Hosting Provided By

SecurityFocus Newsletter #180

From: John Boletta <jboletta(at)securityfocus.com>
Date: Mon Jan 20 2003 - 14:14:42 EST

This issue is sponsored by: Qualys

Strengthening Network Security: FREE Guide Network security is a constantly moving target - even proven solutions lose their punch over time. Find out how to get COMPLETE PROTECTION against ever-growing security threats with our FREE new Guide.

Get your copy today at: https://www.qualys.com/forms/nsguideh_376.php

I. FRONT AND CENTER

Exchange 2000 in the Enterprise: Tips and Tricks Part Two
The Curmudgeon's Crystal Ball: Security Predictions for 2003
Open Source Honeypots: Learning with Honeyd
SecurityFocus DPP Program
InfoSec World Conference and Expo/2003 (March 10-12,2003,Orlando,FL) II. BUGTRAQ SUMMARY
Xynph FTP Server Relative Path Directory Traversal Vulnerability
BitMover BitKeeper Daemon Mode Remote Command Execution...
BitMover BitKeeper Local Temporary File Race Condition...
BitMover BitKeeper Local Insecure Temporary File Permissions...
YABB SE Reminder.PHP SQL Injection Vulnerability
Stunnel Unspecified SIGCHLD Signal Handler Vulnerability
phpPass AccessControl.PHP SQL Injection Vulnerability
W-Agora Remote File Disclosure Vulnerability
mpg123 Invalid MP3 Header Memory Corruption Vulnerability
Cyboards PHP Lite Remote File Include Vulnerability
Cyboards PHP Lite Multiple Cross Site Scripting Vulnerabilities
Solaris UUCP Local Buffer Overflow Vulnerability
Symantec Norton Internet Security ICMP Packet Flood Denial Of...
Geeklog Profiles.PHP Multiple Cross-Site Scripting...
Geeklog Users.PHP Cross-Site Scripting Vulnerability
Geeklog Comment.PHP Cross-Site Scripting Vulnerability
Geeklog Homepage User Field HTML Injection Vulnerability
vAuthenticate Remote SQL Injection Vulnerability
vSignup Remote SQL Injection Vulnerability
Psunami Bulletin Board Psunami.CGI Remote Command Execution...
D-Link DWL-900AP+ Firmware Upgrade Configuration Reset...
HTML Forms Generation And Validation Forms.PHP HTML Injection...
Trend Micro OfficeScan CGI Directory Insufficient Permissions...
Trend Micro Virus Control System Denial Of Service Vulnerability
Trend Micro Virus Control System Information Disclosure... III. SECURITYFOCUS NEWS ARTICLES
Rumsfeld orders .mil Web lockdown
MS seeks malware, bust phones after SPV security crack
Discarded computer hard drives prove a trove of personal info
BBC in ironic virus infection IV. SECURITYFOCUS TOP 6 TOOLS
ForceSQL v2.0
SMAC v1.0
Active@ File Recovery v2.0
NBTdeputy v1.0
APD v1
mysql_auth v0.5
SECURITYJOBS LIST SUMMARY
Senior Identity Manager - Cleveland, Ohio (Thread)
Policy, Procedure, and Compliance Senior Manager - Cleveland...
Vulnerability Manager (Thread)
Senior Enterprise Security Manager position in PA (Thread)
Security Engineer (Thread)
WANTED - Senior Sales Exec - New York (Tri-State Area) (Thread)
Vice President of Business Development (Thread)
Security System Engineer - Baltimore/Washington DC (Thread)
Security Engineer -- San Diego (Thread)
Senior Security Engineer - Baltimore/Wshington DC (Thread)
Seeking information security opportunity in - CA/ LA (CISSP)...
Lead Business Development/Security Consultant(s) - UK (Thread)
Seeking Information Security employment (Thread)
Senior Federal Territory Manager (Thread)
Information Security Analyst (Thread)
IDS Signature Engineer needed now! (revised) (Thread)
IDS Signature Engineer needed now! (Thread)
Security Position with Bristol-Myers Squibb-Hopewell-NJ (Thread)
Seeking internship or entry-level position (Thread)
Looking for a security based role (no expierence) (Thread)
@stake Employment in Seattle (Thread)
Looking for security job opportunity in Northern... VI. INCIDENTS LIST SUMMARY
Hacked web server (Thread)
Virus? Trojan? (Thread) VII. VULN-DEV RESEARCH LIST SUMMARY
NO NEW POSTS FOR THE WEEK ENDING 01.17.03 VIII. MICROSOFT FOCUS LIST SUMMARY
AD replication over WAN (Thread)
SecurityFocus Microsoft Newsletter #120 (Thread)
AD replication (Thread)
Understaing Event Details in Windows NT (Thread)
FW: AD replication over WAN (Thread) IX. SUN FOCUS LIST SUMMARY
NO NEW POSTS FOR THE WEEK ENDING 01.17.03
LINUX FOCUS LIST SUMMARY
How to build CD with chkrootkit on it? (Thread) XI. SPONSOR INFORMATION
FRONT AND CENTER
Exchange 2000 in the Enterprise: Tips and Tricks Part Two By Tim Mullen

