💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › HNS › issue039.… captured on 2022-01-08 at 15:57:14.
⬅️ Previous capture (2021-12-03)
-=-=-=-=-=-=-
Net-Sec Newsletter Issue 39 - 26.11.2000 http://net-security.org This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured articles 5) Featured books 6) Security software 7) Defaced archives General security news --------------------- ---------------------------------------------------------------------------- NEW ZEALAND ANTI-HACKING BILL FACES SELECT COMMITTEE A planned amendment to New Zealand's crime bill that would outlaw malicious hacking for the first time - while also controversially allowing security services the freedom to hack into citizens' computers and intercept e-mail and faxes - has passed through to the Government's Law and Order Select Committee. The long-awaited legislation is mainly intended to criminalize computer hacking in New Zealand. The country has so far been without specific laws outlawing malicious hacking. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/00/11/19/news7.html TELEWORKING CAUSES SERIOUS SECURITY THREAT In the wake of the "hack" into Microsoft's network, security administrators have turned their attention to what some believe is the greatest security challenge facing corporations: teleworkers. Network administrator at US firm SR Equipment Craig LaHote is struggling with it now, and just a week ago he had a meeting with executives about it. "We're having a hard time controlling it. It's a real grey area with home computers accessing the network and the Internet," he said. "We really have a hard time enforcing policies there. We have a policy but no real way to audit [users] except basically asking them to comply." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2000/46/ns-19163.html HACKERS AND THE MEDIA "Have you ever watched the news, read the newspaper, went to your favorite tech site and read the news? Of course you have, and you have probably heard the term 'Hacker' used before. Well, let me tell you something my feeble-minded friend. You have been subjected to over-hyped crap that is not true." Link: http://geeknews.net/article.php?story=20001119193710182 FILESYSTEM SECURITY - EXT2 EXTENDED ATTRIBUTES If asked to name the top five security features of the Linux kernel, most administrators would probably not mention ext2 filesystem attributes. Although the definitions for most of the useful ext2 filesystem flags appeared in the kernel source at least as early as the 1.1 development series, this humble feature often takes a back seat to more exotic and recently introduced tools for preserving and assuring system integrity such as LIDS, Tripwire, and others. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/linux/articles/ext2attr.html FIREWALL ACCELERATION OVER ATM Firewalls are not new; but high-performance firewalls are. Historically, firewalls used software to examine every packet and then make the decision to forward or drop the packet. This made them slow. When administrators placed them in line with low-speed WAN access links, firewalls introduced no bottlenecks. But the trust boundary where a firewall is needed doesn't always lie at a WAN link. A finance department's network needs protection from disruption by other departments in the building. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.nwfusion.com/news/tech/2000/1120tech.html THE LATEST SECURITY FAD: PARTNERING Security vendors, still scrambling for the right combination of software, hardware and services to offer the enterprise, have another new idea: When in doubt, partner. This week, firewall and intrusion detection maker Zone Labs Inc., of San Francisco, and Tokyo-based anti-virus software developer Trend Micro Inc. will announce a close relationship, capping a furious week of partnering and punctuating a year of failed security solutions. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/eweek/stories/general/0,11011,2655640,00.html INFOSEC, QUALITY ASSURANCE, AND EXTORTION "...Anyway, in our conversation, the student and I started off discussing the issue of full disclosure of security vulnerabilities, complete with technical details and even exploit code. I argued that there were better ways to contribute to security than to make powerful exploits available even to cyberspace sociopaths and children. But then we shifted the discussion to people who release details of vulnerabilities to pressure software firms for rapid fixes to problems..." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/cover/coverstory20001120.html BLACKHAT '00 VIDEO INTERVIEW - IAN GOLDBERG Ian Goldberg, Chief Scientist with Zero-Knowledge System. In this interview, Ian Goldberg, Chief Scientist with Zero-Knowledge System, offers his perspective on privacy and security issues affecting us today. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/media/79 RUSSIA'S HACKERS: NOTORIOUS OR DESPERATE? In a recent poll on a hacker-oriented Web site, 82 percent said Russia had the world's best hackers; only 5 percent said Americans were better. But the bravado is laced with frustration. Hackers are motivated as much by a lack of opportunity in economically struggling Russia as by criminal leanings, people inside and outside the hacker community say. Sergei Pokrovsky, editor of the magazine Khaker, said that hackers in his circle have skills that could bring them rich salaries in the West, but they expect to earn only about $300 a month working for Russian companies. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2000/TECH/computing/11/20/russia.hackers.ap/index.html 'ANALYZER' DEFENDS ISRAELI SITES The twenty-one year old Tenenbaum is serving as CTO of the security firm 2XS. Two weeks ago, according to Tenebaum, he heard from a hacker group he founded in 1996, called the "Israeli Internet Underground" (IIU). The group asked Tenebaum if his company would provide security solutions for Israeli companies for free. "They claimed they are going to help all the Israeli sites that are under attack, or sites that there is a good reason to believe will be attacked," says Tenenbaum. "I liked the idea in general." