Pantek Library
Hosting Provided By
CybrHost
High Speed Hosting
Mailing Lists: securityfocus.com > sf-news > 03 > 020014.html (Request Expert securityfocus.com Support)

SecurityFocus Newsletter #183

From: John Boletta <jboletta(at)securityfocus.com>
Date: Mon Feb 10 2003 - 13:41:56 EST

SecurityFocus Newsletter #183

This Issue sponsored by: NetIQ

Security Webcast Featuring Kevin Mitnick

Do you need cost-effective methods to create and implement information security policies to gain control of your enterprises? Join former hacker turned consultant Kevin Mitnick for NetIQ's free webcast-"People & Policies: Turning Your Weakest Security Link into a First Line of Defense."

Register now at:
http://www.netiq.com/f/form/form.asp?id=1696&origin=NSSecFocusCorpNL021103

I. FRONT AND CENTER

  1. SunScreen, Part Two: Policies, Rules, and NAT
  2. The Great IDS Debate : Signature Analysis Versus Protocol Analysis
  3. Smallpot: Tracking the Slapper and Scalper Unix Worms
  4. Lessons From the Slammer
  5. Something Needs to Change
  6. SecurityFocus DPP Program
  7. InfoSec World Conference and Expo/2003(March10-12,2003,Orlando,FL) II. BUGTRAQ SUMMARY
  8. SILC Server SSH2 Authentication Password Persistence Weakness
  9. myphpPageTool Remote File Include Vulnerability
  10. Bladeenc Signed Integer Memory Corruption Vulnerability
  11. phpMyShop compte.php SQL Injection Vulnerability
  12. OpenBSD CHPass Temporary File Link File Content Revealing...
  13. KaZaA Advertisement Response Denial of Service Vulnerability
  14. Microsoft Internet Explorer dragDrop Method Local File Reading...
  15. PHP-Nuke Avatar HTML Injection Vulnerability
  16. PAM pam_xauth Module Unintended X Session Cookie Access...
  17. Opera Cross Domain Scripting Vulnerability
  18. Opera JavaScript Console Attribute Injection Vulnerability
  19. Opera Image Rendering HTML Injection Vulnerability
  20. Majordomo Default Configuration Remote List Subscriber...
  21. Linux O_DIRECT Direct Input/Output Information Leak Vulnerability
  22. ByteCatcher FTP Client Long Server Banner Buffer Overflow...
  23. Electrasoft 32Bit FTP Client Long Server Banner Buffer...
  24. Microsoft Windows 2000 NetBIOS Continuation Packets Kernel...
  25. Microsoft Windows 2000 RPC Service Privilege Escalation...
  26. Epic Games Unreal Engine Memory Consumption Denial Of Service... III. SECURITYFOCUS NEWS ARTICLES
  27. Student charged with massive ID fraud
  28. Spyware found on one in three corporate networks
  29. Discarded computer had confidential medical information
  30. Slammer: Why security benefits from proof of concept code IV. SECURITYFOCUS TOP 6 TOOLS
  31. Login Anomaly Detection System v0.1
  32. WatchLog v0.1b
  33. FieryFilter v0.3
  34. apachelogrotate.pl v0.1.2
  35. GkrellMMS v2.1.8
  36. Logdog v2.0-RC2
  37. SECURITYJOBS LIST SUMMARY
  38. Employment Opportunities with @stake (Thread)
  39. How picky should a security person be in today?s economy? (Thread)
  40. Security and Compliance Paralegal (Thread)
  41. Information Control & Compliance Manager (Thread)
  42. Internet Investigator (Thread)
  43. Network Exploitation Analyst (Thread)
  44. Database Management Specialist (Thread)
  45. Sr. Account Manager - Inside Sales (Thread)
  46. Sr. IA Functional Analyssts - Northern VA/DC (Thread)
  47. Product Sales Professionals (Inside Sales) - Amherst, NY (Thread)
  48. Senior Account Executives - Amherst, NY (Thread)
  49. IL-Windows Security Specialist (Thread)
  50. Senior Project Consultant -Information Security - OH - $80k...
  51. Sydney Opportunities (Thread)
  52. Looking for a Pre/Post Sales position based out of Kentucky...
  53. ezmlm warning (Thread)
  54. Wanted Immediately - Sr. Software Engineer (Thread)
  55. Vulnerability Analyst - looking for work (Thread)
  56. Resume: Web Security Specialist (Thread)
  57. Security Consultant seeking employment in Toronto, Canada...
  58. Need -- Design Engineers -- secure battlefield wireless...
  59. Seeing a Security Architect in Los Angeles (Thread)
  60. Symantec in Redwood City needs a security focused Architect... VI. INCIDENTS LIST SUMMARY
  61. Netbios Name Scans/opaserv worm (Thread)
  62. ALEVRIUS! (Thread)
  63. email address probes (Thread)
  64. Packets from 255.255.255.255(80) (was: Packet from port 80 with...
  65. Packets from 255.255.255.255(80) (was: Packet from port 80 with...
  66. FTP/Port 1038 (Thread)
  67. DoS Attacks, Detecting the Source, and Service Providers (Thread)
  68. Speedera Ping, was "Packets from 255.255.255.255(80), etc."...
  69. Packet from port 80 with spoofed microsoft.com ip (Thread)
  70. More /sumthin, maybe (Thread)
  71. Packets from 255.255.255.255(80) (Thread)
  72. Packets from 255.255.255.255(80) (was: Packet from port 80...
  73. /sumthin Revisited (Thread)
  74. klez variant?? (Thread)
  75. The Spread of the Sapphire/Slammer Worm (Thread)
  76. ZOMBIES_HTTP_GET (Thread)
  77. Fwd: Packets from 255.255.255.255(80) (was: Packet from port...
  78. MSDE contained in... (Thread) VII. VULN-DEV RESEARCH LIST SUMMARY
  79. Fw: f-prot antivirus useless buffer overflow (Thread)
  80. Re[2]: Windows reverse Shell (Thread)
  81. Windows reverse Shell (Thread)
  82. Possible DOS against search engines? (Thread)
  83. slocate vulnerability (Thread)
  84. locator exploit (Thread)
  85. bash 2.05.0(1)-release/it.map.gz Slackware 8.0 default and... VIII. MICROSOFT FOCUS LIST SUMMARY
  86. L0phtCrack and Windows 2000 LM Hashes (Thread)
  87. Customising user rights on win2k Pro (Thread)
  88. Unknown Windows Process (Thread)
  89. Unknown Windows 2000 files? (Thread)
  90. Secure Ldap call not working due to IUSR/IWAM permissions?...
  91. Dynamic Entries in IP Routing Table (Thread)
  92. SecurityFocus Microsoft Newsletter #123 (Thread)
  93. IIS Security using Integrated Windows Authentication (Thread) IX. SUN FOCUS LIST SUMMARY
  94. ezmlm warning (Thread)
  95. LDAP replacing NIS...? (Thread)
  96. LINUX FOCUS LIST SUMMARY
  97. openSSL Key generation (Thread)
  98. ezmlm warning (Thread)
  99. Perl administration for Linux fileserver (Thread)
  100. Secure Web-Based Administration (Thread)
  101. NIS with local root (Thread) XI. SPONSOR INFORMATION
  102. FRONT AND CENTER
  103. SunScreen, Part Two: Policies, Rules, and NAT By Ido Dubrawsky