This is the second installment in a two-part series on securing Exchange 2000 in the enterprise. In the first part, we finished up building a messaging infrastructure that handled many of the issues mail administrators must contend with. This segment will address the security ramifications of publishing mail content to the Internet via Outlook Web Access.

http://online.securityfocus.com/infocus/1658

Do you need help?

2. The Curmudgeon's Crystal Ball: Security Predictions for 2003 By Richard Forno

As we ring in the new year, it's in with the new and out with the old. Or is it? Our fearless forecaster thinks not.

http://online.securityfocus.com/columnists/135

3. Open Source Honeypots: Learning with Honeyd by Lance Spitzner

Honeypots are an exciting new technology. They allow us to turn the tables on the bad guys, we can take the initiative. In the past several years there has been growing interest in exactly what this technology is and how it works. The purpose of this paper is to introduce you to honeypots and demonstrate their capabilities. We will begin by discussing what a honeypot is and how it works, then go into detail using the OpenSource solution Honeyd.

http://online.securityfocus.com/infocus/1659

4. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only global early-warning system for cyber attacks - SecurityFocus DeepSight Threat Management System.

Do you need more help?

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

5. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)

Optional Workshops March 8, 9, 12, 13, & 14 Vendor Expo March 10 & 11

Solutions to today’s security concerns; hands-on experts; blockbuster vendor expo; the CISO Executive Summit; invaluable networking opportunities. InfoSec World has it all!

Go to: http://www.misti.com/10/os03nl37inf.html

II. BUGTRAQ SUMMARY

Xynph FTP Server Relative Path Directory Traversal Vulnerability BugTraq ID: 6587 Remote: Yes Date Published: Jan 11 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6587 Summary:

Xynph FTP Server is a shareware FTP server available for Microsoft Windows operating systems.

A problem in Xynph FTP Server may allow a remote user to gain access to unauthorized resources.

Can we help you?

A problem with the handling of input has been reported in Xynph FTP Server. Under some circumstances, it may be possible for a remote user to escape the FTP root directory using relative path notation. This could allow unauthorized access to systems using the vulnerable software.

It should be noted that this problem may allow an attacker to download arbitrary files on the vulnerable system. Additionally, the attacker would be able to access any files on the system to which the FTP server has access rights, which may be run with SYSTEM privileges in some configurations.

2. BitMover BitKeeper Daemon Mode Remote Command Execution Vulnerability BugTraq ID: 6588
Remote: Yes
Date Published: Jan 11 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6588
Summary:

BitKeeper is a source code management system by BitMover. It is available for Unix, Linux, and Microsoft Windows operating systems.

A problem with BitKeeper may make remote command execution possible.

It has been reported that BitKeeper is vulnerable to an input validation bug. When the software is run in daemon mode, it starts a service with an interface that can be connected to via HTTP. By sending specially crafted input to the service, it is possible to execute abitrary commands.

