported that this can reliably produce a crash in the proxy
server after multiple such requests are submitted.  The attacker must
reportedly send HTTP GET requests that are 490k in length to reproduce
this issue.

This issue may be indicative of a boundary condition error.  This
information, however, is conjecture based on reports by the researcher.
If this information does prove to be true, it may likely be possible to
exploit this condition to execute code with the privileges of the proxy
server process.

13. Macromedia ColdFusion MX Security Sandbox Circumvention Vuln...
BugTraq ID: 9521
Remote: No
Date Published: Jan 28 2004
Relevant URL: http://www.securityfocus.com/bid/9521
Summary:
ColdFusion MX is the application server for developing and hosting
infrastructure distributed by Macromedia. It is available as a standalone
product for Unix, Linux, and Microsoft Operating Systems.

ColdFusion MX has been reported prone to a security sandbox circumvention
vulnerability. The issue is reported to exist because programmers have the
ability to create instances of classes without using "CreateObject()" or
"<cfobject>" tags. It has been reported that the security sandbox does not
prevent this behavior.

This issue cannot be exploited remotely, but the vulnerability may present
a danger in a shared hosted environment.

An attacker may exploit this issue to circumvent the security sandbox of
ColdFusion MX.

This issue has been reported to affect ColdFusion MX 6.1.

14. Kerio Personal Firewall Local Privilege Escalation Vulnerabi...
BugTraq ID: 9525
Remote: No
Date Published: Jan 29 2004
Relevant URL: http://www.securityfocus.com/bid/9525
Summary:
Kerio Personal Firewall (KPF) is a desktop firewall solution that performs
stateful packet inspection. It is available for the Microsoft Windows
platform.

A vulnerability has been reported to be present in the software that may
allow a local attacker to gain elevated privileges.  The problem occurs
due to a function used to load configuration files.  It has been reported
that this function can be exploited to execute malicious applications with
SYSTEM privileges.

Successful exploitation of this issue may allow an attacker to execute
malicious applications with SYSTEM privileges on a vulnerable system that
may lead to full compromise.

Kerio Personal Firewall 2.1.5 has been reported to be prone to this issue,
however, other versions could be affected as well.


III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Controlling Admin Access (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/352161

2. SMTP Service in private DMZ OK? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/352158

3. terminal server (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/352041

4. Encrypt data - SQL Server 2000 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/351981

5. SecurityFocus Microsoft Newsletter #173 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/351305


IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. Proactive Windows Security Explorer
By: Elcomsoft Co. Ltd.
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.elcomsoft.com/pwsex.html#
Summary:

Proactive Windows Security Explorer (PWSEX) is a password security test
tool that's designed to allow Windows NT, Windows 2000, and Windows
XP-based systems administrators to identify and close security holes in
their networks. Proactive Windows Security Explorer helps secure networks
by executing an audit of account passwords, and exposing insecure account
passwords. If it is possible to recover the password within a reasonable
time, the password is considered insecure.

An administrator can also use it to recover any lost password and access a
user's Windows account. Proactive Windows Security Explorer works by
analyzing user password hashes and recovering plain-text passwords.

2. Outpost Personal Firewall Pro 2.0
By: Agnitum
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.outpost.uk.com
Summary:

New Outpost Personal Firewall Pro 2.0 outdistances the award-winning
Outpost Personal Firewall Pro 1.0 on multiple levels, from enhanced
privacy features to ease-of-use. As the foremost security application for
personal computers, Outpost Personal Firewall Pro 2.0 gives you the latest
in personal firewall technology, making version 2.0 the clear security
choice for your system.

3. Dekart Logon
By:
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.dekart.com/products/authentication_access/logon/
Summary:

Dekart Logon is a solution designed to provide an additional level of
security for the Microsoft Windows operating system. Access to the Windows
environment can only be gained after inserting a USB key or smart card
into the appropriate slot and by entering the correct PIN code.

Dekart Logon offers a number of security options: you can select to have
Windows access blocked once the key is removed, during a screen saver
timeout or other user assigned prompts. This flexibility automatically
reduces the possibility of human error by maintaining predefined security
levels even if the user leaves their PC unattended.

4. AppSentry
By: Integrigy
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.integrigy.com/appsentry.htm
Summary:

AppSentry is a new generation of security scanner and vulnerability
assessment tool. Unlike other security scanners, AppSentry knows the
application it is validating ? its technology and data model. The security
audits and checks are written specifically for the application being
tested. Hackers and mischievous employees often exploit security issues at
different layers of the technology stack, thus only a complete and
comprehensive security validation will uncover all risks in a multi-tiered
environment.

The advantage of AppSentry is now you don't have to seperate tools for the
operating system, web server, and database. AppSentry is a single tool
that can validate and audit the security of the entire application
technology stack from operating system to application layer.

AppSentry is available for the following applications -

Oracle E-Business Suite (11i)
Oracle Database (8.x, 8i, 9i, 10g)
Oracle Application Server (9iAS, 10g)
SAP
PeopleSoft
Microsoft SQL Server

5. AppDefend
By: Integrigy
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.integrigy.com/appdefend.htm
Summary:

AppDefend is a new concept in Intrusion Prevention - direct application
protection. AppDefend protects the application from attacks and intrusions
by blocking attacks before they reach the application.

