Hosting Provided By

SecurityFocus Newsletter #207

From: John Boletta <jboletta(at)securityfocus.com>
Date: Mon Jul 28 2003 - 16:43:28 EDT

('binary' encoding is not supported, stored as-is)

This Issue is Sponsored by: SPI Dynamics

ALERT:
"How a Hacker Launches a LDAP Injection Attack Step-by-Step" - White Paper
It's as simple as placing additional LDAP query commands into a Web form input box giving hackers complete access to all your backend systems! Firewalls and IDS will not stop such attacks because LDAP Injections are seen as valid data.

Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!
http://www.securityfocus.com/SPIDynamics-sf-news4

I. FRONT AND CENTER

"Copying is Theft ..."
Demonstrating ROI for Penetration Testing (Part One)
Detecting SQL Injection in Oracle II. BUGTRAQ SUMMARY
Witango Server Remote Cookie Buffer Overflow Vulnerability
RAV AntiVirus Online Virus Scan RavonLine.DLL ActiveX Control...
Apache HTTP Server Multiple Vulnerabilities
SimpNews PATH_SIMPNEWS Remote File Include Vulnerability
GnuPG Group Root File Corruption Vulnerability
CGI.pm Start_Form Cross-Site Scripting Vulnerability
GNU GNATS Queue-PR Database Command Line Option Buffer Overflow...
Multiple Linux 2.4 Kernel Vulnerabilities
Microsoft Windows 2000 RPC DCOM Interface Denial of Service...
Drupal Cross-Site Scripting Vulnerability
AtomicBoard Directory Traversal Vulnerability
WebCalendar Local File Include Information Disclosure...
SCO OpenServer Display Local Privilege Escalation Vulnerability
SurfControl E-Mail Filter For SMTP Nested Zip File Filter...
Top Home Environment Variable Local Buffer Overflow Vulnerability
Ashnews Remote File Include Vulnerability
Savant Web Server CGITest.HTML Cross Site Scripting Vulnerability
Multiple Savant Web Server Denial Of Service Vulnerabilities
Microsoft Multiple IIS 6.0 Web Admin Vulnerabilities
MySQL AB ODBC Driver Plain Text Password Vulnerability
FDClone Local Insecure Temporary Directory Creation Vulnerability
Sun Solaris IPv6 Packet Denial of Service Vulnerability
3Com DSL Router Administrative Interface Long Request Router...
Sun Solaris automountd Denial of Service Vulnerability
Novell Netware Enterprise Web Server CGI2Perl.NLM Buffer... III. SECURITYFOCUS NEWS ARTICLES
The Hackers Who Broke Windows
Guilty Plea in Kinko's Keystroke Caper
Study finds computer voting system widely vulnerable to tampering
Online Identity-Theft Tactic Targeted IV. SECURITYFOCUS TOP 6 TOOLS
Rate v0.81
Enigmail v0.81.0
Crash Core Analysis Suite v3.6-0.3
Ethereal v0.9.14
The SpamBouncer v1.5-Jul22
Gherkin v0.2.3
SECURITYJOBS LIST SUMMARY
Looking for a Security position (Thread)
Data Security/Audit Specialist- Chicago (Thread)
Looking for junior to mid level position - new and improved...
Penetration Testers Required; London UK. (Thread)
Common Criteria Evaluators - urgently required (Thread)
Looking for Security Work (Thread)
Risk / Security Management position sought (Thread)
Sr. Software/Embedded Systems Eng. (Thread)
Looking for a Job in Athens, Greece.??? (Thread)
VP of Marketing & Product Marketing Manager needed in Boston...
Security Research Support Engineer for TENABLE NETWORK...
Windows and Web interface GUI developer for TENABLE NETWORK...
Security Sales Account Executive position for TENABLE NETWORK...
Principal Intelligence Analyst vacancy (Thread)
CHIPSET SECURITY ARCHITECT - San Jose, CA (Thread)
Risk Management Analyst needed, Twin Cities (Thread)
seeking job in Sydney,Australia (Thread)
Seeking infosec opportunity (Thread)
Firewall support needed in Richmond, VA (Thread)
Secuity Software Sales Openings (Thread)
2 Security Sales Opportunities in the Bay Area (Thread)
7 Security Sales Opportunities in the Mid Atlantic (Thread)
7 Security Sales Opportunities in the North East (Thread)
6 Security Sales Opportunities in the Mid West (Thread)
JOB OPENING: Certification & Accreditation Security...
Promotionsstelle am Institut fuer Informatik und Gesellschaft...
Software Architect - Security (Thread)
Question about opportunities for Americans outside the US...
VOLUNTEER WORK (Thread)
JOB OPENING: Enterprise Security Architect (Thread)
Top Secret Cleared Security Professionals Wanted (Thread)
Security Software Engineer (Thread) VI. INCIDENTS LIST SUMMARY
Port 0 packets (Thread)
New worm in Japan? (Thread)
Scan of TCP 552-554 (Thread)
[Full-Disclosure] Cisco IOS Denial of Service thataffects...
[Full-Disclosure] Cisco IOS Denial of Service that affects...
First time security issue. (Thread)
New SecurityFocus Articles (2) (Thread)
Cisco IOS Denial of Service that affects most Cisco IOS...
Importance of outbound traffic filtering (Thread)
Cisco IOS Denial of Service that affects most Cisco IOS...
Windows XP Guest Account. (Thread)
Cisco 0-day? [Was: strange protocol scans (and MOBP plug)]...
Cisco IOS vulnerability (Thread)
strange protocol scans (and MOBP plug) (Thread)
Strange DoS / new halflife server bug? (Update) (Thread)
Need some help and guidance, please.... TROJAN: Symantec: New...
Cisco ISO vul patch for packit 0.6.0c (Thread)
RES: Cisco IOS vulnerability (Thread)
Strange 4 MB Emails (Thread)
DOS / gameservers (Thread)
Cisco IOS Denial of Service that affects most Cisco IOS...
Strange domain-udp signature (Thread) VII. VULN-DEV RESEARCH LIST SUMMARY
Shellcoding ... again. (Thread)
Does IE object type overflow work only on an Administrator...
Anyone looked at the canary stack protection in Win2k3? (Thread) VIII. MICROSOFT FOCUS LIST SUMMARY
Tracking down a user in a large AD network (Thread)
SecurityFocus Microsoft Newsletter #146 (Thread)
plugging old IIS FTP holes (Thread)
Article Announcement: Waiting for the Worms (Thread)
Article Announcement: Forensic Log Parsing with Microsoft's...
Biometric fingerprint scanner (Thread) IX. SUN FOCUS LIST SUMMARY 1.NO NEW POSTS FOR THE WEEK ENDING 07.25.03
LINUX FOCUS LIST SUMMARY 1.NO NEW POSTS FOR THE WEEK ENDING 07.25.03 XI. SPONSOR INFORMATION
FRONT AND CENTER
"Copying is Theft ..." By Mark Rasch

