Network Security
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
FW: SecurityFocus Newsletter #241
- From: Howell, Paul
- Date: Tue Mar 23 07:34:27 2004
-----Original Message-----
From: sf-news-euro-return-1-grue=merit.edu@securityfocus.com
[mailto:sf-news-euro-return-1-grue=merit.edu@securityfocus.com] On Behalf Of
Conrad Schilbe
Sent: Monday, March 22, 2004 6:42 PM
To: sf-news-euro@securityfocus.com
Subject: SecurityFocus Newsletter #241
------------------------------
This Issue is Sponsored by: Verisign
Secure your servers with 128-bit SSL encryption! Grab your
copy of VeriSign's FREE Guide, "Securing Your Web site for Business," and
you'll learn everything you need to know about using 128-bit SSL to encrypt
your e-commerce transactions,
secure your corporate intranets and authenticate your Web sites. 128-bit SSL
is serious security for your online business.
Get it now!
http://www.securityfocus.com/sponsor/Verisign_sf-news_040315
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Forensic Analysis of a Live Linux System, Pt. 1
2. Detection of SQL Injection and Cross-site Scripting Attacks
3. The 12KB Bomb
II. BUGTRAQ SUMMARY
1. Metamail Extcompose Program Symlink Vulnerability
2. XInterceptTalk XITalk Privilege Escalation Vulnerability
3. Sun Solaris Patch Unexpected Security Weakness
4. cPanel dir Parameter Cross-Site Scripting Vulnerability
5. Dogpatch Software CFWebstore SQL Injection Vulnerability
6. cPanel Login Script Remote Command Execution Vulnerability
7. Dogpatch Software CFWebstore Cross-Site Scripting Vulnerabil...
8. UUDeview Insecure Temporary File Creation Vulnerability
9. IP3 Networks IP3 NetAccess Appliance SQL Injection Vulnerabi...
10. HP HTTP Server Trusted Certificate Compromise Vulnerability
11. Chaogic Systems VHost Unspecified Cross-Site Scripting Vulne...
12. Emumail EMU Webmail Multiple Vulnerabilities
13. Macromedia Studio MX 2004 /Contribute 2 Local Privilege Esca...
14. Computer Associates Unicenter TNG Utilities Multiple Remote ...
15. Novell GroupWise WebAccess Unauthorized Access Vulnerability
16. PHPBB ViewTopic.PHP "postdays" Cross-Site Scripting Vulnerab...
17. PHPBB ViewForum.PHP "topicdays" Cross-Site Scripting Vulnera...
18. OpenBSD httpd Access Rule Bypass Vulnerability
19. Oracle Application Server Web Cache Multiple Unspecified Vul...
20. Opera Web Browser Large JavaScript Array Handling Vulnerabil...
21. Check Point Firewall-1 SmartDashboard Filter Buffer Overflow...
22. MathoPD Remote Buffer Overflow Vulnerability
23. WS_FTP Pro Client Remote Buffer Overflow Vulnerability
24. YABB/YABB SE Multiple Cross-Site Scripting Vulnerabilites
25. Apache HTAccess LIMIT Directive Bypass Configuration Error W...
26. GNU SPIP Unspecified PHP Code Execution Vulnerability
27. VocalTec VGW4/8 Telephony Gateway Remote Authentication Bypa...
28. Multiple Vendor SOAP Server Undisclosed Request Denial Of Se...
29. PHP-Nuke Modules.php Multiple Cross-Site Scripting Vulnerabi...
30. Sybari AntiGen For Lotus Domino Denial Of Service Vulnerabil...
31. WarpSpeed 4nAlbum Module For PHPNuke Multiple Vulnerabilitie...
32. Phorum Multiple Module Cross-Site Scripting Vulnerability
33. PHPBB Search.PHP Search_Results Parameter SQL Injection Vuln...
34. SteelID thePhotoTool Login.ASP SQL Injection Vulnerability
35. Apache Mod_Security Module SecFilterScanPost Off-By-One Buff...
36. WS_FTP Pro Client Remote Stack Buffer Overflow Vulnerability
37. JelSoft VBulletin MemberList.PHP Cross-Site Scripting Vulner...
38. JelSoft VBulletin ForumDisplay.PHP Cross-Site Scripting Vuln...
39. JelSoft VBulletin ShowThread.PHP Cross-Site Scripting Vulner...
40. Mambo Open Source Index.PHP Cross-Site Scripting Vulnerabili...
41. Mambo Open Source Index.PHP SQL Injection Vulnerability
42. Microsoft Windows XP explorer.exe Remote Denial of Service V...
43. Lim Unlimited Crafty Command Line Local Buffer Overflow Vuln...
44. Fizmez Web Server Null Connection Denial Of Service Vulnerab...
45. PHP-Nuke Image Tag Admin Command Execution Vulnerability
46. PhpBB admin_words.php Multiple Vulnerabilities
47. ClamAV RAR Archive Remote Denial Of Service Vulnerability
48. Techland Chrome Denial of Service Vulnerability
49. OpenSSL Denial of Service Vulnerabilities
50. IBM Lotus Domino HTTP webadmin.nsf Directory Traversal Vulne...
51. IBM Lotus Domino HTTP webadmin.nsf Quick Console Cross-Site...
52. AIX Make CC Path Local Buffer Overflow Vulnerability
53. GlobalSCAPE Secure FTP Server SITE Command Remote Buffer Ove...
54. AIX Getlvcb Command Line Argument Buffer Overflow Vulnerabil...
55. AIX Putlvcb Command Line Argument Buffer Overflow Vulnerabil...
56. OpenBSD isakmpd Multiple Unspecified Remote Denial Of Servic...
57. WFTPD Server GUI Remote Denial Of Service Vulnerability
58. DameWare Mini Remote Control Server Weak Encryption Implemen...
59. Belchior Foundry VCard Authentication Bypass Vulnerability
60. PHP-Nuke Error Manager Module Multiple Vulnerabilities
61. Symantec Norton Internet Security/Personal Firewall Remote D...
62. Internet Security Systems Protocol Analysis Module ICQ Parsi...
III. SECURITYFOCUS NEWS ARTICLES
1. Report: Phishing attacks on the rise
2. Anti-piracy vigilantes track file sharers
3. Hosting company reveals hacks, citing disclosure law
4. UK.biz leaves door open to hackers
5. The farce of federal cybersecurity
6. 'Witty' Worm Wrecks Computers
IV. SECURITYFOCUS TOP 6 TOOLS
1. Qingy Is Not Getty v0.4.0
2. Network Packet Capture Facility for Java v0.01.15
3. moftpd v1.1.6
4. filewatcher v2.3.9
5. CryptoHeaven v2.3.2
6. NetMRG v0.14
V. SECURITYJOBS LIST SUMMARY
1. Security and audit professional available for volunt... (Thread)
2. SecurityGuys, a securityjobs-like list for Brazil (Thread)
3. CSO NEEDED!!!!! (Thread)
4. Senior System Engineer (East Coast, West Coast) posi... (Thread)
5. CISO cover letter help needed (Thread)
6. Security Consultant - UK - SE/Central England (Thread)
7. PenTester/Security Researcher Position (Thread)
8. Full time Senior Security Consultant position in Pit... (Thread)
9. Security Practice Lead - #867JA - Northeast - $120k ... (Thread)
10. 2 Unix/security positions in Washington DC -Full tim... (Thread)
11. Security Software Training. (Thread)
12. Group Product Manager (Thread)
13. Information Security Officer (Thread)
