SecurityFocus Microsoft Newsletter #196
----------------------------------------
This Issue is Sponsored By: SecurityFocus
Want to keep up on the latest security vulnerabilities? Don't have time to
visit a myriad of mailing lists and websites to read the news? Just add the
new SecurityFocus RSS feeds to your freeware RSS reader, and see all the
latest posts for Bugtraq and the SF Vulnernability database in one
convenient place. Or, pull in the latest news, columnists and feature
articles in the SecurityFocus aggregated news feed, and stay on top of
what's happening in the community!
I. FRONT AND CENTER
1. Close the E-Mail Wiretap Loophole
2. Multi-Layer Intrusion Detection Systems
II. MICROSOFT VULNERABILITY SUMMARY
1. vBulletin newreply.php Cross-Site Scripting Vulnerability
2. MPlayer GUI File Name Buffer Overflow Vulnerability
3. McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Scrip...
4. Apache ap_escape_html Memory Allocation Denial Of Service Vu...
5. Sun Java Runtime Environment Font Object Assertion Failure D...
6. Microsoft Internet Explorer Cross-Domain Frame Loading Vulne...
7. IBM Lotus Domino IMAP Quota Changing Vulnerability
8. Netegrity IdentityMinder Multiple Cross-Site Scripting Vulne...
9. Qbik WinGate Information Disclosure Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
1. supressing IE (Thread)
2. Non Admin Rights + Visual Studio (Thread)
3. Consumer Security Web Site (Thread)
4. Administrivia: Out of Office Autoreplies (Thread)
5. Article Announcement: Redmond's Butterfly Effect (Thread)
6. SecurityFocus Microsoft Newsletter #195 (Thread)
7. RE: Consumer Security Web Site (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
1. Network Time System
2. Anon-Encrypt
3. RSI
4. WiSSH
5. Firewall RuleMaker
6. CAT Cellular Authentication Token and eAuthentication Servic...
V. NEW TOOLS FOR MICROSOFT PLATFORMS
1. Ettercap v0.7.0 pre2
2. Athena 1.0
3. CryptoHeaven v2.4.0
4. XArp 0.1
5. Honeynet Security Console 1.0
6. LogMonitor 1.0
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Close the E-Mail Wiretap Loophole
By Mark Rasch
Some pretty sleazy operators are slipping through a hole in a federal
wiretap law that arguably leaves your e-mail unprotected from snooping.
http://www.securityfocus.com/columnists/253
2. Multi-Layer Intrusion Detection Systems
By Nathan Einwechter
This article discusses framework for a mIDS, a system that brings together
many layers of technology into a single monitoring and analysis engine,
from integrity monitoring software like Tripwire to system logs, IDS logs,
and firewall logs.
http://www.securityfocus.com/infocus/1788
II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. vBulletin newreply.php Cross-Site Scripting Vulnerability
BugTraq ID: 10612
Remote: Yes
Date Published: Jun 26 2004
Relevant URL: http://www.securityfocus.com/bid/10612
Summary:
vBulletin is reportedly affected by a cross-site scripting vulnerability in the newreply.php script. This issue is due to a failure of the application to properly sanitize user-supplied URI input.
An attacker may exploit this issue to have malicious HTML or script code executed in the browser of an unsuspecting user and within the context of a visited web site. This may potentially lead to theft of cookie based authentication credentials, other attacks are also possible.
2. MPlayer GUI File Name Buffer Overflow Vulnerability
BugTraq ID: 10615
Remote: Yes
Date Published: Jun 28 2004
Relevant URL: http://www.securityfocus.com/bid/10615
Summary:
It has been reported that MPlayer when used with the graphical user interface (GUI) is affected by a buffer overflow vulnerability. This issue is due to a failure of the application to properly handle user-supplied strings when copying them into finite buffers.
Successful exploitation would immediately produce a denial of service condition in the affected process. This issue may also be leveraged to execute code on the affected system within the security context of the user running the vulnerable process.
3. McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Scrip...
BugTraq ID: 10617
Remote: Yes
Date Published: Jun 28 2004
Relevant URL: http://www.securityfocus.com/bid/10617
Summary:
Cart32 is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.
A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If a user follows this link, the hostile code renders in the web browser of the victim user. Theft of cookie-based authentication credentials and other attacks is possible.
Cart32 version 5.0 and prior are considered prone to this issue.
4. Apache ap_escape_html Memory Allocation Denial Of Service Vu...
BugTraq ID: 10619
Remote: Yes
Date Published: Jun 28 2004
Relevant URL: http://www.securityfocus.com/bid/10619
Summary:
Apache Web Server is reportedly affected by a memory allocation based denial of service vulnerability. This issue is due to a failure of the server to handle excessivley long HTTP header strings.
This issue would allow an attacker to cause the affected application to crash, denying service to legitimate users.
Although Apache version 2.0.49 reportedly affected by this issue, it is likely that earlier versions are affected as well.
5. Sun Java Runtime Environment Font Object Assertion Failure D...
BugTraq ID: 10623
Remote: Yes
Date Published: Jun 28 2004
Relevant URL: http://www.securityfocus.com/bid/10623
Summary:
The Sun Java Runtime Environment Font object is reportedly vulnerable to an assertion failure denial of service vulnerability. This issue is due to a failure of the process to handle exceptional conditions when processing font objects.
This issue is reported to affect Java Runtime Environment versions 1.4.1 through 1.4.2; it is likely however that other versions are also affected. This issue will crash Internet browsers running an affected Java plug-in as well.
This issue may be exploited by an attacker to cause a vulnerable application, as well as all processes spawned from the application, to crash, denying service to legitimate users. Due to the scope of the crash, data loss may occur.
6. Microsoft Internet Explorer Cross-Domain Frame Loading Vulne...
BugTraq ID: 10627
Remote: Yes
Date Published: Jun 29 2004
Relevant URL: http://www.securityfocus.com/bid/10627
Summary:
Microsoft Internet Explorer is reported prone to a cross-domain frame loading vulnerability. It is reported that if the name of a frame rendered in a target site is known, then an attacker may potentially render arbitrary HTML in the frame of the target site.
An attacker may exploit this vulnerability to spoof an interface of a trusted web site.
7. IBM Lotus Domino IMAP Quota Changing Vulnerability
BugTraq ID: 10642
Remote: Yes
Date Published: Jun 30 2004
Relevant URL: http://www.securityfocus.com/bid/10642
Summary:
IBM Lotus Domino server is reported to improperly allow users to alter their own mail storage quota values.
A user's mailbox is assigned a quota to limit the amount of data that can be consumed by email on the server. This quota is assigned by the administrator of the application.
An attacker could possibly use this vulnerability to raise their mailbox's quota to a very large amount, and then proceed to fill the mail servers storage device. This will result in a denial of service condition, where new mail will not be able to be stored on the full disk.
Domino version 6.5.0 and 6.5.1 are reported vulnerable to this issue.
8. Netegrity IdentityMinder Multiple Cross-Site Scripting Vulne...
BugTraq ID: 10645
Remote: Yes
Date Published: Jul 01 2004
Relevant URL: http://www.securityfocus.com/bid/10645
Summary:
Netegrity IdentityMinder is a tool designed for the Microsoft Windows platform to manage and maintain users and user accounts. The tool supports a web based interface for creating and removing users in multi-user environments.
It has been reported that Netegrity IdentityMinder is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials as well as arbitrary application command execution.
9. Qbik WinGate Information Disclosure Vulnerability
BugTraq ID: 10646
Remote: Yes
Date Published: Jul 02 2004
Relevant URL: http://www.securityfocus.com/bid/10646
Summary:
WinGate is reported susceptible to an information disclosure vulnerability in its HTTP proxy server.
An internal web server contained in WinGate improperly allows attackers access to read arbitrary files outside of its document root. WinGate by default runs as the localsystem user, therefore this vulnerability allows remote attackers to read system files.