And other legal myths in the looming battle over peer-to-peer.

http://www.securityfocus.com/columnists/175

2. Demonstrating ROI for Penetration Testing (Part One) By Marcia Wilson

Do you need help?

This is the first in a series of articles demonstrating ROI (return on investment) for a penetration test. You will have to step into the world of budgeting, cost justification, resource allocation, and learn a few unfamiliar terms.

http://www.securityfocus.com/infocus/1715

3. Detecting SQL Injection in Oracle
By Pete Finnigan

This paper takes the subject of SQL injection further and investigates the possibilities for the Oracle Database Administrator to detect SQL injection in the wild.

http://www.securityfocus.com/infocus/1714

II. BUGTRAQ SUMMARY

Witango Server Remote Cookie Buffer Overflow Vulnerability BugTraq ID: 8224 Remote: Yes Date Published: Jul 18 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8224 Summary:

Witango Server is a rapid application development tool designed for Web applications.

Because Witango does not properly perform bounds checking on variables read from cookies, it may be possible to supply an excessively long value to overrun an internal buffer stored on the stack. Specifically, if an attacker sends an HTTP request to the Witango Server containing a cookie with the Witango_UserReference variable set to a value exceeding approximately 2864 bytes in length, the buffer overflow condition will be triggered. Execution of arbitrary code may be possible, as attackers may corrupt a saved instruction pointer residing in adjacent stack memory.

Do you need more help?

It should be noted that Witango Server must be installed with the privileges of LocalSystem, and as a result, a complete compromise is feasible by exploiting this vulnerability.