This is the second of a two-part series looking at SunScreen, Sun Microsystem's firewall product, which provides a variety of features that allow system and network administrators to secure their networks as well as provide for remote access capabilities. This article will cover the some of the rudimentary facilities in SunScreen such as adding and removing rules, setting up a remote management station, and network address translation.

Do you need help?X

http://online.securityfocus.com/infocus/1664

2. The Great IDS Debate : Signature Analysis Versus Protocol Analysis by Matt Tanase

Intrusion detection systems (IDS) have rapidly become a crucial component of any network defense strategy. Over the past few years, their popularity has soared as vendors have refined their results and increased performance capabilities. At the heart of intrusion detection systems lies the analysis engine. It reviews each packet, determines if it is malicious, and logs an alert if necessary &#x2013; the core tasks of an IDS. Two different IDS techniques, each favored by separate and loyal camps, have emerged as the preferred engine behind the software. Despite the copious marketing material and fiery online debates, each method has distinct strengths and weaknesses. In this article, we'll examine and compare the two different techniques: signature analysis and protocol analysis.

http://online.securityfocus.com/infocus/1663

3. Smallpot: Tracking the Slapper and Scalper Unix Worms by Costin Raiu

Fueled by the old myth that "you can't get a virus in Unix" and by the increasing popularity of Linux and FreeBSD, Unix viruses passed an important milestone in 2001 and continued by receiving even more attention during 2002.