14. Information "Systems Security Engineer" position at ... (Thread)
15. FW: Software Engineer User Interface San Diego CA (Thread)
16. Security Sales Folks Needed (Thread)
17. IDS/IPS Architecture Consultants - NY, NJ, Bay Area (Thread)
18. <Job> Application Security Engineer Two Contract Pos... (Thread)
19. Senior Test and Evaluation Engineer (Thread)
20. Product Manager-San Francisco (Thread)
21. Sales and SE's (Thread)
22. Job Opportunity Sr. Developer, Security Systems (Thread)
23. Senior Security Programmer II (Full time position i... (Thread)
24. Senior Security Engineer - New Jersey ($70k-90k) Imm... (Thread)
25. Director Public Relations Security (Thread)
26. Job Opportunity- Sales Engineer in the New York Area (Thread)
27. Information Security position in the Washington, DC ... (Thread)
28. Security Scanner Test Engineer Silicon Valley CA (Thread)
29. Account Manager, Nordics (Thread)
30. Account Manager, Brussels (Thread)
31. Penetration Tester (Thread)
32. ETHICAL HACKER (Thread)
33. Software Engineers - RADIUS - Infoblox, Silicon Vall... (Thread)
34. Network Security Architect - NY (Thread)
35. Senior Security Programmer (Full time position in At... (Thread)
36. Director of Development (Thread)
37. Rainmaker in Chicago (Thread)
38. SAGEM Smart Card Specialist United Arab Emirates (Thread)
39. Senior Security Programmer position in Atlanta GA (Thread)
40. IAM, CISSP looking in the DC metro area (Thread)
41. Senior Security Analyst Needed (Thread)
42. Network Security specialist team lead - Toronto (Thread)
43. Information Security Specialist II (Full time positi... (Thread)
44. Senior Network Security Specialist needed (Thread)
VI. INCIDENTS LIST SUMMARY
1. very weird traffic (Thread)
2. New virus? (Thread)
3. Release of Rootkit Hunter 1.0.0 (Thread)
4. Incident Response Database (Thread)
5. Phatbox: Media Hype? Scare Tactics? (Thread)
6. Administrivia: SPAM control accounts... (Thread)
7. New article annnouncement (2) (Thread)
8. SDSU compromise (Thread)
9. Dead Thread: New phishing scheme... (Thread)
10. New phishing style? Give them real links except for... (Thread)
11. Computer Security Mexico 2004 (Thread)
12. Port 2979 Activity (Thread)
VII. VULN-DEV RESEARCH LIST SUMMARY
1. Computer Security Mexico 2004 (Thread)
2. Linux exploits and random post-argv/ envp injection (Thread)
3. New security alert #66 issued in Oracle web cache (Thread)
4. buffer overflows and stack alignment (Thread)
VIII. MICROSOFT FOCUS LIST SUMMARY
1. Hardening TCP/IP Stack; conflicting sources (Thread)
2. security tools (Thread)
3. Article Announcement: Detection of SQL Injection and... (Thread)
4. SecurityFocus Microsoft Newsletter #180 (Thread)
5. Article Announcement: Where to Turn? (Thread)
IX. SUN FOCUS LIST SUMMARY
1. sunscreen and stealth interfaces (Thread)
2. PAM & Auth (Thread)
X. LINUX FOCUS LIST SUMMARY
1. ModSSL - Knoppix 3.3 (Thread)
XI. UNSUBSCRIBE INSTRUCTIONS
XII. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Forensic Analysis of a Live Linux System, Pt. 1
By Mariusz Burdach
This article is the first of a two-part series that provides step-by-step
instructions on forensics of a live Linux system that has been recently
compromised.
http://www.securityfocus.com/infocus/1769
2. Detection of SQL Injection and Cross-site Scripting
Attacks By K. K. Mookhey and Nilesh Burghate
This article discusses techniques to detect SQL Injection and Cross Site
Scripting (CSS) attacks against your networks using regular expressions with
the open-source IDS, Snort.
http://www.securityfocus.com/infocus/1768
3. The 12KB Bomb
By Kelly Martin
It only takes a 12KB virus for total system compromise and a highly
effective spam engine. Anyone can make one. Some assembly required.
http://www.securityfocus.com/columnists/228
II. BUGTRAQ SUMMARY
-------------------
1. Metamail Extcompose Program Symlink Vulnerability
BugTraq ID: 9850
Remote: No
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9850
Summary:
It has been reported that Metamail extcompose program may be prone to a
symbolic link vulnerability that may allow an attacker to corrupt or
overwrite sensitive files. It has been reported that 'extcompose' writes
output to a file specified by the user via the command line. The issue has
been reported to present itself because the program creates files without
verifying the existence of the specified files. A local user may leverage
this condition to corrupt arbitrary files triggering a system wide denial of
service or potentially elevating their system privileges.
Although unconfirmed, it has been reported that the 'extcompose.sigh' is
also vulnerable to this issue.
Metamail 2.7 and prior may be prone to these issues.
2. XInterceptTalk XITalk Privilege Escalation Vulnerability BugTraq ID: 9851
Remote: No
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9851
Summary:
Reportedly xitalk is prone to a local privilege escalation vulnerability.
This issue is due to a design error causing a failure in the handling of
privileges by the application.
The problem may allow a malicious user to execute arbitrary commands using
the privileges of the 'utmp' user.
3. Sun Solaris Patch Unexpected Security Weakness
BugTraq ID: 9852
Remote: No
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9852
Summary:
Sun has announced that some patches released for Solaris may in fact present
a new security weakness. The problem is said to cause the auditing
functionality of the Basic Security Module (BSM) to be disabled. The issue
presents itself on Solaris 9 systems with Basic Security Module
(BSM) enabled and either patch 114332-08 for SPARC or 114929-06 for x86
installed.
Sun has reported that patch 114332-08 for SPARC can be replaced with patch
114332-10 and another patch will be released to address this issue in x86.
4. cPanel dir Parameter Cross-Site Scripting Vulnerability BugTraq ID: 9853
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9853
Summary:
It has been reported that cPanel may be prone to a cross-site scripting
vulnerability that may allow a remote attacker to execute HTML or script
code in a user's browser. The issue presents itself due to insufficient
sanitization of user-supplied data via the 'dir' parameter of
'dohtaccess.html' page. The victim may require to be authenticated with
valid credentials to be exposed to exploitation.