The program does not properly filter single quotes. As a result, commands contained between quotes will be executed on the host running the vulnerable software. Any commands executed between quotes will be executed with the privileges of the BitKeeper daemon process.

3. BitMover BitKeeper Local Temporary File Race Condition Vulnerability BugTraq ID: 6589
Remote: No
Date Published: Jan 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6589
Summary:

Can't find what you're looking for?

BitKeeper is a source code management system by BitMover. It is available for Unix, Linux, and Microsoft Windows operating systems.

A problem with BitKeeper may make local symbolic link attacks possible.

It has been reported that BitKeeper is vulnerable to a race condition error. Under some circumstances, BitKeeper creates files in the temporary directory. However, it may be possible to create a symbolic link in a crucial point of program execution that would result in the overwriting of files at the end of the link.

The program does not properly open the temporary file. Rather than performing the check and opening the file all in one function, the program first checks, then in a seperate function opens the file. This creates a window of attack that could result in the overwriting of files that are write-accessible to the BitKeeper process.

4. BitMover BitKeeper Local Insecure Temporary File Permissions Vulnerability BugTraq ID: 6590
Remote: No
Date Published: Jan 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6590
Summary:

BitKeeper is a source code management system by BitMover. It is available for Unix, Linux, and Microsoft Windows operating systems.

A problem with BitKeeper may make the destruction or injection of information possible.

It has been reported that BitKeeper insecurely creates temporary files. Under some circumstances, BitKeeper creates files in the temporary directory. However, these files are created with world-writable permissions, which may allow the removal of these files, or injection of data into them.

Don't know where to look next?

5. YABB SE Reminder.PHP SQL Injection Vulnerability BugTraq ID: 6591
Remote: Yes
Date Published: Jan 12 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6591
Summary:

YaBB SE is a freely available, open source port of Yet Another Bulletin Board (YaBB). It is available for Unix, Linux, and Microsoft Operating Systems.

A problem with YaBB SE could make it possible for a remote user launch SQL injection attacks.

It has been reported that a problem exists in the Reminder.php script distributed as part of YaBB SE. Due to insufficient sanitizing of input, it is possible for a remote user to inject arbitrary SQL into the database used by YaBB SE that could be used to reset or change the password of a user.

This problem may allow a remote user to change the password of the administrative user of an instance of YaBB SE. It may also allow a remote user to gain other information from SQL databases used to backend YaBB SE.

6. Stunnel Unspecified SIGCHLD Signal Handler Vulnerability BugTraq ID: 6592
Remote: No
Date Published: Jan 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6592
Summary:

Stunnel is a freely available, open source cryptography wrapper. It is designed to wrap arbitrary protocols that may or may not support cryptography. It is maintained by the Stunnel project.

A vulnerability has been reported for Stunnel. The vulnerability exists in the SIGCHLD signal handling routine. Reportedly, some functions in the signal handler are used in an unsafe manner.

Confused? Frustrated?

Precise technical details of this vulnerability are currently unknown. This BID will be updated as further information is available.

This vulnerability has been reported to affect Stunnel versions prior to 4.04.

7. phpPass AccessControl.PHP SQL Injection Vulnerability BugTraq ID: 6594
Remote: Yes
Date Published: Jan 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6594
Summary:

phpPass is a system that allows restrictions to web pages. It is implemented in PHP and is available for a variety of platforms.

A problem with phpPass may allow an attacker to launch a SQL injection attack.

The vulnerability exists in the accesscontrol.php script included with phpPass. Due to insufficient sanitization of user-supplied input, it is possible for a remote user to inject arbitrary SQL into the database used by a vulnerable site. This may allow an attacker to view pages that would normally be restricted.

SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

This vulnerability was reported for phpPass 2. It is not known whether other versions are affected.

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365

8. W-Agora Remote File Disclosure Vulnerability BugTraq ID: 6595
Remote: Yes
Date Published: Jan 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6595
Summary:

W-Agora is a freely available, open source PHP forum software package. It is available for Unix and Linux systems.