http://online.securityfocus.com/infocus/1662

4. Lessons From the Slammer
By Richard Forno

Do you need more help?X

January's Slammer infection held valuable lessons for all security stakeholders.

http://online.securityfocus.com/columnists/140

5. Something Needs to Change
By Tim Mullen

That's all there was to "Slammer," 376 bytes. When you think about it, it's amazing that a piece of code could have wreaked such havoc on the Internet and caused such widespread system failure -- at about the size of two paragraphs of this column.

http://online.securityfocus.com/columnists/139

6. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only global early-warning system for cyber attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

Can we help you?X

7. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)

Optional Workshops March 8, 9, 12, 13, & 14 Vendor Expo March 10 & 11

Solutions to today&#x2019;s security concerns; hands-on experts; blockbuster vendor expo; the CISO Executive Summit; invaluable networking opportunities. InfoSec World has it all!

Go to: http://www.misti.com/10/os03nl37inf.html

II. BUGTRAQ SUMMARY

  1. SILC Server SSH2 Authentication Password Persistence Weakness BugTraq ID: 6743 Remote: No Date Published: Feb 01 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6743 Summary:

SILC (Secure Internet Live Conferencing) is a protocol which provides secure conferencing services in the Internet.

A problem with SILC may allow the recovery of sensitive information.

It has been reported that SILC does not safely handle password information. As a result, a local user may be able to recover authentication passwords.

Can't find what you're looking for?X

The problem is in the handling of authentication passwords after authentication has been negotiated. Correct behavior of such applications is to remove passwords from memory immediately after authentication has occurred. However, SILC retains password information in memory, which may result in recovery by another user with sufficient privileges. In addition to being present in process memory space, this information may also be retrieved from memory dumps of processes.

2. myphpPageTool Remote File Include Vulnerability BugTraq ID: 6744
Remote: Yes
Date Published: Feb 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6744
Summary:

myphpPagetool is an application used to maintain a web site using a mysql database, which stores and manage all web pages and their contents. myphpPagetool is written in PHP and is available for a variety of platforms.

myphpPageTool is prone to an issue which may allow remote attackers to include files located on remote servers. This issue is present in the index.php, help1.php, help2.php, help3.php, help4.php, help5.php, help6.php, help7.php, help8.php and help9.php pages existing in the /doc/admin folder.

Under some circumstances, it is possible for remote attackers to influence the include path for 'pt_config.inc' to point to an external file on a remote server by manipulating the $ptinclude URI parameter.

If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the webserver.

This vulnerability was reported for myphpPageTool 0.43-1. It is not known whether other versions are affected.

3. Bladeenc Signed Integer Memory Corruption Vulnerability BugTraq ID: 6745
Remote: No
Date Published: Feb 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6745
Summary:

Don't know where to look next?X

Bladeenc is an open-source MP3 encoder and is available for a variety of platforms including Microsoft Windows and Linux and Unix variant operating systems.

A memory corruption vulnerability has been reported for Bladeenc. Bladeenc encodes WAV files in 'chunks' of data. The vulnerability exists when Bladeenc is seeking a WAV file chunk. Specifically, in the function __myfseek() in the samplein.c source file, an integer value is not properly verified. When this function is given a negative value, it will result in the corruption of sensitive areas of memory with attacker-supplied values.

An attacker can exploit this vulnerability by creating a malicious WAV file with carefully crafted headers that will cause Bladeenc to execute malicious attacker-supplied code.

This vulnerability was reported for Bladeenc 0.94.2 and earlier.

4. phpMyShop compte.php SQL Injection Vulnerability BugTraq ID: 6746
Remote: Yes
Date Published: Feb 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6746
Summary:

phpMyShop is an application written in PHP that makes it possible to manage a web based electronic shop.

phpMyShop, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries. As a result, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries. This may result in unauthorized operations being performed on the underlying database.

This vulnerability was reported to exist in the compte.php script file distributed with phpMyShop. A remote attacker may exploit this vulnerability to bypass the authentication/registration process used by phpMyShop sites.

Confused? Frustrated?X

SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

This vulnerability was reported for phpMyShop 1.00. It is not known whether other versions are affected.