Due to the possibility of attacker-specified HTML and script code being
rendered in a victim's browser, it is possible to steal cookie-based
authentication credentials from that user. Other attacks are possible as
well.
5. Dogpatch Software CFWebstore SQL Injection Vulnerability BugTraq ID: 9854
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9854
Summary:
It has been reported that CFWebstore is prone to a remote SQL injection
vulnerability. This issue is due to a failure of the application to
properly sanitize user input before including it in an SQL statement.
As a result of this a malicious user may influence database queries in order
to view or modify sensitive information, potentially compromising the
software or the database. It has been reported that an attacker may be able
to disclose the administrator password hash by exploiting this issue.
6. cPanel Login Script Remote Command Execution Vulnerability BugTraq ID:
9855
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9855
Summary:
A potential remote command execution vulnerability has been discovered in
the cPanel application. This issue occurs due to insufficient sanitization
of externally supplied data to the login script. An attacker may exploit
this problem by crafting a malicious URI request for the affected script;
the attacker may then supply shell metacharacters and arbitrary commands as
a value for the affected variable.
7. Dogpatch Software CFWebstore Cross-Site Scripting Vulnerabil... BugTraq
ID: 9856
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9856
Summary:
It has been reported that CFWebstore is prone to a remote cross-site
scripting vulnerability. This issue is due to a failure of the application
to properly sanitize user input.
Attackers may exploit this vulnerability to steal authentication
credentials. Other attacks may also be possible.
8. UUDeview Insecure Temporary File Creation Vulnerability BugTraq ID: 9857
Remote: No
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9857
Summary:
UUDeview is prone to an issue that may allow malicious local users to
corrupt system files, most likely resulting in loss of data or a denial of
service.
The source of this vulnerability is that the utility creates temporary files
in an insecure manner. This type of vulnerability may potentially allow for
elevation of privileges in situations where an attacker could influence what
is written or appended during this operation. The possibility of privilege
escalation has not been confirmed in this instance.
9. IP3 Networks IP3 NetAccess Appliance SQL Injection Vulnerabi... BugTraq
ID: 9858
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9858
Summary:
It has been reported that the IP3 NetAccess Appliance is prone to a remote
SQL injection vulnerability. This issue is due to a failure of the
appliance to properly sanitize user input.
This issue may allow an attacker to gain full control of the appliance
through the network administration interface. It may also be possible for a
malicious user to influence database queries in order to view or modify
sensitive information potentially compromising the system or the database.
10. HP HTTP Server Trusted Certificate Compromise Vulnerability BugTraq ID:
9859
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9859
Summary:
The HP HTTP Server included with HP Web-Enabled Management Software (Compaq
Web Management) allows users to upload client-side certificates that will
authenticate them against the service. This vulnerability only exists if
the Anonymous Access option is enabled. This option is not enabled by
default.
This vulnerability is reported to exist on HP HTTP Server versions 5.0
through 5.92.
11. Chaogic Systems VHost Unspecified Cross-Site Scripting Vulne... BugTraq
ID: 9860
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9860
Summary:
It has been reported that the vHost web based interface is prone to a remote
cross-site scripting vulnerability. This issue is due to a failure of the
application to properly sanitize user input.
The technical details of this issue cannot be currently described due to
insufficient details, however this BID will be updated as new information
becomes available.
Attackers may exploit this vulnerability to steal authentication
credentials. Other attacks may also be possible.
12. Emumail EMU Webmail Multiple Vulnerabilities
BugTraq ID: 9861
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9861
Summary:
Multiple vulnerabilities have been identified in the application that may
allow an attacker to carry out cross-site scripting attacks and disclose the
path to the victim's home directory. The issues are reported to exist in
the login script, 'emumail.fcgi' script and the 'init.emu' sample script.
EMU Webmail 5.2.7 has been reported to be affected by these issues.
13. Macromedia Studio MX 2004 /Contribute 2 Local Privilege Esca... BugTraq
ID: 9862
Remote: No
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9862
Summary:
It has been reported that Macromedia Studio MX 2004 and Contribute 2 are
prone to a local privilege escalation vulnerability. These issues are due
to a single design error that causes the creation of a setuid binary that is
globally writable.
Successful exploitation of this issue may allow an attacker to escalate
their privileges.
This issue has been reported to affect only the version of the software
designed for Apple Macintosh OS X.
14. Computer Associates Unicenter TNG Utilities Multiple Remote ... BugTraq
ID: 9863
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9863
Summary:
Several Computer Associates Unicenter TNG utilities have been reported to be
prone to multiple remote buffer overflow vulnerabilities. These
vulnerabilities likely exist due to a lack of sufficient boundary checks
performed on user-supplied data.
It has been reported that these issues are exploitable remotely without
prior authentication to potentially have arbitrary code executed with SYSTEM
privileges on a vulnerable host.
15. Novell GroupWise WebAccess Unauthorized Access Vulnerability BugTraq ID:
9864
Remote: Yes
Date Published: Mar 13 2004
Relevant URL: http://www.securityfocus.com/bid/9864
Summary:
An issue has been reported in Novell GroupWise WebAccess that could allow
unauthorized remote access to the WebAccess server. This is due to a
configuration issue in the GWAPACHE.CONF file.
16. PHPBB ViewTopic.PHP "postdays" Cross-Site Scripting Vulnerab... BugTraq
ID: 9865
Remote: Yes
Date Published: Mar 13 2004
Relevant URL: http://www.securityfocus.com/bid/9865
Summary:
It has been reported that one of the scripts included with phpBB is prone to
a cross-site scripting vulnerability. According to the author of the
report, the script "viewtopic.php" returns the value of the HTML variable
"postdays" to the client as its output without encoding it or otherwise
removing potentially hostile content. This can be exploited by constructing
malicious links with the malicious "postdays" variable value embedded as a
GET request style HTML variable. If the target user visits such a link, the
malicious, externally created content supplied in the link will be rendered
(or executed, in the case of script code) as part of the viewtopic.php
document and within the context of the vulnerable website (including the
phpBB forum).
17. PHPBB ViewForum.PHP "topicdays" Cross-Site Scripting Vulnera... BugTraq
ID: 9866
Remote: Yes
Date Published: Mar 13 2004
Relevant URL: http://www.securityfocus.com/bid/9866
Summary:
It has been reported that one of the scripts included with phpBB is prone to
a cross-site scripting vulnerability. According to the author of the
report, the script "viewforum.php" returns the value of the HTML variable
"topicdays" to the client as its output without encoding it or otherwise
removing potentially hostile content. This can be exploited by constructing
malicious links with the malicious "topicdays" variable value embedded as a
GET request style HTML variable. If the target user visits such a link, the
malicious, externally created content supplied in the link will be rendered
(or executed, in the case of script code) as part of the viewtopic.php
document and within the context of the vulnerable website (including the
phpBB forum).
18. OpenBSD httpd Access Rule Bypass Vulnerability
BugTraq ID: 9867
Remote: Yes
Date Published: Mar 14 2004
Relevant URL: http://www.securityfocus.com/bid/9867
Summary:
OpenBSD httpd access module is reported to allow unauthorized access. This
is due to an error in the parsing of Allow/Deny rules with IP addresses
without a netmask.