A file disclosure vulnerability has been reported for W-Agora. Reportedly, some scripts included with W-Agora do not adequately sanitize some user-supplied input. The vulnerability was reported to exist in the index.php and modules.php script files.

An attacker can construct a URL consisting of dot-dot-slash (../) character sequences to obtain access to files outside of the document root. It should be noted that only files accessible by the web server will be disclosed to the attacker.

Exploitation of this vulnerability may lead to disclosure of sensitive information that may be useful in mounting further attacks on the host system.

This vulnerability affects W-Agora 4.1.5.

9. mpg123 Invalid MP3 Header Memory Corruption Vulnerability BugTraq ID: 6593
Remote: Yes
Date Published: Jan 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6593
Summary:

mpg123 is a MPEG audio player for Linux variant operating systems.

Do you need help?

A memory corruption vulnerability has been reported for mpg123 that may result in code execution.

The vulnerability exists when mpg123 is used to play certain MP3 files. Specifically, when playing MP3 files with malformed or overly large headers, it may be possible to cause mpg123 to execute malicious attacker-supplied code.

The file common.c defines MAX_INPUT_FRAMESIZE to a value of 1920 bytes. An attacker can exploit this vulnerability by creating a malicious MP3 file that contains headers consisting of greater than 1920 bytes. When mpg123 is used to play this corrupted MP3 file, it will trigger the buffer overflow condition. Any attacker supplied code will be executed with the privileges of the mpg123 process.

This vulnerability has been reported to affect mpg123pre0.59s.

Cyboards PHP Lite Remote File Include Vulnerability BugTraq ID: 6597 Remote: Yes Date Published: Jan 13 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6597 Summary:

A vulnerability has been discovered in Cyboards PHP Lite. Due to insufficient sanitization of user-supplied variables by the
'default_header.php' and 'options_form.php' scripts, it is possible for a
remote attacker to include a malicious PHP file in a URL.

By placing a script on an attacker-controlled host and mimicking the name and directory structure of the server, it is possible to cause a vulnerable server to include the file.

It may be possible to exploit this issue to execute arbitrary commands with the privileges of the target server.

Cyboards PHP Lite Multiple Cross Site Scripting Vulnerabilities BugTraq ID: 6596 Remote: Yes Date Published: Jan 13 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6596 Summary:

Multiple cross site scripting vulnerabilities have been discovered in Cyboards PHP Lite. These issues occur due to insufficient validation of user supplied values.

Do you need more help?

It is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running Cyboards PHP Lite.

This issue affects the following PHP scripts:

include/default_header.php
include/options_form.php
adminopts/login_form.php
adminopts/include/ban_form.php
adminopts/include/board_form.php

adminopts/include/login_form.php
adminopts/include/vip_form.php

This issue could be exploited to steal a legitimate users cookie-based authentication credentials. Information gained in this manner could be later used to hijack a legitimate users web session.

Solaris UUCP Local Buffer Overflow Vulnerability BugTraq ID: 6600 Remote: No Date Published: Jan 13 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6600 Summary:

UUCP is the Unix-to-Unix Copy Protocol infrastructure, implmented with numerous Unix and Unix clone operating systems.

A vulnerability has been discovered in the Solaris implementation of UUCP. The problem is due to insufficient bounds checking of user-supplied filenames. By passing excessive data as an argument for the '-s' command line parameter it is possible to trigger a buffer overflow. By exploiting this issue to overwrite sensitive locations in memory, it may be possible for an attacker to execute arbitrary code.

As UUCP is installed setuid root this would result in the execution of attacker-supplied commands with the privileges of the superuser.

Symantec Norton Internet Security ICMP Packet Flood Denial Of Service Vulnerability BugTraq ID: 6598 Remote: Yes Date Published: Jan 13 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6598 Summary:

Symantec Norton Internet Security is a suite of commercial security utilities including Norton Personal Firewall and Norton Antivirus.

Symantec Norton Internet Security 2003 is reported to be prone to a denial of service condition.

Can we help you?

It is possible to trigger this condition by sending an excessive (approximately 65500 or more) number of ICMP packets to a host running Norton Internet Security. This may cause a denial of service and possible system instability.