2. RAV AntiVirus Online Virus Scan RavonLine.DLL ActiveX Control Buffer Overflow Vulnerability
BugTraq ID: 8225
Remote: Yes
Date Published: Jul 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8225
Summary:

ravonline.dll is a linked library distributed as part of the ActiveX control for the RAV AntiVirus Online Virus Scan service.

ravonline.dll has been reported prone to a buffer overflow vulnerability. The issue reportedly presents itself when excessive data is passed to the browseForFolder() function.

It has been conjectured that this issue could potentially lead to the execution of code with the privileges of the user executing the web browser. This problem requires that a user with the vulnerable control installed visit a web page that invokes the control in a manner sufficient to trigger the issue. Upon doing so, it may be possible to create a remotely exploitable stack overflow condition that results in the overwriting of sensitive process memory. This, however, has not been confirmed.

Although unconfirmed, because the function browseForFolder() is reportedly imported from Shell32.dll, this issue may actually present itself in Microsoft Windows native Shell32.dll library.

It should be noted, that ActiveX controls by nature might contain latent vulnerabilities. Caution should be employed if installing ActiveX controls.

3. Apache HTTP Server Multiple Vulnerabilities BugTraq ID: 8226
Remote: Yes
Date Published: Jul 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8226
Summary:

Can we help you?

Apache HTTP Server is a open-source web server designed to run on a number of different platforms.

Apache HTTP Server version 1.3.28 has been released in response to multiple vulnerabilities discovered. Apache is vulnerable to three potential security issues. The impact of these vulnerabilities includes denial of service, file descriptor leakage, and logging failures.

Under Windows and OS/2 systems, it may be possible to cause Apache to send special control characters, namely a 0x1A character, over a pipe. This could potentially cause Apache to cease logging and exit.

It has also been reported that attackers may be able to send specially crafted requests that cause Apache to go into an internal loop and eventually crash.

Additionally, Apache may under certain circumstances leak file descriptors from a parent process to a child process. This could result in varying degrees of unauthorized access.

Multiple BIDs are currently pending for these issues. When individual BIDs are available, this BID will be retired.

4. SimpNews PATH_SIMPNEWS Remote File Include Vulnerability BugTraq ID: 8227
Remote: Yes
Date Published: Jul 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8227
Summary:

SimpNews is a web news system implemented in PHP. It is available for Unix/Linux variants and Microsoft Windows operating systems.

Can't find what you're looking for?

SimpNews is prone to a vulnerability that may permit remote attackers to include and execute malicious PHP scripts. Remote users, under some PHP configurations, may influence the $path_simpnews URI variable. This variable is used in the include path for the 'config.php', 'functions.php' and 'includes/has_entries.inc' scripts. By influencing the include path so that it points to a malicious PHP script on a remote system, it is possible to cause arbitrary PHP code to be executed. This would occur in the context of the web server. This issue exists in both the 'eventcal2.php' and 'eventscroller.php' scripts.

This could be exploited to execute malicious PHP commands in the context of the web server process.

It should be noted that although SimpNews versions 2.01 through 2.13 have been reported vulnerable, other versions might also be affected.

5. GnuPG Group Root File Corruption Vulnerability BugTraq ID: 8228
Remote: No
Date Published: Jul 19 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8228
Summary:

gnupg is an encryption utility that is available for a number of platforms, including Unix/Linux variants.

gnupg is reported to be prone to an issue that could permit a malicious local user to corrupt files owned by the root group. This issue is reportedly the result of gnupg having setgid root privileges. The issue was reported for Gentoo Linux, though other distributions may have a similar default installation and be prone to this issue.

This vulnerability may potentially be exploited to corrupt critical or sensitive files for a denial of service. The possibility of privilege escalation also exists.

6. CGI.pm Start_Form Cross-Site Scripting Vulnerability BugTraq ID: 8231
Remote: Yes
Date Published: Jul 20 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8231
Summary:

Don't know where to look next?

CGI.pm is a module for Perl that allows for dynamic creation of web forms and parsing of CGI input.

CGI.pm is prone to cross-site scripting attacks under some circumstances. This issue occurs because the start_form() function (or other functions which use this function such as start_multipart_form()) does not sufficiently sanitize HTML and script code when a form action is not specified. This could expose scripts that use the function to cross-site scripting attacks.

This issue could be exploited to cause hostile HTML and script code to be rendered in the browser of a user who is enticed to visit a malicious link to a vulnerable script. The code would be interpreted in the context of the vulnerable site. Exploitation could allow theft of cookie-based authentication credentials or other attacks.