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/news/116 IS THERE HOPE? What is the feasibility of running national federal elections over the Internet? SunWorld guest writer Avi Rubin focuses on the limitations of the currently deployed infrastructure, with an emphasis on concerns over the security of voting hosts and the Internet itself. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.sunworld.com/sunworldonline/swol-11-2000/swol-1103-voting.html SIX MONTHS DOWNTIME A former computer science student has been sentenced in the US to six months house arrest, two years probation and been banned from using computers for recreational purposes after he attacked Nasa computers last year. 29-year-old Ikenna Iffih, from Boston, Massachusetts, pleaded guilty to charges of defacing a commercial website and wilful malicious interference of communications in June. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1114257 A STAR WARS DEFENSE Basing their strategy on a grad student's work, a new Internet security company has begun beta-testing its solution to Denial-of-Service attacks on the high-speed experimental Internet2 backbone. Asta Networks was formed earlier this year to develop and market the security system by Asta chief scientist Stefan Savage, a doctoral candidate at the University of Washington, and members of the school's Computer Science and Engineering faculty. Their approach to the Denial-of-Service problem is based on his doctoral thesis. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/technology/0,1282,40297,00.html INTRODUCTION TO FIREWALLS "In this article I cover some of the design decisions that have to be made before creating a firewall, from architecture to various decisions that should be made." Link: http://www.linux.com/sysadmin/newsitem.phtml?sid=1&aid=11296 WINDOWS WHISTLER ADVANCED SECURITY FEATURES Jim Ewel, Vice President of IT infrastructure and hosting for Microsoft, told reporters in London that the next build of Windows codenamed Whistler, will feature several new security options. One such feature, set to prevent the onslaught of viruses and other scripting problems, prevents Windows from executing any single application lacking a digital signature. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/sp/stories/news/0,4538,2655786,00.html SECURING ROAMING ACCESS PORTS ON YOUR NETWORK In this day of the mobile office, a system administrator may have to not only worry about all of the boxes that "live" permanently on the network, but must also now manage hundreds, possibly even thousands, of machines that plug in and out of the network randomly. The people using these roaming machines expect that they will have similar access on their laptops as they do on their desktops, an expectation that can prove to be quite problematic. Each user can theoretically have their own configurations of hardware and software, none of it necessarily having any strong links to the machines that are currently on your network. How then can we still keep a secure network amongst all of this diversity? Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/roaming20001121.html OPENSSH INSTALLATION AND CONFIGURATION The Internet is built with communication in mind. You will routinely move around the Web from one site to the other or telnet to another machine to check your mail or to administer that machine. The trouble with most of these protocols is that they are not encrypted. Over a telnet connection, your passwords are sent as plain-text, which can be read by anyone. Using packet sniffers, even an amateur hacker can spy on your connection and grab your data. Secure Shell was built to address these faults and provide a more secure environment to work in. SSH encrypts all your traffic including your passwords when you connect to another machine over the net. SSH also replaces telnet, ftp, rsh, rlogin and rexec. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.freeos.com/articles/2745/2/13/ ENCRYPTION, FREE SPEECH AND GOVERNMENT REGULATION Encryption software has sparked regulation by the U.S. government and at least two important lawsuits involving the First Amendment. Exporting encryption products requires a thorough understanding of what's legal and what's not. This article explains the issues. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.gigalaw.com/articles/grossman-2000-05a-p1.html FREEBSD 4.2-RELEASE IS NOW AVAILABLE Following the release of FreeBSD 4.1.1 in September, 2000, many bugs were fixed, important security issues dealt with, and a conservative number of new features added. 4.2-RELEASE is now available for i386 and alpha in "FTP installable" form and can be installed directly over the net using the boot floppies or copied to a local NFS/ftp server. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.bsdtoday.com/2000/November/News338.html MOROCCO GOVT INTERNET SITE ATTACKED A attacker broke into Morocco's Finance Ministry's Web site for the first time at the weekend but caused no damage, an official said on Monday. Web surfers or potential investors visiting the site at www.mfie.gov.ma found a message in bad French saying the cover page had been hacked by "NetOperat." The tainted page maintained a link with the ministry's original Internet site stressing the server was not corrupted and invited authorities to protect their system better. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.timesofindia.com/today/22info23.htm DIMITRI VISITS MICROSOFT IN THE NEDERLANDS "We saw each other last week and had a useful conversation," Michiel Gosens, a spokesperson for Microsoft in the Netherlands said, after 19-year-old IT student with handle 'Dimitri', visited Microsoft's Dutch office. If you don't remember, Dimitri penetrated and defaced one of the Microsoft's servers for two times in past few weeks. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.infoworld.com/articles/hn/xml/00/11/21/001121hnsecret.xml WORM BLOCKS ANTI-VIRUS SITES The software virus known as W95/MTX now can block users from going to certain anti-virus software vendor Web sites, thus preventing access to updates. Command Software Systems, a security provider, said the virus was spreading quickly. W95/MTX is a virus, worm, backdoor access Trojan that arrives through e-mail as an attachment, and has a variety of decoy file names. Once launched, it can wipe out files and be difficult to remove. Link: http://www.telekomnet.com/xml_news/story.asp?id=xml_news_data/11-22-00_worm_antivirussites.xml WORKERS OPEN BACK DOORS FOR ATTACKERS Employees are the biggest threat to network security - and they don't even know it. Unauthorised equipment attached to a company network can, according to Robin Dahlberg, UK MD of Internet Security Systems, compromise the best efforts of a network manager to secure the system by creating a "backdoor" into the network. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/1/14910.html CONTROLLING AND MONITORING COMMUNICATIONS Aaron Sullivan's popular series "The Crux of NT Security" continues with a look at secure network design and implementation - Where should the Exchange server go? The database server? The firewall?? What protocols should be permitted, and where? Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/microsoft/nt/crux3.html BIG BUSINESSES STILL IGNORE VIRUS ALERTS British businesses are still failing to grasp the importance of internet security and network availability according to research released this morning. Despite a raft of scare stories in recent months, more than 70 per cent of respondents believe employees aren't aware of security threats and 40 per cent felt end users remain the most dangerous part of the network. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.silicon.com/a41036 SHROPSHIRE RALLIES AGAINST ATTACKER The Virtual Shropshire website is tightening security after it was invaded by the attacker who rubbished the county online, describing it as a "series of decaying and festering market towns". The website's description of the county as a rural idyll that welcomed visitors from all over the world was changed by the attacker to a "land of boringly verdant landscapes which have inspired unsuccessful writers and artists for centuries". Link: http://www.thisislondon.com/dynamic/news/story.html?in_review_id=337726&in_review_text_id=280865 MORE ON CARNIVORE House Republican leader Dick Armey added his voice Wednesday to those accusing an outside review panel of whitewashing a controversial FBI cyber surveillance tool. "The Department of Justice stacked the deck for this report," said Armey, a Texas Republican known as a champion of smaller, less intrusive government. "It selected reviewers and set the rules in order to ensure they would get the best possible review." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,40342,00.html YAHOO! VOWS TO STOP PEDOPHILES In an exclusive interview with ZDNet News U.K., Martina King, U.K. managing director of Yahoo!, confirmed that the company is about to employ a Yahoo! "inspector" charged with ensuring that Yahoo!�s Messenger system is not polluted with pedophile content. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.msnbc.com/news/493473.asp U.S. ARMY KICK-STARTS CYBERWAR MACHINE The U.S. military has a new mission: Be ready to launch a cyberattack against potential adversaries, some of whom are stockpiling cyberweapons. Such an attack would likely involve launching massive distributed denial-of-service assaults, unleashing crippling computer viruses or Trojans, and jamming the enemy's computer systems through electronic radio-frequency interference. An order from the National Command Authority - backed by President Clinton and Secretary of Defense William Cohen - recently instructed the military to gear up to wage cyberwar. The ability of the U.S. to conduct such warfare "doesn't exist today," according to a top Army official speaking at a conference in Arlington, Va., last week. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2000/TECH/computing/11/22/cyberwar.machine.idg/index.html TOP 50 SECURITY TOOLS "I was so impressed by the list they created that I am putting the top 50 up here where everyone can benefit from them. I think anyone in the security field would be well advisted to go over the list and investigate any tools they are unfamiliar with. I also plan to point newbies to this page whenever they write me saying "I do not know where to start". Respondants were allowed to list open source or commercial tools on any platform. Commercial tools are noted as such in the list below." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.insecure.org/tools.html SNAPSHIELD INTROS ENCRYPTED PHONE CALL SERVICE Snapshield, formerly known as Microlink, an Israeli company, has developed a phone encryption technology that it says is almost unbreakable. The firm has teamed with Bezeq, the Israeli telecommunications carrier, to offer the service to end users. Bezeq is running its system on a Snapshield secure network access platform, an IT security system that encrypts voice and fax communications. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/00/11/23/news6.html BAWP WEB SITE DEFACED The Register reports that The British Association of Web Professionals Web site (www.bawp.co.uk) has been defaced by a character known as Evil Angelica. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/6/14983.html THREE ARRESTED IN JAPAN A team of investigators from five prefectural police forces in Japan arrested three people Thursday on suspicion of illegally accessing computer networks (using others' passwords). Link: http://www.japantimes.co.jp/cgi-bin/getarticle.pl5?nn20001124a9.htm MORE REGARDING THE MIDDLE EAST CONFLICT As tensions in the Middle East continue to simmer, more than a hundred Web sites have been defaced or shut down by pro-Palestinian and pro-Israeli attackers, often with the assistance of activists from several countries not actively involved in the conflict, according to security experts. Ben Venzke, director of intelligence production at iDefense, a Web security firm that has been monitoring the Middle East conflict as it plays out online, said attackers from as far away as South America to the U.S. are expanding the conflict by contributing their skills to whichever side has their sympathies. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/00/11/25/news1.html ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- RED HAT - NEW NETSCAPE PACKAGES A buffer overflow exists in Netscape's HTML parsing code. By using specially designed code, a remote website could cause arbitrary code to be run on the local machine. Link: http://www.net-security.org/text/bugs/974730975,56143,.shtml REMOTE DOS IN SMARTSERVER 3 There are remote DoS vulnerabilities in both the SMTP and POP components of the SmartServer3 email server. By passing large arguments to commands in both components, the services can be caused to fail. Link: http://www.net-security.org/text/bugs/974730989,79739,.shtml DECRYPTING PASSWORDS FOR SMARTSERVER 3 SmartServer3 (SS3) is a small business email server from NetCPlus. It installs by default in C:\Program Files\smartserver3\ . In this folder it stores a configuration file called 'dialsrv.ini' . This file is accessible to all authenticated users (authenticated to Windows) and contains entries for every user which include their weakly encrypted password. Link: http://www.net-security.org/text/bugs/974731010,81908,.shtml WINVNC 3.3.X VULNERABILITY During the InstallShield setup utility, it creates the registry key: HKEY_LOCAL_MACHINE\Software\ORL\WinVNC3\ which is used to store all of WinVNC's default settings. By default, Administrator and SYSTEM have full control, and Everybody has Special Access (read and modify). The connection password, ip and query restrictions and other settings are all stored here, all editable by anybody. Link: http://www.net-security.org/text/bugs/974731046,16257,.shtml ANOTHER IE 5.X/OUTLOOK VULNERABILITY There is a security vulnerability in IE 5.5/Outlook/Outlook Express which allows executing arbitratrary programs using .chm files and revealing the location of temporary internet files folder. This may lead to taking full control over user's computer. Link: http://www.net-security.org/text/bugs/974764463,85116,.shtml CGIFORUM 1.0 VULNERABILITY CGIForum is a free forum. We can set 'thesection' parameter to view files on the vulnerable system with privileges of the user "nobody". This is caused from OutputHTMLFile function in cgiforum.pl script where $section (= $thesection ) isn't checked (never besides in this script). Link: http://www.net-security.org/text/bugs/974764481,65837,.shtml "SESSION ID COOKIE MARKING" VULNERABILITY On October 23, 2000, Microsoft released the original version of this bulletin, to discuss the availability of a patch that eliminates a security vulnerability in Microsoft Internet Information Server. The vulnerability could allow a malicious user to "hijack" another user's secure web session, under a very restricted set of circumstances. On November 20, 2000, we re-released the bulletin to advise customers using IIS 4.0 on Alpha platforms, or IIS 5.0 on x86 platforms, that new versions of these patch are available, to correct an error in the original version of the patch. The x86 IIS 4.0 patch was not affected by the error, and customers using these systems do not need to take any action. Link: http://www.net-security.org/text/bugs/974813634,97052,.shtml SECURITY PROBLEM IN ADCYCLE INSTALLATION Adcycle is a banner management system which is written in Perl and uses MySQL for data storage. Installation is done by editing AdConfig.pm, creating a Mysql user/password/database and then running the build.cgi script. That script checks if the database connection is working (showing the username/password it reads from AdConfig.pm) and creating the tables within the database. The 'exploit' is quite simple: when the build.cgi remains executable for your httpd process after the installation, every internet user can view the output of it, including your manager password and database password. Attackers can delete, change and add banner campaigns. Another big problem is when build.cgi is called from a webbrowser, the AdCycle tables are dropped so all banner campaigns are lost. Link: http://www.net-security.org/text/bugs/974813650,52259,.shtml DISCLOSURE OF JSP SOURCE CODE Under a particular configuration, ServletExec AS v3.0C will disclose the source code of JSP pages when some special characters are appended to HTTP requests. Link: http://www.net-security.org/text/bugs/974858485,9354,.shtml LINUX MANDRAKE - PINE UPDATE By adding specific headers to messages, the pine mail reader could be made to exit with an error message when users attempted to manipulate mail folders containing those messages. Link: http://www.net-security.org/text/bugs/974858502,41213,.shtml QUICKSTORE SHOPPING CART VULNERABILITY In a few versions of QuikStore's Shopping Cart it is posible to read any world readable file on the server. One such example is that someone could easily get your password file if it is unshadowed. Also, it's possible, after the passwords have been cracked, to steal credit card information(Yes it does use pgp but some admins may keep the key on the same system. Yes its very likely it could happen.) ,or client personal information. Link: http://www.net-security.org/text/bugs/974858522,49182,.shtml LINUX MANDRAKE - JOE UPDATE When exiting joe in a non-standard way (such as a system crash, closing an xterm, or a network connection going down), joe will unconditionally append its open buffers to the file DEADJOE. This can be exploited by the creation of DEADJOE symlinks in directories where root would normally use joe. In this way, joe could be used to append garbage to potentially sensitive files, resulting in a denial of service or other problems. Link: http://www.net-security.org/text/bugs/974858537,65453,.shtml INPERSON VULNERABILITIES InPerson is a multimedia desktop conferencing tool for IRIX workstations. There have been several reports of vulnerabilities in InPerson which allow users with