5. OpenBSD CHPass Temporary File Link File Content Revealing Vulnerability BugTraq ID: 6748
Remote: No
Date Published: Feb 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6748
Summary:

OpenBSD is a freely available version of the BSD Unix operating system.

A problem in OpenBSD may result in the disclosure of the contents of specific files.

It has been reported that a vulnerability in chpass may allow local users to gain access to the content of specific files. This vulnerability requires that lines in the target file be constructed in a specific format. The issue also affects the chfn and chsh programs which are hard links to the chpass binary.

While chpass executes, it is possible for a user to halt the executing process by sending a SIGSTOP signal to the process via the shell. While the process is stopped, it is possible for the user to manipulate the temporary file created by the process, and change the file to a symbolic link to an arbitrary file. When the process resumes execution, it will read the content of the linked file. Since the chpass program is a setuid root executable, this may result in the display of some lines contained in the file to standard output.

This could allow a local user to read the contents of restricted files, and may result in further attack against the vulnerable system.

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365X

6. KaZaA Advertisement Response Denial of Service Vulnerability BugTraq ID: 6747
Remote: Yes
Date Published: Feb 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6747
Summary:

KaZaA Media Desktop is a peer to peer file sharing utility. KaZaA is available for the Microsoft Windows operating system.

When KaZaA clients make a connection to a file sharing server, a request is made for an advertisement (*ad*) download. A vulnerability has been discovered in KaZaA clients when receiving unexpected responses to *ad* requests. When the susceptible KaZaA client attempts to process the response, the client will crash. This condition likely occurs due to client assuming various attributes of the response. Computing values assumed to exist in a response, which may not be in an expected format, may cause the client to behave in an unpredictable manner.

This issue could be exploited by an attacker to cause a denial of service against KaZaA clients. The denial of service may also be triggered by a filter configured to reject various web requests.

Although not yet confirmed, it has been reported that this issue may be exploited to execute arbitrary instructions within the context of the target client process.

7. Microsoft Internet Explorer dragDrop Method Local File Reading Vulnerability BugTraq ID: 6749
Remote: Yes
Date Published: Feb 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6749
Summary:

Microsoft Internet Explorer 5.5 and higher contain the ActiveX method dragDrop() that allows HTML elements to be dragged and dropped on a web page.

The dragDrop() method can be used by a maliciously crafted web page to read local files from an Internet Explorer user's local drive.

Do you need help?X

If a web page is constructed containing a script element utilizing the dragDrop() method and properly obfuscated, users can be tricked into uploading a local file to the malicious webserver.

This can typically be achieved by constructing a Javascript element appearing to be a hyperlink that actually contains elements to drop text, such as a file name, into an HTML upload control using the dragDrop() method. The local file name must be known in order for the attack to succeed, however, relative paths may be used. The user must also perform another action, such as clicking on a button, in order to trigger the file upload.

8. PHP-Nuke Avatar HTML Injection Vulnerability BugTraq ID: 6750
Remote: Yes
Date Published: Feb 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6750
Summary:

PHP-Nuke is a web-based portal system. Implemented in PHP, it is available for a range of systems, including Unix, Linux, and Microsoft Windows.

A vulnerability has been reported in PHP-Nuke that may result in HTML injection. The vulnerability occurs because PHP-Nuke does not sanitize some user-supplied input submitted to a site when selecting 'avatar' images. Due to this condition, a malicious user may be able to insert malicious HTML code which will then be displayed to unsuspecting users of PHP-Nuke forums. Any attacker-supplied code will be interpreted in a victim user's web browser in the security context of the site hosting the software.

It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. It is also possible to modify or corrupt other user's Avatars. Other attacks are also possible.

This vulnerability was reported for PHP-Nuke 6.0 and earlier.

9. PAM pam_xauth Module Unintended X Session Cookie Access Vulnerability BugTraq ID: 6753
Remote: No
Date Published: Feb 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6753
Summary:

Do you need more help?X

Pluggable Authentication Modules (PAM) is shipped with RedHat Linux 8.0 and earlier, by default. PAM comes with the pam_xauth module which can be used in conjuction with the su utility to pass X MIT-Magic-Cookies to newly created sessions.

A vulnerability has been discovered when the pam_xauth module is used in conjunction with the su utility within an X session. When a user (user1) runs the su utility to assume the identity of another user (user2), pam_xauth will create a temporary .xauth cookie file located in the assumed users (user2) home directory. The file is created with read-write only permissions for the assumed user and contains sensitive information regarding the suing users X session.