7. GNU GNATS Queue-PR Database Command Line Option Buffer Overflow Vulnerability
BugTraq ID: 8232
Remote: No
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8232
Summary:

GNU GNATS is a freely available bug tracking system. It is available for a variety of Linux and Unix variant operating environments.

The queue-pr utility is shipped as part of GNATS and is intended as a tool, used to manage the GNATS queue. The queue-pr utility is a setuid utility typically with UID 'gnats' privileges.

A stack overflow vulnerability has been reported for the queue-pr utility. The vulnerability occurs due to insufficient bounds checks performed on the database name passed to the '-d' commandline option.

An attacker may invoke the queue-pr utility passing a malicious database name (>=1148 bytes of data), in a manner sufficient to trigger the vulnerability.

Confused? Frustrated?

Successful exploitation may result in the execution of attacker-supplied code with potentially elevated privileges.

It should be noted that on some systems, the queue-pr utility might be installed with setuid 'root' privileges.

It should be noted that although this vulnerability has been reported to affect GNATS version 3.113.1_6, other versions might be affected.

8. Multiple Linux 2.4 Kernel Vulnerabilities BugTraq ID: 8233
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8233
Summary:

Red Hat has released an advisory reporting the existence of multiple vulnerabilities in the Linux 2.4 kernel. The following issues were reported:

/proc/tty/driver/serial may expose sensitive information to local attackers by revealing the exact character count for serial links. This information could permit a malicious local user to infer password lengths and the timing between keystrokes when entering passwords. This might aid in brute-force attacks that attempt to compromise another user's password.

A race condition in the implementation of the execve() system was reported. This issue is described in BID 8042.

The kernel RPC code was reported to have recently changed, causing the reuse flag on newly created sockets to be set. This introduced a vulnerability that could permit unprivileged users to bind to UDP ports used for related services, such as nfsd.

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365

A vulnerability in the implementation of the execve() system could permit malicious local users to gain read access to restricted file descriptors. This occurs because the file descriptor of the executable process is stored in the file table of the calling process. This could be exploited to gain access to sensitive information. This is related to the race condition in execve() and is also discussed in BID 8042.

A flaw in the /proc filesystem could be exploited to gain access to sensitive information. If /proc/self entries are opened before executed a setuid program, the program may fail to change the ownership and permissions of entries that are already open.

The STP protocol on Red Hat was disabled due to lack of security. This could be an issue on other distributions. An additional issue with STP was reported in the kernel that may permit denial of service attacks, due to insufficient length checking.

It was reported that the kernel Forwarding table may be spoofed if forged packets are received that have the same source IP address as the host.

These issues will be divided into separate BIDs when further analysis is complete.

9. Microsoft Windows 2000 RPC DCOM Interface Denial of Service Vulnerability
BugTraq ID: 8234
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8234
Summary:

Microsoft Windows uses Remote Procedure Calls (RPC) for client-server communications in a distributed computing environment (DCE). TCP Port 135 is typically used for DCE endpoint resolution.

A vulnerability in the Windows DCE-RPC stack could allow a remote user to disable RPC services. If a specifically malformed packet is sent to the DCOM __RemoteGetClassObject interface on a vulnerable system, the RPC service may fail. This is due to a NULL pointer being passed from __RemoteGetClassObject to the PerformScmStage function.

Do you need help?

Because other services may depend on the RPC service, the loss of this interface may impact other components on the system, possibly causing them to fail as well.

It should be noted that once disabled, it might be possible for local users to gain elevated privileges by hijacking orphaned pipes left by the RPC process. This issue is described in BID 6769.

This issue may be related to BID 6005, however, this has not been confirmed. Reportedly, this vulnerability affects systems that have applied the patch for Microsoft Security Bulletin MS03-026.

Drupal Cross-Site Scripting Vulnerability BugTraq ID: 8235 Remote: Yes Date Published: Jul 21 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8235 Summary:

Drupal is an open-source content management system. Drupal is available for a number of platforms including Microsoft Windows operating systems and Unix/Linux variants.

The Drupal content management system is prone to a cross-site scripting vulnerability. This issue is exposed through the main page and through other sub-pages. An attacker may exploit this issue by including hostile HTML and script code in a malicious link to Drupal. This code may be rendered in the web browser of a user who visits the link. This would occur in the security context of the site hosting Drupal.