AppDefend is designed specifically for the application it is protecting.
Thus, when implementing for the Oracle E-Business Suite, there is no
analysis or other configuration required to provide maximum protection for
the application. Integrigy has already performed all this work for you --
all modules, all versions.

AppDefend is designed to be simple to install and easy to maintain. A
straight-forward, yet robust, implementation takes only 15 minutes. No
complex configuration or analysis of the application is required.

6. Airscanner Mobile AntiVirus Pro
By: Airscanner Corp.
Platforms: Windows CE
Relevant URL: http://airscanner.com/downloads/av/av.html
Summary:

Airscanner Mobile AntiVirus Pro will quarantine or eradicate embedded
viruses and malware, has fast, optimized scanning speed based on patent
pending technology, has automatic, online updates of virus signatures and
scanning engine as well as support for PocketPC 2003/Windows Mobile 2003
and easy online updates.

In addition to an accurate virus scanner, Airscanner Mobile AntiVirus
includes these  powerful tools for debugging Trojan horses:
 - Intercept memory resident viruses with an advanced process discovery
tool.
 - Debug Trojan hacks with an easy-to-use registry viewer.
 - Uncover denial of service attacks with a rapid system analyzer.
 - Enter your own custom virus signatures (for experts).
 - Perform fast, recursive, and flexibly multithreaded filesystem
scanning.


V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. MUTE File Sharing  v0.2.2
By: Jason Rohrer
Relevant URL: http://mute-net.sourceforge.net/
Platforms: Linux, MacOS, Os Independent, Windows 2000, Windows 95/98
Summary:

MUTE File Sharing is an anonymous, decentralized search-and-download file
sharing system. Several people have described MUTE as the "third
generation file sharing network" (From Napster to Gnutella to MUTE, with
each generation getting less centralized and more anonymous). MUTE uses
algorithms inspired by ant behavior to route all messages, include file
transfers, through a mesh network of neighbor connections.

2. Airscanner Mobile AntiVirus Pro  v1.4
By: Airscanner Corp
Relevant URL: http://airscanner.com/downloads/av/av.html
Platforms: Windows CE
Summary:

Airscanner Corporation is the most trusted name in helping to defend your
mobile device from "airborne" computer viruses. From the company that
wrote the best-selling technical book Maximum Wireless Security comes a
professional strength virus scanner for the Pocket PC.

With the increased wireless connectivity of PDAs and Smartphones comes an
increased threat from virus attacks. Save money, time, and data by
protecting your valuable Pocket PC now with Airscanner Mobile AntiVirus
Pro.

3. WinRelay v2.0
By: Arne Vidstrom <[email protected]>
Relevant URL: http://www.ntsecurity.nu/toolbox/winrelay/
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

WinRelay is a TCP/UDP forwarder/redirector. You can choose the port and IP
it will listen on, the source port and IP that it will connect from, and
the port and IP that it will connect to.

4. GNU Generic Security Service Library   v0.0.10
By: Simon Josefsson
Relevant URL: http://www.gnu.org/software/gss/
Platforms: UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

Generic Security Service (GSS) is an implementation of the Generic
Security Service API (GSSAPI). It is used by network applications to
provide security services, such as authenticating SMTP/IMAP, via the
GSSAPI SASL mechanism. It consists of a library and a manual, and a
Kerberos 5 mechanism that supports mutual authentication and the DES and
3DES ciphers.

5. OSIRIS v3.0.0
By: The Shmoo Group
Relevant URL: http://osiris.shmoo.com
Platforms: BSDI, FreeBSD, Linux, MacOS, OpenBSD, UNIX, Windows 2000,
Windows NT, Windows XP
Summary:

Osiris is a host integrity management system that can be used to monitor
changes to a network of hosts over time and report those changes back to
the administrator(s). Currently, this includes monitoring any changes to
the filesystems. Osiris takes periodic snapshots of the filesystem and
stores them in a database. These databases, as well as the
configurations and logs, are all stored on a central management host.
When changes are detected, Osiris will log these events to the system
log and optionally send email to an administrator. In addition to files,
Osiris has preliminary support for the monitoring of other system
information including user lists, file system details, kernel modules,
and network interface configurations (not included with in this beta
release).

6. mrtg v2.10.13
By: Tobias Oetiker
Relevant URL: http://people.ee.ethz.ch/~oetiker/webtools/mrtg/
Platforms: POSIX, Windows 2000, Windows NT
Summary:

The Multi Router Traffic Grapher (MRTG) is a tool to monitor the traffic
load on network-links. MRTG generates HTML pages containing GIF/PNG images
which provide a live visual representation of this traffic.


VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
[email protected] from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer.
Alternatively you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.

If your email address has changed email [email protected] and
ask to be manually removed.


VII. SPONSOR INFORMATION
-----------------------
This issue sponsored by: Tenable Network Security

Doing network vulnerability scanning? Did you have to ask for permission?
Did you have to beg for forgiveness from the admins you caused panic and
disruption to?  Try NeVO, the worlds only 100% passive vulnerability
scanner, from Tenable Network Security!

http://www.securityfocus.com/sponsor/TenableSecurity_ms-secnews_040202

For your 30 day demo please contact: [email protected]
------------------------------------------------------------------------