This poses a security risk when a user (user1) runs the su utility to assume the identity of another user. The real user (user2) is able to read the contents of the cookie file. The vulnerability lies in the fact that the cookie file contains sensitive information pertaining to the suing users X session. This issue could be exploited by the real user (user2) to connect to the X server with the credentials of the suing user (user1).

Accessing another users X session may allow an attacker to obtain sensitive information otherwise restricted. It may also grant the ability to run commands with the privileges of the victim user.

This vulnerability could result in elevated privileges in the event that a higher privileged user made use of the su program to log into the account of a lower-privileged user. The lower-privileged user could exploit this issue to gain administrative access to the local system.

It has been reported that this issue does not affect RedHat 7.0.

  1. Opera Cross Domain Scripting Vulnerability BugTraq ID: 6754 Remote: Yes Date Published: Feb 04 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6754 Summary:

Opera is a web client available for a number of platforms, including Microsoft Windows, Linux and Unix variants and Apple MacOS.

A vulnerability has been reported reported for Opera 7 browsers for Microsoft Windows operating systems.

Can we help you?X

Due to flaws in Opera, it is possible for functions in different domains to be accessed and executed by an attacker with the credentials of the victim user. This vulnerability is also exacerbated by the fact that an attacker may also be able to override properties and methods in other windows to create malicious methods that can be accessed by a victim user.

Exploitation of this vulnerability will allow an attacker to obtain access to local resources on a vulnerable system.

This issue may be similar to the ones described in BID 6184.

These vulnerabilities were reported for Opera 7 browser for Microsoft Windows.

  1. Opera JavaScript Console Attribute Injection Vulnerability BugTraq ID: 6755 Remote: Yes Date Published: Feb 04 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6755 Summary:

Opera is a web client available for a number of platforms, including Microsoft Windows, Linux and Unix variants and Apple MacOS.

A vulnerability has been reported for Opera 7 browsers for Microsoft Windows operating systems. The vulnerability exists in Opera's JavaScript console program. The console program consists of three HTML files, one of which is 'console.html'. Any unhandled exceptions thrown by any JavaScript are listed in the console and are converted into clickable links.

The vulnerability exists in the regular expressions used by 'console.html' to format exception messages. Specifically, exception messages are not parsed for quote characters. It is possible, by inserting quote (") characters, to add additional attributes to URLs that may make it possible to execute arbitrary attacker-supplied script code in the file:// protocol context. This may lead to disclosure of local file contents to remote attackers.

This vulnerability was reported for Opera 7 browser for Microsoft Windows.

  1. Opera History Object Information Disclosure Weakness BugTraq ID: 6757 Remote: Yes Date Published: Feb 04 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6757 Summary:
Can't find what you're looking for?X

Opera is a web client available for a number of platforms, including Microsoft Windows, Linux and Unix variants and Apple MacOS.

An information disclosure weakness has been reported for Opera 7 browsers on the Microsoft Windows platform.

The weakness is due to the way the history object exposes some properties. Specifically, the properties history.next and history.previous are exposed.

A vulnerable user, when navigating to a malicious website, may have some information pertaining to browser history logged by the site. This information can be used by Web masters for, potentially, malicious purposes.

This vulnerability was reported for Opera 7 browser for Microsoft Windows.

  1. Opera Image Rendering HTML Injection Vulnerability BugTraq ID: 6756 Remote: Yes Date Published: Feb 04 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6756 Summary:

Opera is a web client available for a number of platforms, including Microsoft Windows, Linux, Unix variants and Apple MacOS.

Problems with Opera could make it possible to execute arbitrary HTML code in a vulnerable client.

It has been reported that, when generating HTML to display images or embedded media, Opera does not correctly format the provided URL or sufficiently encode local URLs. Specifically, URLs that use the 'file://' protocol to access local files are not sufficiently sanitized of malicious HTML code.

Don't know where to look next?X

This vulnerability could allow an attacker to inject malicious HTML code to an unsuspecting user of Opera, through a malformed link. Any code will be executed in the security context of the local Opera User.

Successful exploitation of this vulnerability may result in the disclosure of local file contents to remote attackers. Other attacks are possible.

This vulnerability was reported for Opera 7 browser for Microsoft Windows.