The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user.

AtomicBoard Directory Traversal Vulnerability BugTraq ID: 8236 Remote: Yes Date Published: Jul 21 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8236 Summary:

AtomicBoard is a weblog and message board system written in PHP.

It has been reported that attackers may be able to modify the 'location' URI variable passed to the index.php file to cause the Web server to return arbitrary files. This script is prone to a directory traversal vulnerability, allowing attackers to retrieve any file residing on the filesystem readable by the Web server user.

Do you need more help?

Specifically, by issuing a malicious request that contains directory traversal sequences, '../..', an attacker may be able to break out of the web root and disclose potentially sensitive web server readable files.

Additionally, by supplying an invalid filename, the web server may return an error message disclosing the path to the AtomicBoard system.

The vendor claims this software is an alpha version and acknowledges the insecurity present. The author advises that users do not deploy this software in secure or sensitive environments.

It should be noted that although AtomicBoard version 0.6.2 has been reported vulnerable, other versions might also be affected.

WebCalendar Local File Include Information Disclosure Vulnerability BugTraq ID: 8237 Remote: Yes Date Published: Jul 21 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8237 Summary:

WebCalendar is a freely available, open source web calendar software package. It is available for the Unix and Linux operating systems.

It has been reported that an information disclosure issue exists in WebCalendar. This may allow an attacker to gain unauthorized read access to potentially sensitive information with the privileges of the web server process.

The problem is in the handling of directory traversal strings when passed to a specific variable. When a request for any PHP script is made and directory traversal strings are passed to the user_inc variable, it is possible to view a file at the end of the directory traversal string.

SCO OpenServer Display Local Privilege Escalation Vulnerability BugTraq ID: 8238 Remote: No Date Published: Jul 22 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8238 Summary:

OpenServer is a commercially available UNIX operating system distributed and maintained by SCO.

Can we help you?

A vulnerability has been reported in the SCO display program. This problem may make it possible for an attacker to gain unauthorized privileges on a vulnerable system.

The specifics of this issue are not currently known. This BID will be updated when further analysis has been completed.

It is speculated that this issue is a memory corruption error. However, this information has not been confirmed. This vulnerability may be related to the vulnerability described in BID 8177, titled "ImageMagick Display Filename Format String Vulnerability."

SurfControl E-Mail Filter For SMTP Nested Zip File Filter Bypass Vulnerability BugTraq ID: 8240 Remote: Yes Date Published: Jul 20 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8240 Summary:

SurfControl E-Mail Filter for SMTP is a gateway e-mail scanner that is compatible with a number of SMTP server implementations. It is available for Microsoft Windows operating systems.

It is reported that nested zip files may bypass the scanning mechanism in Surf Control E-Mail Filter for SMTP. If a zipped message attachment contains 16 other zip files, the filter will scan the first 15 files but fail to scan the 16th. Scanning is reportedly done alphabetically so it is possible to control the order in which files are scanned.

This could permit content that is malicious or restricted by security policy to bypass the e-mail filter. An end-user would still be required to execute any malicious content that is sent via this medium.

This issue may be exploitable with other archive formats. Other SurfControl products may also use a similar scanning mechanism and may be prone to this issue as well, though this has not been confirmed.

Top Home Environment Variable Local Buffer Overflow Vulnerability BugTraq ID: 8239 Remote: No Date Published: Jul 22 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8239 Summary:

top is a freely available, open source process monitoring utility. It is available for various Unix and Linux platforms.

Can't find what you're looking for?

A buffer overflow condition has been reported in top when handling environment variables of excessive length. This may result in an attacker potentially executing arbitrary code.

The problem is in the checking of bounds on the HOME environment variable. top does not properly handle input of excessive length in the HOME environment variable. By placing a string of excessive length (1100 bytes) in this environment variable, an attacker may be able to corrupt sensitive process memory, and potentially execute arbitrary code with the privileges of the top program.

It should be noted that top is typically installed with the setuid root bit set.

Additionally, although top versions less than or equal to version 2.0.11 have been reported vulnerable, it should be noted that other versions might also be vulnerable.

Ashnews Remote File Include Vulnerability BugTraq ID: 8241 Remote: Yes Date Published: Jul 22 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8241 Summary:

Ashnews is a web based news board system written in PHP.