local accounts on IRIX workstations to obtain root access. SGI has investigated the issue and recommends the following steps for neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures be implemented on ALL vulnerable SGI systems. Link: http://www.net-security.org/text/bugs/974858551,11592,.shtml BROKER FTP VULNERABILITY Broker FTP is vulnerable to two very dangerous attack. First one allows attacker to browse servers whole disk while second one allows attacker to fetch passwords and account information easily. Link: http://www.net-security.org/text/bugs/975035606,70513,.shtml UPDATED OPENSSH FOR RED HAT LINUX 7.0 An OpenSSH client will do agent or X11 forwarding at the request of a server, even if the user has not requested that it be done. A malicious server can exploit this vulnerability to gain access to the user's display. Link: http://www.net-security.org/text/bugs/975035631,86990,.shtml DEBIAN LINUX - NEW VERSION OF JOE RELEASED When joe (Joe's Own Editor) dies due to a signal instead of a normal exit it saves a list of the files it is editing to a file called `DEADJOE' in its current directory. Unfortunately this wasn't done safely which made joe vulnerable to a symlink attack. This has been fixed in version 2.8-15.1 Link: http://www.net-security.org/text/bugs/975035645,47327,.shtml UPDATE: MICROSOFT SECURITY BULLETIN #86 On November 06, 2000, Microsoft released the original version of this bulletin, announcing the availability of a patch that eliminates a security vulnerability in Microsoft IIS 5.0. On November 10, 2000, we updated the bulletin to clarify the scope of the issue. On November 21, 2000, we updated it again, to discuss two newly-discovered variants of the original vulnerability. The new variants don't change the effect of exploiting the vulnerability. However, they do affect a larger number of products. The original variant affected IIS 5.0 in all cases, but only affected IIS 4.0 when a service pack prior to Windows NT 4.0 Service Pack 6a was in use. The new variants affect both IIS 4.0 and IIS 5.0 regardless of the service pack is in use. Microsoft recommends that all affected customers apply the new versions of the patches. Link: http://www.net-security.org/text/bugs/975035667,76284,.shtml "DOMAIN ACCOUNT LOCKOUT" VULNERABILITY Microsoft has released a patch that eliminates a security vulnerability in Microsoft Windows 2000. The vulnerability could allow a malicious user to use repeated attempts to guess an account password even if the domain administrator had set an account lockout policy. Link: http://www.net-security.org/text/bugs/975035697,89168,.shtml DOS POSSIBILITY IN SYSLOG-NG When syslog-ng parses log messages a variable named "left" is used to store the remaining length of the log message. The priority part in the message should look like this: < 6> When the line ends without the closing '>' this "left" variable becomes -1 due a to a bug. The remaining part of the message parsing routine checks if there's any characters left using the condition: left != 0, since -1 is not 0, this condition evaluates to true. Link: http://www.net-security.org/text/bugs/975035728,81790,.shtml 602PRO LAN SUITE WEB ADMIN OVERFLOW The remote administration component (webprox.dll) of this application is subject to a buffer overflow attack through a lengthy GET command. If this request contains 1059 bytes or more it will overflow a buffer and allow the execution of arbitrary code. Link: http://www.net-security.org/text/bugs/975035749,3698,.shtml PHORUM PHP MESSAGE BOARD VULNERABILITY Any user can parse a choosed php script file using the Phorum sustem. It is also possible, under certain circunstances, to execute arbitrary commands on the server as the httpd user. This is fixed in version 3.2.7 that was released on 2000-11-22. Link: http://www.net-security.org/text/bugs/975035768,82550,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- SMARTCARD SECURITY FOR E-BUSINESS - [20.11.2000] Cylink Corporation announced that it will offer Veridicom's fingerprint-based smartcard reader with Cylink's PrivateCard under a reseller's agreement that will allow the e-business security pioneer to deliver a new class of secure martcards protected with fingerprint authentication for secure desktop and laptop e-business transactions. Press release: < http://www.net-security.org/text/press/974731559,96730,.shtml > ---------------------------------------------------------------------------- SECURE BLUETOOTH-BASED FINANCIAL SERVICES - [21.11.2000] Rainbow Technologies, Inc., a leading provider of high-performance security solutions for the Internet and eCommerce, today announced an agreement to partner with Consumer Direct Link, Inc. (CDL) and Acer, Inc., to jointly develop secure Bluetooth-based solutions for the financial services and retail markets. Under terms of the agreement, the companies will develop BluePoint and BlueZone Access Controllers with Rainbow's Virtual Private Network (VPN) encryption technology. Press release: < http://www.net-security.org/text/press/974763478,86814,.shtml > ---------------------------------------------------------------------------- MCAFEE PLAYS WITH HOLIDAY HYPE - [21.11.2000] McAfee Consumer Products Division, a business unit of Network Associates, will again provide consumers with extensive online protection this holiday season with the strong privacy and security technology found in Internet Guard Dog and Internet Guard Dog Pro software. These comprehensive suites offer strong, customizable, privacy controls and security features such as personal firewall technology and encryption, to safeguard consumers' sensitive information while they shop online for holiday gifts. A recent survey by Jupiter Media Metrix reports 35 million people in the United States will purchase gifts online this holiday season, compared with 20 million who shopped online last year. Press release: < http://www.net-security.org/text/press/974814019,13449,.shtml > ---------------------------------------------------------------------------- SECURE STUDENT-TO-GOVERNMENT TRANSACTIONS - [21.11.2000] VeriSign, Inc., the leading provider of Internet trust services, announced that it will provide Public Key Infrastructure (PKI) consulting and application integration support for a number of Federal Agencies to enable students to use digital certificates to secure online transactions with the Agencies. These Federal Agencies, including the Department of Education, Department of Labor, Department of Veterans Affairs and the United States Postal Service are collaborating to offer students a single online interface to a multitude of Federal programs, such as student financial aid applications. Press release: < http://www.net-security.org/text/press/974814103,24903,.shtml > ---------------------------------------------------------------------------- DYNAMIC INTERNET SECURITY MARKETPLACE - [22.11.2000] In an effort to maximize shareholder value and capitalize on the growth and profit potential of the Internet security software business, Inforum Communications, Inc. announces a shift in business strategy that will allow the Company to focus solely on the continued development of its Internet security software subsidiary, 2Cactus Development, Inc. Press release: < http://www.net-security.org/text/press/974858708,65409,.shtml > ---------------------------------------------------------------------------- ENTRUST ESTABLISHES PRESENCE IN SINGAPORE - [22.11.2000] Entrust Technologies Inc., a global leader in solutions that bring trust to e-business, announced plans to establish a local presence in Singapore to better serve and support customers in the South East Asian markets. Recognizing the importance of the region as a hub of e-commerce growth, Entrust plans to directly invest in Singapore to create an infrastructure to expand business throughout South East Asia. Press release: < http://www.net-security.org/text/press/974858767,8054,.shtml > ---------------------------------------------------------------------------- ALADDIN RELEASES HASP CD9 WITH LINUX SUPPORT - [22.11.2000] Aladdin Knowledge Systems, a global leader in the field of Internet content and software security, announced the release of HASP CD9, the latest software for the HASP4 hardware-based software protection system that offers high-level security for Linux developers, as well as new ease-of-use features. Press release: < http://www.net-security.org/text/press/974858982,86834,.shtml > ---------------------------------------------------------------------------- PARTNERSHIP TO SECURE BUSINESS WEBS - [22.11.2000] Bowstreet, a leading provider of business web automation solutions for plug- and-play e-commerce, and Netegrity Inc., the leading provider of e-commerce infrastructure solutions for secure portal management, joined forces to bring enhanced security to "business webs." Business webs are emerging e-business networks that connect partner companies to lower transaction costs, generate new revenue, enable collaboration on new products and services, and deliver new value to customers. Press release: < http://www.net-security.org/text/press/974859095,77195,.shtml > ---------------------------------------------------------------------------- ZONE LABS AND TREND MICRO PARTNER - [24.11.2000] Zone Labs Inc., developers of the award-winning security products ZoneAlarm and ZoneAlarm Pro, and Trend Micro, a leading provider of enterprise antivirus and content security products, announced a far-reaching strategic partnership that allows Trend Micro to incorporate Zone Labs' patented technology in the next generation of Trend Micro's best-of-breed antivirus products. In addition, the agreement opens new co-marketing and distribution channels for each company. Press release: < http://www.net-security.org/text/press/975083837,5240,.shtml > ---------------------------------------------------------------------------- WEBTRENDS SECURITY ANALYZER AWARDED - [24.11.2000] WebTrends Corporation, the leading provider of Enterprise Solutions for eBusiness Intelligence and Visitor Relationship Management, announced that WebTrends Security Analyzer was awarded Editors' Choice in PC Magazine's November 16 roundup of security scanners. Press release: < http://www.net-security.org/text/press/975083917,88772,.shtml > ---------------------------------------------------------------------------- SONICWALL APPLIANCE AWARDED - [24.11.2000] SonicWALL, Inc., the market leader in Internet security solutions announced that its ipXpress load-balancing appliance has received the "Best of The Tests" award for Web Acceleration Tools from Network World magazine. The ipXpress was originally a product of Phobos Corporation, a manufacturer of secure transaction processing and load balancing products, which was recently acquired by SonicWALL. Press release: < http://www.net-security.org/text/press/975083972,90488,.shtml > ---------------------------------------------------------------------------- Featured articles ----------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org Below is the list of the recently added articles. ---------------------------------------------------------------------------- GUIDE TO KERNEL COMPILATION WITH SHORT REFERENCE TO THE NEW 'IPTABLES' FIREWALLING by Aleksandar Stancin aka D'Pressed In the following article I'll discuss, in brief, compiling of a new kernel, or an old one, which ever pleases you most, on a example of the upcoming kernel 2.4.0, by using the 2.4.0-test9 version, and some references on new and improved firewalling implemented in it, called iptable. Read more: < http://www.net-security.org/text/articles/compilation.shtml > ---------------------------------------------------------------------------- ENABLING A NEW PGP KEY by M. E. Kabay You will recall that PGP generates two keys at a time (a keypair) that are complementary: what one key encrypts, the other decrypts - and vice versa. One of the keys is made public; the other is kept secret by its user. This asymmetric encryption algorithm makes possible the public-key crypto-system, and that is very useful indeed. Read more: < http://www.net-security.org/text/articles/nwf/pgp.shtml > ---------------------------------------------------------------------------- Featured books ---------------- The HNS bookstore is located at: http://net-security.org/various/bookstore Suggestions for books to be included into our bookstore can be sent to staff@net-security.org ---------------------------------------------------------------------------- SUSE LINUX AND NETFINITY SERVER INTEGRATION GUIDE (REDBOOKS) >From the Back Cover: Here's all the information you need to maximize SuSE Linux performance and reliability on IBM's state-of-the-art Netfinity server platforms. In this book, a team of IBM's top Linux experts presents start-to-finish, Netfinity server-specific coverage of SuSE Linux 6.2/6.3 deployment and system administration throughout the entire system lifecycle! You'll get running fast with IBM's expert step-by-step preparation and installation techniques: review updating your BIOS and firmware; making the CD-ROM bootable, preparing SCSI devices, partitioning, configuration, XWindows setup, deploying IBM ServeRAID in SuSE Linux environments, and much more. Next, you'll master all the key techniques of day-to-day SuSE Linux system administration, including backup and recovery, Internet and email connectivity, DNS/DHCP name services, and using SuSE Linux with Samba as a world-class file/print server for Windows workstations. IBM-tested, proven, and crystal clear, this is the one essential book for everyone running SuSE Linux on Netfinity servers. Book: < http://www.amazon.com/exec/obidos/ASIN/0130286753/netsecurity > ---------------------------------------------------------------------------- VISUAL BASIC SHELL PROGRAMMING Windows users take advantage of shell extensions on the desktop every single day, but understanding what they are and how to program with them can be tricky and, until now anyway, usually required the use of Visual C++. Filled with expert knowledge of the underlying Windows shell COM objects, Visual Basic Shell Programming is all that you need to write shell-enabled applications that look more professional, as well as rival the functionality of programs that are written in C++. First and foremost, this efficiently packaged text is a reference to all of the COM objects and APIs that are needed to program with the Windows shell successfully. Each section is organized by topic, with an explanation of what kind of functionality you can add, and then all of the COM objects, methods, and constants that you'll need to use in VB, along with sample code. For many of the examples, a custom file extension (.rad) illustrates how to integrate this file into the desktop, and extend what it can do within the Windows desktop. Book: < http://www.amazon.com/exec/obidos/ASIN/1565926706/netsecurity > ---------------------------------------------------------------------------- Managing IMAP Topics covered: The Internet Mail Access Protocol and its implementation, especially in the University of Washington's IMAP server and the Cyrus IMAP server. After presenting the case for IMAP and comparing it to Post Office Protocol (POP), the book shows how to set up and administer both major IMAP servers. It also compares IMAP clients. Other topics that are covered include security, user management, and scalability. A directory of IMAP administration interfaces and an IMAP command reference round out the volume. Book: < http://www.amazon.com/exec/obidos/ASIN/059600012X/netsecurity > ---------------------------------------------------------------------------- THE UNIVERSAL HISTORY OF COMPUTING: FROM THE ABACUS TO THE QUANTUM COMPUTER >From the I Ching to AI, tremendous human brainpower has been devoted to devising easier means of counting and thinking. Former math teacher Georges Ifrah has devoted his life to tracking down traces of our early calculating tools and reporting on them with charm and verve. This book gives a grand title to a grand subject, and Ifrah makes good on his promise of universality by leaping far back in time and spanning all of the inhabited continents. If his scope is vast, his stories and details are still engrossing. Readers will hang on to the stories of 19th-century inventors who converged on multiplication machines and other, more general "engines," and better understand the roots of biological and quantum computation. Ifrah has great respect for our ancestors and their work, and he transmits this feeling to his readers with humor and humility. Book: < http://www.amazon.com/exec/obidos/ASIN/0471396710/netsecurity > ---------------------------------------------------------------------------- JAVA EXAMPLES IN A NUTSHELL Aimed at those who have some previous Java experience, Java Examples in a Nutshell, 2nd Edition provides an outstanding collection of code samples that are designed to help you improve your programming skills--by studying code that works. With over 150 expert examples that illustrate a wide range of Java APIs, this volume definitely can bring your knowledge of Java to the next level. Many programming titles rely on code excerpts to illustrate key programming concepts. This book reverses that approach by emphasizing the code itself, enhancing it with introductory material and explanations. While some short examples illustrate simple algorithms (such as random- number generation and sorting), many of the examples are substantial: for example, how to create a multithreaded Web server, a proxy server, and even a simple Web browser (by using built-in Swing classes for a user interface). These longer examples occupy several pages; generally, they're well-commented models of coding clarity. Book: < http://www.amazon.com/exec/obidos/ASIN/0596000391/netsecurity > ---------------------------------------------------------------------------- Security Software ------------------- All programs are located at: http://net-security.org/various/software ---------------------------------------------------------------------------- NCPQUERY V.1.2 NCPQuery is an open source tool that allows probing of a Novell Netware 5.0/5.1 server