  1. IBM WebSphere Exported XML Password Encoding Weakness BugTraq ID: 6758 Remote: No Date Published: Feb 03 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6758 Summary:

IBM WebSphere is a commercial web application server which runs on a number of platforms including Linux and Unix variants and Microsoft Windows operating environments.

IBM WebSphere allows administrators to export configuration files to XML. When the WebSphere configuration file is exported in this manner, passwords are obfuscated using an easily reversible algorithm.

The algorithm used to obfuscate the password is as follows:

CHARobfuscated(n) = CHARpassword(n) XOR CHAR("_")

where n is the position of the character.

Confused? Frustrated?X

The obfuscated password is then Base64 encoded.

If an attacker gains access to an exported XML configuration file, it is a trivial task to decode the password.

To exploit this weakness, an administrator must first export the configuration to XML and then the attacker may gain unauthorized access to the exported file.

The WebSphere documentation states that exported configurations will contain encoded (and not encrypted) passwords. Administrators should be cautious when exporting configuration files.

This issue was reported in IBM WebSphere Advanced Server Edition 4.0.4. It is not known if the same encoding is used in other versions. Though the core weakness is that passwords are encoded and may be easier to reverse than if encrypted using a strong algorithm, so all current versions should be considered prone to this weakness to some degree.

  1. Majordomo Default Configuration Remote List Subscriber Disclosure Vulnerability BugTraq ID: 6761 Remote: Yes Date Published: Feb 04 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6761 Summary:

Majordomo is a freely available, open source mailing list management software package. It is available for Unix, Linux, and Microsoft Windows platforms.

A problem with Majordomo may allow remote users to gain access to sensitive information.

It has been reported that Majordomo does not sufficiently guard list subscriber information. By sending specific commands to a default implementation, a remote user may be able to gain access to the list of mailing list subscribers. This issue is documented in the Majordomo documentation.

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365X

The problem is in the default configuration of the mailing list manager. The software does not place sufficient access controls on the ability of users to execute the which command. By sending the command "which @", remote users may be able to list the entire member base of the list, resulting in a loss of privacy.

It should be noted that in the Majordomo 2 branch, this vulnerability is limited to gaining access to one address per submission per list.

  1. Opera Error Message History Disclosure Weakness BugTraq ID: 6759 Remote: Yes Date Published: Feb 04 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6759 Summary:

Opera is a web client available for a number of platforms, including Microsoft Windows, Linux, Unix variants and Apple MacOS.

The Opera console is used to keep a track of any JavaScript error messages that may have occured when browsing a Web site.

It has been reported that Opera fails to ensure that a remote site has proper authorization before executing some methods used to access error messages stored in the Opera console. Specifically, Opera does not validate any requests for the opera.errorIndex() and opera.errorMessage(i) methods.

This issue is further exacerbated by the fact that error messages also contain the URL of the site that caused the issue. This can be exploited by a malicious attacker to obtain a listing of the victim user's Web browsing habits for, potentially, malicious purposes.

This vulnerability was reported for Opera 7 browser for Microsoft Windows.

  1. Linux O_DIRECT Direct Input/Output Information Leak Vulnerability BugTraq ID: 6763 Remote: No Date Published: Feb 04 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6763 Summary:

The Linux Kernel is the core of the Linux operating system. It is distributed by various Linux distributions.

Do you need help?X

A problem with the O_DIRECT flag could make it possible for local users to gain access to potentially sensitive information.

It has been reported that some Linux Kernels do not properly handle O_DIRECT, which is used for direct input and output. Any user with system write privileges may be able to read limited information from other files.

This problem could allow a local user to read limited data from current files, and may be able to read data from previously deleted files. The ability of an attacker to exploit this issue at will is not known. Additionally, exploitation could result in minor corruption of the file system, which would require repair with the fsck utility.

It should be noted that this vulnerability can not be exploited on systems using a vulnerable kernel and the EXT3 file system.

  1. ByteCatcher FTP Client Long Server Banner Buffer Overflow Vulnerabiliity BugTraq ID: 6762 Remote: Yes Date Published: Feb 04 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6762 Summary:

Save-It Sotwares ByteCatcher is an FTP client for Microsoft Windows that lets you resume downloads.

It has been reported that a memory corruption bug exists in ByteCatcher FTP client. Under some circumstances, when the client connects to a malicious FTP server, it may be possible for the server to trigger a boundary condition error.