Ashnews is prone to a vulnerability that may permit remote attackers to include and execute malicious PHP scripts. Remote users, under some PHP configurations, may influence the $pathtoashnews variable. This variable is used in the include path for the ashnews.php and ashheadlines.php scripts. By influencing the include path so that it points to a malicious PHP script on a remote system, it is possible to cause arbitrary PHP code to be executed. This would occur in the context of the web server.

This could be exploited to execute malicious PHP commands in the context of the web server process.

Savant Web Server CGITest.HTML Cross Site Scripting Vulnerability BugTraq ID: 8242 Remote: Yes Date Published: Jul 21 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8242 Summary:

Savant web server is a free web server that runs on Windows platforms.

Don't know where to look next?

cgitest.html is a demonstration script that is installed by default on Savant Web Server installs.

cgitest.html has been reported prone to cross-site scripting attacks. The issue occurs due to a lack of sufficient sanitization performed on data supplied to the cgitest.html script.

This issue could be exploited to cause hostile HTML and script code to be rendered in the browser of a user who is enticed to visit a malicious link to the vulnerable script. The code would be interpreted in the context of the vulnerable site. Exploitation could allow theft of cookie-based authentication credentials or other attacks.

It should be noted that while this vulnerability has been reported to affect Savant web server version 3.1, other versions might also be affected.

Multiple Savant Web Server Denial Of Service Vulnerabilities BugTraq ID: 8243 Remote: Yes Date Published: Jul 21 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8243 Summary:

Savant web server is a free web server that runs on Windows platforms.

Savant web server has been reported prone to multiple denial of service vulnerabilities.

Reportedly, a remote attacker may invoke many HTTP requests, against the Savant web server, in rapid succession. It has been reported that this activity will trigger an exception in the Savant web server and the service will fail.

Additionally a remote attacker may make a HTTP request of excessive length. This will also reportedly cause an exception in the Savant web server causing the service to fail. This issue may be identical to the issue described in BID 3788; this however has not been confirmed.

Confused? Frustrated?

It should be noted that while this vulnerability has been reported to affect Savant web server version 3.1, other versions might also be affected.

Microsoft Multiple IIS 6.0 Web Admin Vulnerabilities BugTraq ID: 8244 Remote: Yes Date Published: Jul 22 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8244 Summary:

Multiple vulnerabilities have been reported in the web admin interface that is included in Microsoft IIS 6.0.

Multiple instances of cross-site scripting vulnerabilities were discovered in many of the ASPs that are included in the web admin interface. In particular, input supplied to the ReturnURL parameter via many of these scripts (such as Web_LogSettings.asp) may not be sanitized before being echoed back to a user of the interface. An attacker could exploit these issues via a malicious link to the interface that contains hostile HTML or script code. This could cause attacker-supplied code to be rendered in the web browser of a legitimate interface user who follows the link.

Additionally, it is reported that the web admin interface could expose valid session IDs or permit unauthorized access to areas that do not require session IDs. These issues may in part be due to insufficient access validation for certain web admin interface components. Scripts that may be affected include default.asp, tasks.asp and users.asp.

This BID will be separated into separate BIDs when further analysis of these issues is complete.

20. MySQL AB ODBC Driver Plain Text Password Vulnerability BugTraq ID: 8245
Remote: No
Date Published: Jul 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8245
Summary:

A vulnerability has been reported in the MySQL AB ODBC (Open Data Base Connectivity) driver implementation. Reportedly, ODBC credentials are stored in the system registry using plain text format.

When creating ODBC connections, the MySQL ODBC driver reportedly stores plain text credentials used to connect to the specified database in the system registry. ODBC SYSTEM-DSN entries are stored in the HKEY_LOCAL_MACHINE branch of the system registry, unlike USER-DSN entries which are stored in HKEY_LOCAL_USER registry branch. This may exaggerate the impact of the vulnerability when relating to MySQL ODBC SYSTEM-DSN entries, because the data may be accessible to a greater number of users.

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365

If a local user has read access to the registry key that contains the sensitive data, the credentials may be disclosed and used to connect to the target database.

It should be noted that this issue might be configuration specific. Other ODBC drivers may also be prone to the same issue, though this is not confirmed.

21. FDClone Local Insecure Temporary Directory Creation Vulnerability BugTraq ID: 8247
Remote: No
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8247
Summary:

fdclone is a freely available, open source file management tool. It is available for the Linux platform.