19. Oracle Application Server Web Cache Multiple Unspecified Vul... BugTraq
ID: 9868
Remote: Yes
Date Published: Mar 12 2004
Relevant URL: http://www.securityfocus.com/bid/9868
Summary:
Oracle has reported multiple unspecified vulnerabilities in various
Application Server Web Cache releases. These issues are remotely
exploitable.
20. Opera Web Browser Large JavaScript Array Handling Vulnerabil... BugTraq
ID: 9869
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9869
Summary:
Opera Web Browser is prone to an issue when handling large JavaScript
arrays.
In particular, it is possible to crash the browser when performing various
operations on Array objects with 99999999999999999999999 or 0x23000000
elements.
The crash is due to a segmentation fault and may be indicative of an
exploitable memory corruption vulnerability, possibly resulting in arbitrary
code execution, though this has not been confirmed.
21. Check Point Firewall-1 SmartDashboard Filter Buffer Overflow... BugTraq
ID: 9870
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9870
Summary:
It has been reported that Check Point Firewall-1 SmartDashboard may be prone
to a buffer overflow vulnerability that may allow an attacker to execute
arbitrary code on a vulnerable system in order to gain unauthorized access.
The issue is reported to present itself when the SmartTracker utility is
used to add a firewall filter for Firewall-1. An attacker may be able to
cause a buffer overflow condition by supplying an excessive amount of data
via the filter line.
It is likely that access to SmartDashboard requires administrator
credentials, in which case this issue would not be considered a
vulnerability. This has not been confirmed at the moment. Due to a lack of
information further details cannot be outlined at the moment. This BID will
be updated as more information becomes available.
This vulnerability is reported to affect SmartDashboard supplied with Check
Point Software NG-AI R54 and NG-AI R55, however, other versions could be
affected as well.
22. MathoPD Remote Buffer Overflow Vulnerability
BugTraq ID: 9871
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9871
Summary:
It has been reported that Mathopd is prone to a remote buffer overflow
vulnerability. The issue arises due to a failure to check the bounds of a
buffer storing user-supplied input.
It may be possible for attackers to leverage this vulnerability to execute
arbitrary instructions on the affected system. Any code executed would be in
the security context of the web server process.
23. WS_FTP Pro Client Remote Buffer Overflow Vulnerability BugTraq ID: 9872
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9872
Summary:
It has been reported that WS_FTP Pro client may be prone to a remote buffer
overflow vulnerability that may allow an attacker to execute arbitrary code
on a vulnerable system. An attacker may be able to cause a buffer overflow
condition in the client by supplying a file or a directory with a large name
exceeding 260 bytes without a terminating CR/LF character to the server.
The buffer overflow condition would occur when the client attempts to browse
through the attacker-supplied directory.
This issue is reported to affect WS_FTP Pro 8.02 and 8.03, however, other
versions may be affected as well.
24. YABB/YABB SE Multiple Cross-Site Scripting Vulnerabilites BugTraq ID:
9873
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9873
Summary:
It has been reported that YaBB and YaBB SE are prone to multiple cross-site
scripting vulnerabilities. These issues are due to a failure of the
applications to properly validate URI supplied user input.
Attackers may exploit this vulnerability to steal authentication
credentials. Other attacks may also be possible.
25. Apache HTAccess LIMIT Directive Bypass Configuration Error W... BugTraq
ID: 9874
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9874
Summary:
LIMIT directives are commonly used in htaccess files to restrict HTTP
methods that are available for a particular resource. However it has been
reported that if the requested resource is served by an Apache module and
not by Apache Server itself, LIMIT restrictions may not apply. Additionally,
CGI/Script resources that do not sufficiently check the calling method may
potentially be invoked with methods not listed in the LIMIT clause to evade
LIMIT restrictions.
26. GNU SPIP Unspecified PHP Code Execution Vulnerability BugTraq ID: 9875
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9875
Summary:
It has been reported that SPIP may be prone to an unspecifed PHP code
execution vulnerability that could allow an attacker to inject arbitrary PHP
code via certain URI parameters of 'forum.php3' script.
Successful exploitation of this issue may allow an attacker to execute
malicous PHP code in the context of the vulnerable site.
Although unconfirmed, SPIP versions 1.7 and prior may be prone to these
issues.
27. VocalTec VGW4/8 Telephony Gateway Remote Authentication Bypa... BugTraq
ID: 9876
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9876
Summary:
It has been reported that the VGW4/8 Telephony Gateway is prone to a remote
authentication bypass vulnerability via its web configuration tool. The
problem is due to a design error in the application that allows a user to
access configuration pages without prior authentication.
Successful exploitation of this issue may allow a remote attacker to gain
control of the affected appliance via its web configuration tool.
28. Multiple Vendor SOAP Server Undisclosed Request Denial Of Se... BugTraq
ID: 9877
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9877
Summary:
A problem has been identified in several different SOAP servers when
handling certain types of requests. Because of this, it is possible for an
attacker to force a denial of service on systems using a vulnerable
implementation.
This BID will be updated as further details regarding this vulnerability are
made public.
29. PHP-Nuke Modules.php Multiple Cross-Site Scripting Vulnerabi... BugTraq
ID: 9879
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9879
Summary:
It has been reported that PHP-Nuke may be prone to multiple cross-site
scripting vulnerabilities. These vulnerabilities occur due to insufficient
sanitization of user-supplied data via the 'Your Name', 'nicname', 'fname',
'ratenum', and 'search' fields of 'modules.php' script. Exploitation could
allow for theft of cookie-based authentication credentials. Other attacks
are also possible.
PHP-Nuke 7.1.0 has been reported to be prone to these issues, however, it is
possible that other versions are affected as well. These issues are
undergoing further analysis. These issues will be separated into individual
BIDs once analysis is complete.
30. Sybari AntiGen For Lotus Domino Denial Of Service Vulnerabil... BugTraq
ID: 9880
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9880
Summary:
Sybari AntiGen For Lotus Domino has been reported prone to a remote denial
of service vulnerability. The issue presents itself when a malicious
encrypted ZIP archive is encountered.
This will result in a denial of service to the affected Sybari AntiGen virus
detection software. Although unconfirmed, it is conjectured that subsequent
to the denial of service attack malicious programs may not be detected by
Sybari AntiGen.
31. WarpSpeed 4nAlbum Module For PHPNuke Multiple Vulnerabilitie... BugTraq
ID: 9881
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9881
Summary:
It has been reported that 4nAlbum is prone to multiple vulnerabilities.
These issues are primarily due to a failure of the module to validate user
input.
There is an information disclosure issue with the 'displaycategory.php'
script.
There is a remote file inclusion vulnerability in the 'displaycategory.php'
script.
A cross-site scripting vulnerability in the 'nmimage.php' script has also
been reported.