running IP. It uses TCP port 524 to enumerate objects with public read access, disclosing such information as account names, server services, and other various objects. A remote attacker can gather the equivalent information provided by the console command "display servers" and the DOS client command "cx /t /a /r" without authentication. Info/Download: < http://net-security.org/various/software/974254520,53276,.shtml > ---------------------------------------------------------------------------- LINUX INTRUSION DETECTION SYSTEM [UPDATE] The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it's in effect, many system administration operations can be made impossible even for root. You can turn the security protection on or off on the fly and you can hide sensitive processes and prevent anyone from using ptrace or any other capability on your system. LIDS can also provide raw device and I/O access protection. Changes: Fixed umount filesystem bug, fixed NFSd and FTPd capability usages, and sys_sysctl() bugfixed. Info/Download: < http://net-security.org/various/software/974467282,92979,.shtml > ---------------------------------------------------------------------------- COOKIE PAL 1.6 BETA 3 Cookie Pal is a complete Internet cookie management system for Windows 95 and NT 4.0. It lets you automatically accept or reject Internet cookies from all sites or just from sites you specify, without having to click on the Web browser's annoying "Cookie Alert" messages all the time. Cookie Pal also allows you to view and delete existing cookies on your system. Info/Download: < http://net-security.org/various/software/975086967,64299,.shtml > ---------------------------------------------------------------------------- EWALLET (PALM OS) 2.0 With eWallet you can store, protect, and back up your important information, and find it as soon as you need it. Have your most important personal information backed up for safekeeping, encrypted and password-protected for security on your Palm Powered handheld and desktop PC. Info/Download: < http://net-security.org/various/software/975087040,99608,.shtml > ---------------------------------------------------------------------------- CHAOS 2.04 The CHAOS data encryption system provides comprehensive and secure data storage and access control facilities. CHAOS data encryption offers protection against unauthorized data access. CHAOS is totally transparent for application programs. Info/Download: < http://net-security.org/various/software/975087395,68704,.shtml > ---------------------------------------------------------------------------- Defaced archives ------------------------ [21.11.2000] - Goodyear Indonesia Original: http://www.goodyear-indonesia.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/21/www.goodyear-indonesia.com/ [21.11.2000] - Alcatel Alcanet International Italia Original: http://www.alcatel.it/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/21/www.alcatel.it/ [22.11.2000] - Harley-Davidson Mexico Original: http://www.harley-davidson.com.mx/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/22/www.harley-davidson.com.mx/ [22.11.2000] - AIWA (UK) Ltd Original: http://www.aiwa.co.uk/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/22/www.aiwa.co.uk/ [22.11.2000] - Government of Guam Original: http://govt.gov.gu/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/22/govt.gov.gu/ [23.11.2000] - NEC Brasil Original: http://www.nec.com.br/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/www.nec.com.br/ [23.11.2000] - ADC Networks ISP Guadalajara, Mexico Original: http://www.adc.net.mx/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/www.adc.net.mx/ [23.11.2000] - Numazu Internetwork Council Original: http://www2.numazu-net.or.jp/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/www2.numazu-net.or.jp/ [23.11.2000] - Bulgarian Academy of Science Original: http://www.imbm.bas.bg/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/www.imbm.bas.bg/ [23.11.2000] - British Association of Web Professionals Original: http://www.bawp.co.uk/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/www.bawp.co.uk/ [23.11.2000] - National Aeronautics and Space Administration Langley Research Center Original: http://vabpcnt2.larc.nasa.gov/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/vabpcnt2.larc.nasa.gov/ [23.11.2000] - Nintendo Spain Original: http://www.nintendo.es/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/www.nintendo.es/ [23.11.2000] - NEC Colombia Original: http://www.nec.com.co/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/www.nec.com.co/ [23.11.2000] - Stanford University Original: http://daily.stanford.edu/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/daily.stanford.edu/ [23.11.2000] - UIS KG (YU) Original: http://www.uis.kg.ac.yu/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/www.uis.kg.ac.yu/ [23.11.2000] - TMF BG (YU) Original: http://www.tmf.bg.ac.yu/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/23/www.tmf.bg.ac.yu/ [24.11.2000] - Naval School of Health Science, San Diego Original: http://nshssd.med.navy.mil/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/24/nshssd.med.navy.mil/ [24.11.2000] - Information on Social Security Original: http://www.socialsecurity.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/24/www.socialsecurity.com/ [24.11.2000] - MicroProse, Inc. Original: http://www.microprose.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/24/www.microprose.com/ [25.11.2000] - Hyundai Motor Company Original: http://www.hyundai-motor.com/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/25/www.hyundai-motor.com/ [25.11.2000] - Massachusetts Institute of Technology Original: http://ac.mit.edu/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/25/ac.mit.edu/ [25.11.2000] - California Department of Transportation Original: http://www.dot.ca.gov/ Defaced: http://www.attrition.org/mirror/attrition/2000/11/25/www.dot.ca.gov/ ---------------------------------------------------------------------------- Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org