This issue is due to insufficient bounds check of FTP banners. When the FTP client receives an FTP banner that contains an excessive ammount of data it becomes unstable. It has been reported that this vulnerability can be reproduced by sending an FTP banner of 4096 bytes or more to a vulnerable client, which may cause sensitive regions of memory to be corrupted with attacker-supplied values.

It is possible that this vulnerability is an exploitable buffer overflow, and could result in the execution of attacker-supplied code. Any code executed would be in the security context of the FTP client process.

  1. Electrasoft 32Bit FTP Client Long Server Banner Buffer Overflow Vulnerabiliity BugTraq ID: 6764 Remote: Yes Date Published: Feb 04 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/6764 Summary:
Do you need more help?X

Electrasoft 32Bit FTP is a light weight FTP client application for Micorsoft Windows.

This issue is due to insufficient bounds check of FTP banners. When the FTP client receives an FTP banner that contains an excessive ammount of data it becomes unstable. It has been reported that this vulnerability can be reproduced by sending an FTP banner of 4096 bytes or more to a vulnerable client, which may cause sensitive regions of memory to be corrupted with attacker-supplied values.

It is possible that this vulnerability is an exploitable buffer overflow, and could result in the execution of attacker-supplied code. Any code executed would be in the security context of the FTP client process.

20. Microsoft Windows 2000 NetBIOS Continuation Packets Kernel Memory Leak Vulnerability BugTraq ID: 6766
Remote: Yes
Date Published: Feb 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6766
Summary:

Microsoft Windows 2000 is reported to be prone to a denial of service when handling NetBIOS continuation packets.

NetBIOS continuation packets are normally generated when a SMB message is split across a number of packets. Under some circumstances, when these packets are handled by the server, a kernel memory leak with occur.

This may result in a failure to service SMB requests, which will cause a denial of service.

21. Microsoft Windows 2000 RPC Service Privilege Escalation Vulnerability BugTraq ID: 6769
Remote: No
Date Published: Feb 04 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6769
Summary:

Can we help you?X

Microsoft Windows 2000 uses Remote Procedure Calls (RPC) for client-server communications in a distributed computing environment (DCE). TCP Port 135 is typically used for DCE endpoint resolution.

A vulnerability was previously reported which causes a denial of service against the DCE-RPC endpoint mapper (BID 6005). If a system service crashes as a result of this denial of service, there is a possibility that it will orphan a named pipe.

This named pipe could then be hijacked by a malicious user in order to escalate their privilege level on the system when a privileged process attempts to connect to the orphaned pipe. This could result in a complete system level compromise.

22. Epic Games Unreal Engine Memory Consumption Denial Of Service Vulnerability BugTraq ID: 6770
Remote: Yes
Date Published: Feb 05 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6770
Summary:

Epic Games' Unreal Engine is a 3D game engine used by Unreal and many other games.

A memory exhaustion vulnerability has been reported for several games using some versions of the Unreal Engine.

The Unreal Engine includes a facility to provide networked gaming to its users and uses a method known as 'Compact Indices' in an attempt to save some network bandwidth. Unreal Engine allocates memory based on the index value included in client-supplied packets. Due to inconsistent interpretation of integers, it is possible for attackers to cause the server to allocate large amounts of memory by sending a packet with a negative index value.

This likely occurs due to maximum index checks being performed on the index value as a signed integer.

Can't find what you're looking for?X

There are currently no fixes available.

III. SECURITYFOCUS NEWS AND COMMENTARY

  1. Student charged with massive ID fraud By John Leyden, The Register

A former student has been charged with installing secret keystroke monitoring software on "dozens of computers" on the Boston College campus to harvest personal data on thousands of University computer users.

http://online.securityfocus.com/news/2283

2. Spyware found on one in three corporate networks By John Leyden, The Register

One in three European companies are harbouring spyware apps on their networks, a new study claims.

http://online.securityfocus.com/news/2282

3. Discarded computer had confidential medical information By Charles Wolfe, The Associated Press

Don't know where to look next?X

A state computer put up for sale as surplus contained confidential files naming thousands of people with AIDS and other sexually transmitted diseases, the state auditor said Thursday.

http://online.securityfocus.com/news/2274

4. Slammer: Why security benefits from proof of concept code By John Leyden, The Register

The UK security expert who discovered the flaw which was exploited by the Slammer worm has concluded it does more good than harm to publish proof of concept code.

http://online.securityfocus.com/news/2268

IV. SECURITY FOCUS TOP 6 TOOLS

  1. Login Anomaly Detection System v0.1 by Fred Relevant URL: http://www.lepied.com/lads/ Platforms: Python Summary:

The Login Anomaly Detection System (LADS) detects anomalies in logins and logouts and is able to perform various actions in response.