Finally an SQL injection vulnerability has been reported. This issue may be
leveraged through the 'modules.php' script of phpNuke while requesting the
'index' file of the 4nAlbum module.
This issue has been reported to affect version 0.92 of the software. It is
quite likely that other versions are affected as well.
32. Phorum Multiple Module Cross-Site Scripting Vulnerability BugTraq ID:
9882
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9882
Summary:
It has been reported that Phorum is prone to a cross-site scripting
vulnerability across multiple modules. The issue presents itself across
multiple modules including 'login.php', 'register.php', and 'profile.php'.
These modules employ two hidden variables named 'f' and 'target', which are
passed user-supplied input values from HTTP_REFERER without proper
sanitization.
Phorum versions 5.0.3 Beta and prior are reported to be vulnerable to this
issue.
33. PHPBB Search.PHP Search_Results Parameter SQL Injection Vuln... BugTraq
ID: 9883
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9883
Summary:
A vulnerability has been reported to exist in the software that may allow a
remote user to inject malicious SQL syntax into database queries. The
problem reportedly exists in one of the parameters of the search.php script.
This issue is caused by insufficient sanitization of user-supplied data. A
remote attacker may exploit this issue to influence SQL query logic to
disclose sensitive information that could be used to gain unauthorized
access.
34. SteelID thePhotoTool Login.ASP SQL Injection Vulnerability BugTraq ID:
9884
Remote: Yes
Date Published: Mar 15 2004
Relevant URL: http://www.securityfocus.com/bid/9884
Summary:
SteelID thePhotoTool is prone to an SQL injection vulnerability. The issue
is reported to exist in the 'login.asp' script, which does not sufficiently
sanitize user-supplied input before including it in SQL queries. This could
permit remote attackers to pass malicious input to database queries,
resulting in modification of query logic or other attacks.
35. Apache Mod_Security Module SecFilterScanPost Off-By-One Buff... BugTraq
ID: 9885
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9885
Summary:
It has been reported that the Apache 2 mod_security module is affected by an
off-by-one buffer overflow condition that could potentially allow a remote
attacker to execute arbitrary code on a vulnerable system under some
circumstances. The issue presents itself when the 'SecFilterScanPost'
directive is enabled. Specifically, malformed POST data sent by a remote
attacker may trigger an off-by-one buffer overflow condition.
Due to a lack of details further information cannot be provided at the
moment. This BID will be updated as more information becomes available.
mod_security 1.7.4 has been reported to be prone to this issue, however, it
is possible that other versions are affected as well.
36. WS_FTP Pro Client Remote Stack Buffer Overflow Vulnerability BugTraq ID:
9886
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9886
Summary:
It has been reported that WS_FTP Pro client may be prone to a remote buffer
overflow vulnerability that may allow an attacker to execute arbitrary code
on a vulnerable system in order to gain unauthorized access. The issue is
reported to present itself when the client views directory listings
containing files and directory names of excessive length without a
terminating CR/LF character. This vulnerability exists in WS_FTP Pro
version 8.0.3, which was released to fix the WS_FTP Pro Client Remote Buffer
Overflow Vulnerability described in BID 9872. It has been reported that the
fixed version limits user-supplied data to 0x0200 bytes; however, the buffer
is allocated to 0x0100 bytes.
Although this issue is reported to affect WS_FTP Pro 8.0.3, it is quite
likely that it affects previous versions as well.
37. JelSoft VBulletin MemberList.PHP Cross-Site Scripting Vulner... BugTraq
ID: 9887
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9887
Summary:
It has been reported that VBulletin is prone to a cross-site scripting
vulnerability in the 'memberlist.php' script. This issue is reportedly due
to a failure to sanitize user input and so allow for the inclusion of HTML
and script code that may facilitate cross-site scripting attacks.
Successful exploitation of this issue may allow for theft of cookie-based
authentication credentials or other attacks.
38. JelSoft VBulletin ForumDisplay.PHP Cross-Site Scripting Vuln... BugTraq
ID: 9888
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9888
Summary:
It has been reported that VBulletin is prone to a cross-site scripting
vulnerability in the 'forumdisplay.php' script. This issue is reportedly due
to a failure to sanitize user input and so allow for injection of HTML and
script code that may facilitate cross-site scripting attacks.
Successful exploitation of this issue may allow for theft of cookie-based
authentication credentials or other attacks.
39. JelSoft VBulletin ShowThread.PHP Cross-Site Scripting Vulner... BugTraq
ID: 9889
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9889
Summary:
It has been reported that VBulletin is prone to a cross-site scripting
vulnerability in the 'showthread.php' script. This issue is reportedly due
to a failure to sanitize user input and so allow for injection of HTML and
script code that may facilitate cross-site scripting attacks.
Successful exploitation of this issue may allow for theft of cookie-based
authentication credentials or other attacks.
40. Mambo Open Source Index.PHP Cross-Site Scripting Vulnerabili... BugTraq
ID: 9890
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9890
Summary:
It has been reported that the Mambo 'index.php' script is prone to a
cross-site scripting vulnerability. This issue is due to a failure of the
application to properly validate user supplied URI input. This issue could
permit a remote attacker to create a malicious link to the vulnerable
application that includes hostile HTML and script code. If this link were
followed, the hostile code may be rendered in the web browser of the victim
user.
41. Mambo Open Source Index.PHP SQL Injection Vulnerability BugTraq ID: 9891
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9891
Summary:
It has been reported that the Mambo 'index.php' script is prone to an SQL
injection vulnerability. This issue is due to a failure of the application
to properly validate user supplied URI input.
As a result of this a malicious user may influence database queries in order
to view or modify sensitive information, potentially compromising the
software or the database. It may be possible for an attacker to disclose the
administrator password hash by exploiting this issue.
42. Microsoft Windows XP explorer.exe Remote Denial of Service V... BugTraq
ID: 9892
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9892
Summary:
It has been reported that Windows Explorer for Windows XP may be prone to a
denial of service vulnerability that may allow a remote attacker to cause
the system to hang by sending a malicious directory containing 'wmf' files
to a vulnerable user via e-mail or other means. Windows Explorer
automatically attempts to parse 'wmf' files in the directory, however, an
exceptional condition occurs if the directory contains records of zero
length.
Although unconfirmed, all versions of Windows XP are considered to be
affected by this vulnerability.
43. Lim Unlimited Crafty Command Line Local Buffer Overflow Vuln... BugTraq
ID: 9893
Remote: No
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9893
Summary:
It has been reported that Crafty game program may be prone to a local buffer
overflow vulnerability that may allow an attacker to execute arbitrary code
in order to gain elevated privileges. The issue presents itself due to
insufficient bounds checking performed by 'crafty.bin' on user-supplied data
via the command line.
This problem could result in the execution of arbitrary code in the context
of the vulnerable process, and may result in a local user gaining elevated
privileges.
Crafty versions 19.3 and prior are reportedly affected by this issue.