A problem has been reported in the creation of temporary directories by fdclone. Because of this, an attacker may be able to gain access to potentially sensitive information.

The problem is in the creation of directories by the fdclone program in the /tmp directory. fdclone does not properly check for the existence of temporary directories prior to execution, and does not validate permissions on already existing directories. Because of this, an attacker may be able to gain access to the contents of temporary files created by fdclone. It may also be possible to launch symbolic link attacks with this vulnerability.

22. Sun Solaris IPv6 Packet Denial of Service Vulnerability BugTraq ID: 8250
Remote: Yes
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8250
Summary:

Sun Solaris is a popular Unix-based operating system designed for x86 and sparc platforms.

Do you need help?

Sun has issued a security alert detailing a vulnerability present in the Solaris 8 kernel. It is reported that the Solaris kernel may not properly handle specific types of IP version 6 packets, potentially resulting in a kernel panic. It may be possible for remote attackers to construct a malicious packet that will trigger this condition to cause a denial of service.

Specific details regarding the type of packet that may trigger this vulnerability are currently not known. This alert will be updated as more information becomes available.

23. 3Com DSL Router Administrative Interface Long Request Router Denial Of Service Vulnerability
BugTraq ID: 8248
Remote: Yes
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8248
Summary:

The 812 OfficeConnect is one of a series of DSL routers distributed and maintained by 3Com.

A vulnerability in the 3Com 812 OfficeConnect has been reported that may result in the router becoming unstable. Because of this, an attacker may be able to deny service to legitimate users of the vulnerable router.

The problem is in the handling of requests of excessive length by the administrative interface. When an attacker sends a string of 512 or more bytes to the administrative interface on port 80, the router reboots. This could be exploited repeatedly, resulting in an prolonged denial of service.

It should be noted that the administrative interface is reachable only via the LAN interface of the DSL router, and cannot be accessed by the untrusted network side by default.

It should also be noted that this issue is likely a memory corruption vulnerability. Although unconfirmed, a possibility exists that this issue may be exploitable to execute arbitrary code. This issue may also affect other 3Com routers.

Do you need more help?

24. Sun Solaris automountd Denial of Service Vulnerability BugTraq ID: 8253
Remote: No
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8253
Summary:

Sun Solaris is a popular Unix-based operating system designed for x86 and sparc platforms.

Sun has released a security alert detailing a vulnerability present in automountd(1M). This vulnerability may allow local users to cause the automountd process to crash, resulting in a denial of service condition. According to Sun, systems affected are Solaris 8 installations with the following patches applied:

108993-14 through 108993-19 (SPARC) or, 108994-14 through 108994-19 (x86)

Specific details regarding exploitation of this vulnerability are currently not known. This BID will be updated as more information becomes available.

25. Novell Netware Enterprise Web Server CGI2Perl.NLM Buffer Overflow Vulnerability
BugTraq ID: 8251
Remote: Yes
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8251
Summary:

Novell Netware Enterprise Web Server CGI2Perl.NLM has been reported prone to a buffer overflow vulnerability.

The issue presents itself, likely due to insufficient bounds checking performed on user-supplied requests that are passed to the perl interpreter via the perl virtual directory. It has been reported that a remote attacker may send data in a manner sufficient to trigger the condition, and cause one or more server ABEND conditions. This may result in server performance degradation or ultimately in the failure of the server. Effectively denying service to legitimate users.

Can we help you?

It should be noted, that the vendor has reported that no root shell exploit from this kind of failure on Netware is currently known. However due to the nature of this vulnerability, it has been conjectured that arbitrary code execution may be possible; this however has not been confirmed.

This vulnerability has been reported to affect the cgi2perl.nlm for Netware Enterprise Web Server on Netware 5.0 and 6.0.

III. SECURITYFOCUS NEWS AND COMMENTARY

The Hackers Who Broke Windows By Deborah Radcliff

The Polish security researchers in the Last Stage of Delirium crack unbreakable systems and find software security holes missed by multi-million dollar corporations. They just don't sleep much. ... >>

http://www.securityfocus.com/news/6519

2. Guilty Plea in Kinko's Keystroke Caper By Kevin Poulsen

A New York cyberthief bugged the public access machines at thirteen Manhattan Kinko's shops for nearly two years. His take: hundreds of online banking passwords.

http://www.securityfocus.com/news/6447

Can't find what you're looking for?