2. WatchLog v0.1b
by Brian Shellabarger
Relevant URL:
http://www.glug.com/projects/WatchLog/
Platforms: Linux, POSIX, UNIX
Summary:

Confused? Frustrated?X

WatchLog is a Perl program designed to give users a better real-time view of their Web traffic. Simply doing a 'tail -f' on the server log file often yields confusing results as you can be bombarded with scrolling with a single hit. WatchLog attempts to present the same information in a clean, formatted, real time view of the activity on a Website by watching the logfile and presenting only the relevant data.

3. FieryFilter v0.3
by Mezcalero
Relevant URL:
http://www.stud.uni-hamburg.de/users/lennart/projects/fieryfilter/ Platforms: Linux
Summary:

FieryFilter is an interactive desktop firewall for Linux. It will ask the user every time a new network connection is made if they want to allow or deny it. The user is able to generate rules from connections and thus minimize the amount of questions asked.

4. apachelogrotate.pl v0.1.2
by Hatto von Hatzfeld
Relevant URL:
http://www.salesianer.de/util/apachelog.html Platforms: Linux, UNIX
Summary:

apachelogrotate.pl rotates and packs the logfiles of the Apache Web server on a Linux system without interrupting its service and without the need for a permanent change in the Web server configuration. Assuming that Apache is running, it will identify the log files which have to be rotated without any configuration, making it easy to install. By default, logfiles with more than 10 MB are rotated, but this parameter may be changed and/or a daily, monthly, or yearly rotation period can be configured. Documentation is included in the script itself.

5. GkrellMMS v2.1.8
by Sjoerd Simons sjoerd@luon.net
Relevant URL:
http://gkrellm.luon.net/gkrellmms.phtml
Platforms: Linux, POSIX
Summary:

GkrellMMS is a plugin for controlling XMMS from within GKrellM.

6. Logdog v2.0-RC2
by Brandon Zehm
Relevant uRL:
http://caspian.dotconf.net/menu/Software/LogDog/ Platforms: Linux
Summary:

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365X

LogDog monitors messages passing through syslogd and takes actions based on key words and phrases (which can be regular expressions). It has a configuration file which allows you to specify a list of key words or phrases to alert on and a list of commands that can be run when those words are encountered.

V. SECURITY JOBS SUMMARY

  1. Employment Opportunities with @stake (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310848

2. How picky should a security person be in today?s economy? (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310847

3. Security and Compliance Paralegal (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310575

4. Information Control & Compliance Manager (Thread) Relevant URL:

Do you need help?X

http://online.securityfocus.com/archive/77/310561

5. Internet Investigator (Thread)
Relevant URL:

http://online.securityfocus.com/archive/77/310562

6. Network Exploitation Analyst (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310543

7. Database Management Specialist (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310532

8. Sr. Account Manager - Inside Sales (Thread) Relevant URL:

Do you need more help?X

http://online.securityfocus.com/archive/77/310495

9. Sr. IA Functional Analyssts - Northern VA/DC (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310455

  1. Product Sales Professionals (Inside Sales) - Amherst, NY (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310238

  1. Senior Account Executives - Amherst, NY (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310233

  1. IL-Windows Security Specialist (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310206

  1. Senior Project Consultant -Information Security - OH - $80k (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310155

  1. Sydney Opportunities (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/310099

  1. Looking for a Pre/Post Sales position based out of Kentucky ....willing to travel. (Thread) Relevant URL:
Can we help you?X

http://online.securityfocus.com/archive/77/310017

  1. ezmlm warning (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/309855

  1. Wanted Immediately - Sr. Software Engineer (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/309967

  1. Vulnerability Analyst - looking for work (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/309697

  1. Resume: Web Security Specialist (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/309658

20. Security Consultant seeking employment in Toronto, Canada (Thread) Relevant URL:

http://online.securityfocus.com/archive/77/309657

21. Need -- Design Engineers -- secure battlefield wireless communications systems (Thread) Relevant URL:

Can't find what you're looking for?X