44. Fizmez Web Server Null Connection Denial Of Service Vulnerab... BugTraq
ID: 9894
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9894
Summary:
Fizmez Web Server has been reported prone to denial of service
vulnerability.
It has been reported that if the server handles a connection and then that
connection drops without sending any data to the affected server, then the
server will crash while attempting to reference a null pointer.
45. PHP-Nuke Image Tag Admin Command Execution Vulnerability BugTraq ID:
9895
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9895
Summary:
It has been reported that PHP-Nuke is prone to a remote admin command
execution vulnerability. This issue is due to a design error that allows an
attacker to specify arbitrary URI values in bbCode tags contained within
posts.
This issue may be leveraged to force an admin user viewing a malicious post
to perform some query to the affected application such as adding a user or
removing arbitrary data from the database.
46. PhpBB admin_words.php Multiple Vulnerabilities
BugTraq ID: 9896
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9896
Summary:
It has been reported that PhpBB may be prone to multiple vulnerabilities
that may allow an attacker to carry out SQL injection and cross-site
scripting attacks. These issues are reported to affect the 'id' parameter
of 'admin_words.php' module. The SQL injection attack requires
administrator level access.
PhpBB version 2.0.6c has been reported to be affected by these issues,
however, it is possible that other versions are affected as well.
47. ClamAV RAR Archive Remote Denial Of Service Vulnerability BugTraq ID:
9897
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9897
Summary:
ClamAV has been reported prone to a remote denial of service vulnerability.
The issue presents itself when a RAR archive that is created by variants of
the W32.Beagle.A@mm worm (MCID 2443) is encountered.
48. Techland Chrome Denial of Service Vulnerability
BugTraq ID: 9898
Remote: Yes
Date Published: Mar 16 2004
Relevant URL: http://www.securityfocus.com/bid/9898
Summary:
Reportedly Chrome is prone to a remote denial of service vulnerability. This
issue is due to a failure to validate input of data received via network
communications.
This issue may allow a remote attacker to cause the affected server to
crash, denying service to legitimate users. It has been conjectured that
this issue may be leveraged to execute arbitrary code on the affected system
in the context of the vulnerable process, however this is unconfirmed.
49. OpenSSL Denial of Service Vulnerabilities
BugTraq ID: 9899
Remote: Yes
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9899
Summary:
Three security vulnerabilities have been reported to affect OpenSSL. Each
of these remotely exploitable issues may result in a denial of service in
applications which use OpenSSL.
The first vulnerability is a NULL pointer assignment that can be triggered
by attackers during SSL/TLS handshake exchanges. The CVE candidate name for
this vulnerability is CAN-2004-0079. Versions 0.9.6c to 0.9.6k
(inclusive) and from 0.9.7a to 0.9.7c (inclusive) are vulnerable.
The second vulnerability is also exploited during the SSL/TLS handshake,
though only when Kerberos ciphersuites are in use. The vendor has reported
that this vulnerability may not be a threat to many as it is only present
when Kerberos ciphersuites are in use, an uncommon configuration. The CVE
candidate name for this vulnerability is CAN-2004-0112. Versions 0.9.7a,
0.9.7b, and 0.9.7c are affected.
This entry will be retired when individual BID records are created for each
issue.
*Note: A third denial of service vulnerability included in the announcement
was discovered affecting 0.9.6 and fixed in 0.9.6d. The CVE candidate name
for this vulnerability is CAN-2004-0081.
50. IBM Lotus Domino HTTP webadmin.nsf Directory Traversal Vulne... BugTraq
ID: 9900
Remote: Yes
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9900
Summary:
It has been reported that Lotus Domino may be prone to a directory traversal
vulnerability that may allow a remote attacker to access information outside
the server root directory. The issue reportedly exists in the server's
administrative interface accessed via
'webadmin.nsf'. The vulnerability may be exploited by a remote attacker
by traversing outside the server root directory by using '../' directory
traversal character sequences. Successful exploitation of this
vulnerability may allow a remote attacker to gain access to sensitive
information and/or modify the underlying file system.
IBM Lotus Domino server 6.5.1 has been reported to be prone to this issue,
however, it is possible that other versions are affected as well.
51. IBM Lotus Domino HTTP webadmin.nsf Quick Console Cross-Site... BugTraq
ID: 9901
Remote: Yes
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9901
Summary:
It has been reported that Lotus Domino server may be prone to a cross-site
scripting vulnerability that may allow a remote attacker to execute HTML or
script code in a user's browser. The issue presents itself due to
insufficient sanitization of user-supplied data via the 'Quick Console'
function of 'webadmin.nsf' administrative interface.
IBM Lotus Domino server 6.5.1 has been reported to be prone to this issue,
however, it is possible that other versions are affected as well.
52. AIX Make CC Path Local Buffer Overflow Vulnerability BugTraq ID: 9903
Remote: No
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9903
Summary:
AIX make has been reported to be prone to a buffer overflow vulnerability,
the issue is reported to exist due to a lack of sufficient boundary checks
performed when reading the path to the CC compiler.
Because the make utility is reported to run with setGID root privileges, a
local attacker may potentially exploit this condition to gain access to the
root group.
This issue is reported to exist on AIX 4.3.3 platforms.
53. GlobalSCAPE Secure FTP Server SITE Command Remote Buffer Ove... BugTraq
ID: 9904
Remote: Yes
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9904
Summary:
It has been reported that Secure FTP Server may be prone to a remote buffer
overflow vulnerability that may allow attackers to execute arbitrary code on
a vulnerable system in order to gain unauthorized access. An attacker may
cause the buffer overflow condition to occur by sending about 252 bytes of
data via a parameter of the SITE Command. Immediate consequences of an
attack may result in a denial of service condition. The possibility of
remote code execution has not been confirmed at the moment.
Secure FTP Server version 2.0 Build 03.11.2004.2 has been reported to prone
to this issue.
54. AIX Getlvcb Command Line Argument Buffer Overflow Vulnerabil... BugTraq
ID: 9905
Remote: No
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9905
Summary:
getlvcb has been reported to be prone to a buffer overflow vulnerability.
When an argument is passed to the getlvcb utility, the string is copied into
a reserved buffer in memory. Data that exceeds the size of the reserved
buffer will overflow its bounds and will trample any saved data that is
adjacent to the affected buffer. Ultimately this may lead to the execution
of arbitrary instructions in the context of the root user.
An attacker will require root group privileges prior to the execution of the
getlvcb utility, the attacker may exploit the issue described in BID 9903 in
order to gain the necessary privileges required to exploit this
vulnerability.
55. AIX Putlvcb Command Line Argument Buffer Overflow Vulnerabil... BugTraq
ID: 9906
Remote: No
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9906
Summary:
putlvcb has been reported to be prone to a buffer overflow vulnerability.
When an argument is passed to the putlvcb utility, the string is copied into
a reserved buffer in memory. Data that exceeds the size of the reserved
buffer will overflow its bounds and will trample any saved data that is
adjacent to the affected buffer. Ultimately this may lead to the execution
of arbitrary instructions in the context of the root user.