For this issue to be present, the software must be configured to allow ICMP packets and the firewall must be enabled.

It is not known if earlier versions of the software are also affected by this vulnerability.

Geeklog Profiles.PHP Multiple Cross-Site Scripting Vulnerabilities BugTraq ID: 6601 Remote: Yes Date Published: Jan 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6601 Summary:

Geeklog is freely available, open-source weblog software. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

The Geeklog 'profiles.php' script is prone to multiple cross-site scripting vulnerabilities.

This issue is due to insufficient sanitization of input submitted in URI parameters. This input will be displayed in webpages generated by Geeklog. As a result, an attacker may create a malicious link to a site hosting Geeklog, which contains malicious HTML or script code.

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client in the security context of the site hosting Geeklog.

Exploitation of this issue may enable an attacker to steal cookie-based authentication credentials from legitimate users of the software. Other attacks are also possible.

Geeklog Users.PHP Cross-Site Scripting Vulnerability BugTraq ID: 6602 Remote: Yes Date Published: Jan 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6602 Summary:

Can't find what you're looking for?

Geeklog is freely available, open-source weblog software. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

Geeklog is prone to a cross-site scripting vulnerability in the
'users.php' script.

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client in the security context of the site hosting Geeklog.

Exploitation of this issue may enable an attacker to steal cookie-based authentication credentials from legitimate users of the software. Other attacks are also possible.

Geeklog Comment.PHP Cross-Site Scripting Vulnerability BugTraq ID: 6603 Remote: Yes Date Published: Jan 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6603 Summary:

Geeklog is freely available, open-source weblog software. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

Geeklog is prone to a cross-site scripting vulnerability in the
'comment.php' script.

Don't know where to look next?

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client in the security context of the site hosting Geeklog.

Exploitation of this issue may enable an attacker to steal cookie-based authentication credentials from legitimate users of the software. Other attacks are also possible.

Geeklog Homepage User Field HTML Injection Vulnerability BugTraq ID: 6604 Remote: Yes Date Published: Jan 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6604 Summary:

Geeklog is freely available, open-source weblog software. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

Geeklog is prone to HTML injection attacks.

The user account 'Homepage' field is not sufficiently sanitized of HTML and script code. As a result, a malicious user may inject malicious HTML and script code into this field when editing their user information. When the malicious user's account information is displayed to other web users, the attacker-supplied code will be interpreted in their web client in the security context of the site hosting the vulnerable software.

Exploitation of this issue may enable an attacker to steal cookie-based authentication credentials from legitimate users of the software. Other attacks are also possible.

vAuthenticate Remote SQL Injection Vulnerability BugTraq ID: 6605 Remote: Yes Date Published: Jan 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6605 Summary:

vAuthenticate is an authentication script that uses PHP and MySQL. It is available for the Microsoft Windows, Linux, and Unix operating systems.

A vulnerability has been discovered in vAuthenticate. It has been reported that the 'auth.php' fails to sufficiently sanitize user-supplied variables, making various PHP files prone to SQL injection attacks. This may make it possible for an unauthorized to access protected documents. The 'chgpwd.php' and 'admin/index.php' scripts are affected by this issue.

Confused? Frustrated?

An attacker that is able to access protected web pages may gain sensitive information that may aid in launching further attacks against a target server.

SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

This vulnerability was reported for vAuthenticate 2.8.

vSignup Remote SQL Injection Vulnerability BugTraq ID: 6606 Remote: Yes Date Published: Jan 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6606 Summary:

vAuthenticate is an authentication script that uses PHP and MySQL. It is available for the Microsoft Windows, Linux, and Unix operating systems.

A vulnerability has been discovered in vSignup. It has been reported that the 'auth.php' fails to sufficiently sanitize user-supplied variables, making various PHP files prone to SQL injection attacks. This may make it possible for an unauthorized to access protected documents. The
'chgpwd.php' and 'admin/index.php' scripts are affected by this issue.

An attacker that is able to access protected web pages may gain sensitive information that may aid in launching further attacks against a target server.

SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

This vulnerability was reported for vSignup 2.1.

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365

20. Psunami Bulletin Board Psunami.CGI Remote Command Execution Vulnerability BugTraq ID: 6607
Remote: Yes
Date Published: Jan 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6607
Summary:

Psunami is bulletin board software. It is implemented in Perl and is available for Unix and Linux variants.

Psunami Bulletin Board is prone to a remote command execution vulnerability. This issue is present in the 'psunami.cgi' script.

Psunami does not sufficiently sanitize shell metacharacters from query strings. Input supplied via the 'topic' URI parameter will be passed to a Perl open() call. As a result, it may be possible for a remote attacker to execute arbitrary commands in the context of the webserver process.

A remote attacker may exploit this condition to gain local, interactive access to the underlying host.

21. D-Link DWL-900AP+ Firmware Upgrade Configuration Reset Vulnerability BugTraq ID: 6609
Remote: Yes
Date Published: Jan 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6609
Summary:

The DWL-900AP+ is a wireless access point manufactured by D-Link which is capable of speeds up to 22Mbps. A vulnerability has been discovered in the DWL-900AP+. The D-Link AirPlus Access Point Manager is used for various adminstrative tasks including firmware upgrades. It has been reported that upgrading the DWL-900AP+ firmware with this software will cause all configuration settings to be reset to factory defaults.

This poses as a security risk as an unknowing user may upgrade there device and leave their device accessible with a publically known adminstrator password.

Do you need help?

22. HTML Forms Generation And Validation Forms.PHP HTML Injection Vulnerability BugTraq ID: 6608
Remote: Yes
Date Published: Jan 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6608
Summary:

The HTML Forms Generation And Validation package is a freely available, open source PHP package. It is written and maintained by Manuel Lemos.

A problem with HTML Forms Generation And Validation could make HTML injection attacks possible.

It has been reported that the forms.php component of HTML Forms Generation And Validation does not properly check input. Because of this, an attacker could potentially launch HTML injection attacks indirectly via form fields.

This may allow for malicious script code to be inadvertently executed in the browser of a user who views pages which include attacker-supplied HTML and script code.

23. Trend Micro OfficeScan CGI Directory Insufficient Permissions Vulnerability BugTraq ID: 6616
Remote: Yes
Date Published: Jan 15 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6616
Summary:

Trend Micro OfficeScan is an enterprise-level centrally managed antivirus solution.

A vulnerability has been reported for Trend Micro OfficeScan that may allow attackers to access programs residing in the cgi directory of the OfficeScan installation.

Do you need more help?

An attacker can exploit this vulnerability by making a request to any programs in the 'cgi' directory by a HTTP request. Some of these programs, such as the 'cgiChkMasterPwd.exe', allow an attacker to access OfficeScan's pages with administrative access. This may allow an attacker to modify or disable OfficeScan functionality.

24. Trend Micro Virus Control System Denial Of Service Vulnerability BugTraq ID: 6617
Remote: Yes
Date Published: Jan 15 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6617
Summary:

Trend Micro Virus Control System (TVCS) is a Web based management system that allows administrators to configure, monitor and maintain anti-virus programs on a network.

A denial of service vulnerability has been reported for TVCS. The vulnerability occurs when numerous requests for 'activesupport.exe' are made.

An attacker can exploit this vulnerability by making a request for the
'/tvcs/activesupport.exe' service. This will result in the web server
failing to respond for a limited period of time. Subsequent requests will ensure that the web server will fail to respond for an indefinite period of time.

This vulnerability has been reported to affect older versions of Trend Micro TVCS. The TVCS system has been replaced by TMCM (Trend Micro Control Manager) which is reportedly not vulnerable to this issue.

25. Trend Micro Virus Control System Information Disclosure Vulnerability BugTraq ID: 6618
Remote: Yes
Date Published: Jan 15 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6618
Summary:

Trend Micro Virus Control System (TVCS) is a Web based management system that allows administrators to configure, monitor and maintain anti-virus programs on a network.

Can we help you?