3. Study finds computer voting system widely vulnerable to tampering By Brian Witte, The Associated Press

An electronic voting system used in some states as an alternative to the troublesome punch-card ballots is highly vulnerable to fraud, computer security experts warned in a study released Thursday.

http://www.securityfocus.com/news/6530

4. Online Identity-Theft Tactic Targeted By Jonathan Krim, Washington Post

A Los Angeles 17-year-old has settled charges that he used fake Web pages to lure consumers to provide credit card numbers and other personal data, the Federal Trade Commission announced yesterday in a crackdown on a growing form of Internet fraud.

http://www.securityfocus.com/news/6517

IV. SECURITYFOCUS TOP 6 TOOLS

Rate v0.81 by mteg Relevant URL: http://s-tech.elsat.net.pl/ Platforms: FreeBSD, Linux, OpenBSD, Solaris, SunOS Summary:

Rate is a Swiss-Army-knife bandwidth measurement tool. Its primary application is calculating the bandwidth used by packets matching a given BPF packet filter expression, which can really help a network administrator see what is happening at a software-based router at the moment. Administrators can measure the traffic generated by a single host or by a whole subnet, and measure HTTP traffic, broadcast traffic, quake traffic, etc. It can also be used for generating per-IP statistics and for determining nodes that generate highest traffic; it has a special operation mode for it. Additionally, it is able to extract strings from packets based on a POSIX regular expression.

Don't know where to look next?

2. Enigmail v0.81.0
by Patrick
Relevant URL:
http://enigmail.mozdev.org/thunderbird.html Platforms: Linux, MacOS, POSIX, UNIX, Windows 2000, Windows 3.x, Windows 95/98, Windows CE, Windows NT, Windows XP Summary:

Enigmail is a "plugin" for the mail client of Mozilla and Netscape 7.x which allows users to access the authentication and encryption features provided by the popular GnuPG software. Enigmail can encrypt/sign mail when sending, and can decrypt/authenticate received mail. It can also import/export public keys. Enigmail supports both the inline PGP format and the PGP/MIME format, which can be used to encrypt attachments. Enigmail is cross-platform, although binaries are supplied only for a limited number of platforms. Enigmail uses inter-process communication to execute GPG to carry out encryption/authentication.

3. Crash Core Analysis Suite v3.6-0.3
by Mission Critical Linux webmaster@missioncriticallinux.com Relevant URL:
http://oss.missioncriticallinux.com/projects/crash/ Platforms: Linux, POSIX
Summary:

The Crash Core Analysis Suite utility is a self-contained tool, loosely based on the SVR4 crash command but completely merged with gdb, thereby combining the kernel-specific nature of crash with the source level debugging capabilities of gdb. The utility can be used to investigate live systems, kernel core dumps created from the Kernel Core Dump patch offered by Mission Critical Linux, and kernel core dumps created from the Linux Kernel Crash Dumps (LKCD) patch offered by SGI.

4. Ethereal v0.9.14
by Gerald Combs, gerald@ethereal.com
Relevant URL:
http://www.ethereal.com/
Platforms: AIX, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD, SCO, Solaris, True64 UNIX
Summary:

Ethereal is a network protocol analyzer, or "packet sniffer", that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality packet analyzer for Unix, and the most useful packet analyzer on any platform.

5. The SpamBouncer v1.5-Jul22
by BACbKA vassilii@tarunz.org
Relevant URL:
http://www.spambouncer.org/
Platforms: UNIX
Summary:

The SpamBouncer is a set of procmail instructions that search the headers and text of your incoming email to see if it meets one or more of a list of conditions for probable spam. It will then either tag the suspected spam and return it to your main incoming mailbox, tag the suspected spam, delete spam from known spam sources, and file suspected spam in a separate folder, send a simulated MAILER-DAEMON daemon "bounce", complain to the
"upstream providers" of known spammers or spam sites/domains, etc.

Confused? Frustrated?

6. Gherkin v0.2.3
by mschmuhl
Relevant URL:
http://www.altmode.com/gherkin
Platforms: Os Independent, POSIX
Summary:

Gherkin is a Web-enabled multi-threaded, centralized security scan manager that incorporates Nessus vulnerability scanning, DNS and nmblookup name resolution, nmap fingerprinting and scanning, and customized traceroute-based network node detection.

V. SECURITY JOBS SUMMARY