An attacker will require root group privileges prior to the execution of the
putlvcb utility, the attacker may exploit the issue described in BID 9903 in
order to gain the necessary privileges required to exploit this
vulnerability.
56. OpenBSD isakmpd Multiple Unspecified Remote Denial Of Servic... BugTraq
ID: 9907
Remote: Yes
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9907
Summary:
OpenBSD's isakmpd daemon is reported prone to multiple issues that may lead
to a remote denial of service. These issues are reported to occur when
processing certain malformed payloads. This issue may be leveraged by a
remote attacker to cause the isakmpd to cease processing requests, thereby
effectively denying service to legitimate users.
57. WFTPD Server GUI Remote Denial Of Service Vulnerability BugTraq ID: 9908
Remote: Yes
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9908
Summary:
WFTPD server front end GUI has been reported to be prone to a denial of
service. The issue is reported to present itself if a user who is logged
into the affected service issues an FTP request with a large parameter. This
will cause the server GUI to behave in an unstable manner, potentially
preventing the GUI from opening.
58. DameWare Mini Remote Control Server Weak Encryption Implemen... BugTraq
ID: 9909
Remote: Yes
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9909
Summary:
DameWare Mini Remote Control Server has been reported to be prone to a weak
encryption implementation.
It has been reported that analysis of encrypted traffic will reveal the
block cipher that is used by DameWare Mini Remote Control to encrypt the
plaintext data using ECB (Electronic Code Book) mode. This may ultimately
allow an attacker to determine the block cipher and thereby expose plaintext
credentials by reversing the process.
59. Belchior Foundry VCard Authentication Bypass Vulnerability BugTraq ID:
9910
Remote: Yes
Date Published: Mar 17 2004
Relevant URL: http://www.securityfocus.com/bid/9910
Summary:
It has been reported that vCard is prone to a remote authentication bypass
vulnerability. This issue is due to a design error that would allow a
malicious user access to certain admin functionality without having to first
authenticate to the application.
This issue may be leveraged to manipulate the application database,
potentially destroying data.
60. PHP-Nuke Error Manager Module Multiple Vulnerabilities BugTraq ID: 9911
Remote: Yes
Date Published: Mar 18 2004
Relevant URL: http://www.securityfocus.com/bid/9911
Summary:
It has been reported that Error Manager is prone to multiple
vulnerabilities. These issues are due to failure to validate user input,
failure to handle exceptional conditions and simple design errors.
These issues may be leveraged to carry out cross-site scripting attacks,
reveal information about the application configuration and initiate HTML
injection attacks against the affected system.
61. Symantec Norton Internet Security/Personal Firewall Remote D... BugTraq
ID: 9912
Remote: Yes
Date Published: Mar 18 2004
Relevant URL: http://www.securityfocus.com/bid/9912
Summary:
eEye Digital Security has reported an unspecified remotely exploitable
denial of service vulnerability in Symantec Norton Internet Security 2004
and Norton Personal Firewall 2004 products.
62. Internet Security Systems Protocol Analysis Module ICQ Parsi... BugTraq
ID: 9913
Remote: Yes
Date Published: Mar 18 2004
Relevant URL: http://www.securityfocus.com/bid/9913
Summary:
It has been reported that the Internet Security Systems (ISS) Protocol
Analysis Module is prone to a remote buffer overflow vulnerability when
parsing the ICQ protocol. This issue exists due to insufficient bounds
checking performed on certain unspecified ICQ protocol fields supplied in
ICQ response data.
Successful exploitation of this issue may allow a remote attacker to execute
arbitrary code on a vulnerable system in order to gain unauthorized access.
This attack would occur in the context of the vulnerable process.
This module is used to parse network protocols and is included in a number
of products provided by ISS, including various RealSecure and BlackICE
releases.
III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Report: Phishing attacks on the rise
By: Kevin Poulsen
A new report finds a 60 percent increase in one month in the variety of
spammy scam mails sent by identity thieves.
http://www.securityfocus.com/news/8289
2. Anti-piracy vigilantes track file sharers
By: Kevin Poulsen
Crime-busting coders spark controversy when they circulate a Trojan horse on
peer-to-peer networks designed to chastise pirates, and report back to a
public website.
http://www.securityfocus.com/news/8279
3. Hosting company reveals hacks, citing disclosure law
By: Kevin Poulsen
Thousands of customers of a Texas-sized Web hosting company enjoy full
disclosure of a recent security breach, thanks in part to a California law.
http://www.securityfocus.com/news/8240
4. UK.biz leaves door open to hackers
By: John Leyden, The Register
http://www.securityfocus.com/news/8297
5. The farce of federal cybersecurity
By: Richard Forno, The Register
http://www.securityfocus.com/news/8296
6. 'Witty' Worm Wrecks Computers
By: Brian Krebs, Washington Post
http://www.securityfocus.com/news/8291
IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. Qingy Is Not Getty v0.4.0
By: Noberasco
Relevant URL: http://qingy.sourceforge.net/
Platforms: Linux, POSIX
Summary:
qingy is a replacement for getty. It uses DirectFB to provide a fast, nice
GUI without the overhead of the X Windows System. It allows the user to log
in and start the session of his choice (text console, GNOME, KDE, wmaker,
etc.).
2. Network Packet Capture Facility for Java v0.01.15
By: patrick charles
Relevant URL: http://jpcap.sourceforge.net
Platforms: Linux, Solaris, SunOS
Summary:
Network Packet Capture Facility for Java is a set of Java classes that
provide an interface and system for network packet capture. A protocol
library and tool for visualizing network traffic is included. It utilizes
libpcap, a widely used system library for packet capture.
3. moftpd v1.1.6
By: Morth
Relevant URL: http://www.morth.org/moftpd/
Platforms: UNIX
Summary:
moftpd is a powerful FTP server supporting IPv6, virtual hosts, fine grained
permissions, and much more.
4. filewatcher v2.3.9
By: Mark Nagel
Relevant URL: http://filewatcher.sourceforge.net/
Platforms: POSIX
Summary:
filewatcher is a Perl program that uses RCS to maintain a local file archive
repository. A configuration file details which files and directories to
monitor and to whom reports should be delivered.
5. CryptoHeaven v2.3.2
By: Marcin Kurzawa <marcin@cryptoheaven.com>
Relevant URL: http://www.cryptoheaven.com/
Platforms: UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:
CryptoHeaven offers secure email and online file sharing/storage. Its main
features are secure and highly encrypted services such as group
collaboration, file sharing, email, online storage, and instant messaging.
It integrates multi-user based security into email, instant messaging, and
file storage and sharing in one unique package. It provides real time
communication for text and data transfers in a multi-user secure
environment. The security and usability of CryptoHeaven is well-balanced;
even the no-so-technically oriented computer users can enjoy this crypto
product with very high level of encryption.