An information disclosure vulnerability has been reported for TVCS. Reportedly, it is possible for an attacker to access the log files generated by TVCS. The log files contain very sensitive information about the system, including user names and passwords.

Any information obtained in this manner may be used by an attacker to launch further destructive attacks against a system.

III. SECURITYFOCUS NEWS AND COMMENTARY

Rumsfeld orders .mil Web lockdown By Kevin Poulsen

The defense secretary cites an al Qaeda training manual in ordering the armed services to strip official Web sites of information that could aid the enemy.

http://online.securityfocus.com/news/2062

2. MS seeks malware, bust phones after SPV security crack By John Lettice, The Register

A quite bizarre CNET report reveals that Microsoft's Security Response Center began investigations into the circumvention of security on the SPV smartphone on Tuesday, searching - so says CNET, anyway - for reports of rogue programs on the network and damaged phones.

Can't find what you're looking for?

http://online.securityfocus.com/news/2059

3. Discarded computer hard drives prove a trove of personal info By Justin Pope, The Associated Press

So, you think you cleaned all your personal files from that old computer you got rid of? Two graduate students at the Massachusetts Institute of Technology suggest you think again.

http://online.securityfocus.com/news/2055

4. BBC in ironic virus infection
By John Leyden, The Register

The BBC fell victim to the latest variant of the ExploreZip worm, and a certain amount of hubris, last week.

http://online.securityfocus.com/news/2052

IV. SECURITYFOCUS TOP 6 TOOLS

ForceSQL v2.0 by Network Intelligence India Pvt. Ltd. Relevant URL: http://www.nii.co.in/tools.html Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP Summary:

Don't know where to look next?

forceSQL is a password auditing tool for MS SQL Servers. It audits accounts by guessing passwords on SQL Databases. It uses both brute-force and dictionary attacks. It works much faster than other such tools because it bypasses the SQL ODBC API and talks directly to the network layer by constructing its own login packets.

2. SMAC v1.0
by KLC Consulting Security Team
Relevant URL:
http://www.klcconsulting.net/smac/
Platforms: Windows 2000, Windows XP
Summary:

SMAC is a free GUI tool, which allows users to change MAC address for almost any Network Interface Cards (NIC) on the Windows 2000 and XP systems, whether the manufactures allow this option or not.

SMAC does not change the hardware burned-in MAC addresses. It is not necessary. SMAC changes the "software based" MAC addresses on the Windows 2000 & XP systems, and the new MAC addresses you change will sustain from the reboots.

3. Active@ File Recovery v2.0
by Active@ Data Recovery Services
Relevant URL:
http://www.file-recovery.net/
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP Summary:

Active@ File Recovery is a powerful software utility, designed to restore accidentally deleted files and directories. It allows you to recover files that have been deleted from the Recycle Bin, as well as those deleted after avoiding the Recycle Bin (e.g. Shift-Delete).

4. NBTdeputy v1.0
by urity urity@securityfriday.com
Relevant URL:
http://www.securityfriday.com/ToolDownload/NBTdeputy/nbtdeputy_doc.html Platforms: Windows 2000
Summary:

NBTdeputy register a NetBIOS computer name on the network and is ready to respond to NetBT name-query requests. NBTdeputy helps to resolve IP address from NetBIOS computer name. It's similar to Proxy ARP.

Confused? Frustrated?

5. APD v1
by teknop
Relevant URL:
http://apd.sourceforge.net/
Platforms: POSIX
Summary:

APD is an promiscuous node detection tool which uses ARP packets to determine whether or not a host is in promiscuous mode. This project is based of the work of securityfriday.

6. mysql_auth v0.5
by HEGEDUS, Ervin
Relevant URL:
http://people.fsn.hu/~airween/mysql_auth/ Platforms: UNIX
Summary:

mysql_auth is a basic authenticator for Squid Proxy. You can configure all MySQL variables for your existing user/password database (dbhost, dbadmin, dbpasswd, dbname, tablename, columns name), or create a new database. It includes a utility called mypasswd that updates your database.

V. SECURITY JOBS SUMMARY