6. NetMRG v0.14
By: Brady Alleman
Relevant URL: http://www.netmrg.net/
Platforms: Linux
Summary:
NetMRG is a network monitoring, reporting, and graphing system. Using MySQL,
PHP, C++, pthreads, and RRDTOOL, it is capable of monitoring thousands of
variables on five-minute intervals. Graph templating allows network admins
to begin monitoring devices with minimal overhead. NetMRG is also capable of
responding to programmable events, such as variables exceeding accepted
tolerances. It can accommodate server hosting and Internet service provider
environments with different users allowed to view only their own equipment's
graphs.
V. SECURITYJOBS LIST SUMMARY
----------------------------
1. Security and audit professional available for volunt... (Thread) Relevant
URL:
http://www.securityfocus.com/archive/77/358113
2. SecurityGuys, a securityjobs-like list for Brazil (Thread) Relevant URL:
http://www.securityfocus.com/archive/77/358112
3. CSO NEEDED!!!!! (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357998
4. Senior System Engineer (East Coast, West Coast) posi... (Thread) Relevant
URL:
http://www.securityfocus.com/archive/77/357991
5. CISO cover letter help needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357978
6. Security Consultant - UK - SE/Central England (Thread) Relevant URL:
http://www.securityfocus.com/archive/77/357976
7. PenTester/Security Researcher Position (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357887
8. Full time Senior Security Consultant position in Pit... (Thread) Relevant
URL:
http://www.securityfocus.com/archive/77/357886
9. Security Practice Lead - #867JA - Northeast - $120k ... (Thread) Relevant
URL:
http://www.securityfocus.com/archive/77/357885
10. 2 Unix/security positions in Washington DC -Full tim... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357884
11. Security Software Training. (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357883
12. Group Product Manager (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357881
13. Information Security Officer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357877
14. Information "Systems Security Engineer" position at ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357874
15. FW: Software Engineer User Interface San Diego CA (Thread) Relevant URL:
http://www.securityfocus.com/archive/77/357873
16. Security Sales Folks Needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357871
17. IDS/IPS Architecture Consultants - NY, NJ, Bay Area (Thread) Relevant
URL:
http://www.securityfocus.com/archive/77/357870
18. <Job> Application Security Engineer Two Contract Pos... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357869
19. Senior Test and Evaluation Engineer (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357868
20. Product Manager-San Francisco (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357866
21. Sales and SE's (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357650
22. Job Opportunity Sr. Developer, Security Systems (Thread) Relevant URL:
http://www.securityfocus.com/archive/77/357649
23. Senior Security Programmer II (Full time position i... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357647
24. Senior Security Engineer - New Jersey ($70k-90k) Imm... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357646
25. Director Public Relations Security (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357638
26. Job Opportunity- Sales Engineer in the New York Area (Thread) Relevant
URL:
http://www.securityfocus.com/archive/77/357637
27. Information Security position in the Washington, DC ... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357636
28. Security Scanner Test Engineer Silicon Valley CA (Thread) Relevant URL:
http://www.securityfocus.com/archive/77/357635
29. Account Manager, Nordics (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357634
30. Account Manager, Brussels (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357633
31. Penetration Tester (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357632
32. ETHICAL HACKER (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357631
33. Software Engineers - RADIUS - Infoblox, Silicon Vall... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357628
34. Network Security Architect - NY (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357627
35. Senior Security Programmer (Full time position in At... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357624
36. Director of Development (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357622
37. Rainmaker in Chicago (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357618
38. SAGEM Smart Card Specialist United Arab Emirates (Thread) Relevant URL:
http://www.securityfocus.com/archive/77/357518
39. Senior Security Programmer position in Atlanta GA (Thread) Relevant URL:
http://www.securityfocus.com/archive/77/357517
40. IAM, CISSP looking in the DC metro area (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357516
41. Senior Security Analyst Needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357515
42. Network Security specialist team lead - Toronto (Thread) Relevant URL:
http://www.securityfocus.com/archive/77/357514
43. Information Security Specialist II (Full time positi... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357513
44. Senior Network Security Specialist needed (Thread)
Relevant URL:
http://www.securityfocus.com/archive/77/357512
VI. INCIDENTS LIST SUMMARY
--------------------------
1. very weird traffic (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/358136
2. New virus? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/358127
3. Release of Rootkit Hunter 1.0.0 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/358126
4. Incident Response Database (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357910
5. Phatbox: Media Hype? Scare Tactics? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357758
6. Administrivia: SPAM control accounts... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357718
7. New article annnouncement (2) (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357717
8. SDSU compromise (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357697
9. Dead Thread: New phishing scheme... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357695
10. New phishing style? Give them real links except for... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357694
11. Computer Security Mexico 2004 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357580
12. Port 2979 Activity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/75/357492
VII. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Computer Security Mexico 2004 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/357564
2. Linux exploits and random post-argv/ envp injection (Thread) Relevant
URL:
http://www.securityfocus.com/archive/82/357502
3. New security alert #66 issued in Oracle web cache (Thread) Relevant URL:
http://www.securityfocus.com/archive/82/357501
4. buffer overflows and stack alignment (Thread)
Relevant URL:
http://www.securityfocus.com/archive/82/357415
VIII. MICROSOFT FOCUS LIST SUMMARY
----------------------------------
1. Hardening TCP/IP Stack; conflicting sources (Thread) Relevant URL:
http://www.securityfocus.com/archive/88/358130
2. security tools (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/358102
3. Article Announcement: Detection of SQL Injection and... (Thread) Relevant
URL:
http://www.securityfocus.com/archive/88/357699
4. SecurityFocus Microsoft Newsletter #180 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/357533
5. Article Announcement: Where to Turn? (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/357490
IX. SUN FOCUS LIST SUMMARY
--------------------------
1. sunscreen and stealth interfaces (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/357560
2. PAM & Auth (Thread)
Relevant URL:
http://www.securityfocus.com/archive/92/357559
X. LINUX FOCUS LIST SUMMARY
---------------------------
1. ModSSL - Knoppix 3.3 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/357693
XI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to
sf-news-unsubscribe@securityfocus.com from the subscribed address. The
contents of the subject or message body do not matter. You will receive a
confirmation request message to which you will have to answer. Alternatively
you can also visit http://www.securityfocus.com/newsletters
and unsubscribe via the website.
If your email address has changed email listadmin@securityfocus.com and ask
to be manually removed.
XII. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Verisign
Secure your servers with 128-bit SSL encryption! Grab your
copy of VeriSign's FREE Guide, "Securing Your Web site for Business," and
you'll learn everything you need to know about using 128-bit SSL to encrypt
your e-commerce transactions,
secure your corporate intranets and authenticate your Web sites. 128-bit SSL
is serious security for your online business.
Get it now!
http://www.securityfocus.com/sponsor/Verisign_sf-news_040315
------------------------------------------------------------------------
------------------------------------------------------------------------
To unsubscribe from netsec, send mail to majordomo@merit.edu
with a body consisting of the words "unsubscribe netsec" --
without the quotes. For more help, send a message to majordomo@merit.edu
with the word "help" as the body.
------------------------------------------------------------------------
|