An attacker can exploit this issue to read arbitrary files contained on the WinGate computer. These files may contain sensitive information that may aid in further attacks.
III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. supressing IE (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/368056
2. Non Admin Rights + Visual Studio (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367999
3. Consumer Security Web Site (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367705
4. Administrivia: Out of Office Autoreplies (Thread)
Relevant URL:
6. SecurityFocus Microsoft Newsletter #195 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367553
7. RE: Consumer Security Web Site (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367497
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. Network Time System
By: Softros Systems Inc.
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://nts.softros.com/
Summary:
Network Time System - Secure, fast and accurate time sync software across entire network.
2. Anon-Encrypt
By: RiserSoft Corporation
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://risersoft.com/anon-encrypt.php
Summary:
Surf the Internet Totally Anonymous, and Fully Encrypted with our Internet Explorer Pluging!
3. RSI
By: Digital Labs, LLC
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.digitallabs.net/rsi/
Summary:
Remote System Information audits your network for critical hardware and software information and displays the results in a clear, exportable spreadsheet view.
Remote Registry technology provides the ability to dynamically scan your network without the need to install client software.
4. WiSSH
By: Digital Labs, LLC
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.wissh.com
Summary:
WiSSH (Windows over SSH) utilizes SSH tunneling technology to secure Microsoft's RDP protocol. Allows access to multiple hosts behind your network perimeter with only a single host's SSH port open to the Internet
5. Firewall RuleMaker
By: The Net Memetic Pte Ltd
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://firewall.rulemaker.net
Summary:
Firewall RuleMaker is a Windows-based firewall configuration version control software product for managers of Cisco PIX and Netscreen firewalls.
6. CAT Cellular Authentication Token and eAuthentication Servic...
By: Mega AS Consulting Ltd
Platforms: Java, Linux, OpenBSD, Os Independent, SecureBSD, Solaris, UNIX, Windows 2000, Windows NT
Relevant URL: http://www.megaas.co.nz
Summary:
Low cost, easy to use Two Factor Authentication One Time Password token using the Cellular. Does not use SMS or communication, manages multiple OTP accounts - new technology. For any business that want a safer access to its Internet Services. More information at our site.
We also provide eAuthentication service for businesses that will not buy an Authentication product but would prefer to pay a monthly charge for authentication services from our our CAT Server.
V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. Ettercap v0.7.0 pre2
By: ALoR <alor (at) users.sourceforge (dot) net [email concealed]>
Relevant URL: http://ettercap.sourceforge.net/
Platforms: FreeBSD, Linux, MacOS, NetBSD, Windows 2000, Windows NT, Windows XP
Summary:
Ettercap is a network sniffer/interceptor/logger for ethernet LANs. It supports active and passive dissection of many protocols (even ciphered ones, like SSH and HTTPS). Data injection in an established connection and filtering on the fly is also possible, keeping the connection synchronized. Many sniffing modes were implemented to give you a powerful and complete sniffing suite. Plugins are supported. It has the ability to check whether you are in a switched LAN or not, and to use OS fingerprints (active or passive) to let you know the geometry of the LAN.
2. Athena 1.0
By: Steve Lord
Relevant URL: http://www.buyukada.co.uk/projects/athena/
Platforms: Windows 2000, Windows XP
Summary:
Athena is a search engine query tool designed to help find information leakage vulnerabilties using 'googledork' strings. Athena uses an extensible configuration format that supports multiple search engines (Yahoo and Google included). Athena is designed with ease of use in mind and a full illustrated manual is included featuring a full walkthrough.
3. CryptoHeaven v2.4.0
By: Marcin Kurzawa <marcin (at) cryptoheaven (dot) com [email concealed]>
Relevant URL: http://www.cryptoheaven.com/
Platforms: UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:
CryptoHeaven offers secure email and online file sharing/storage. Its main features are secure and highly encrypted services such as group collaboration, file sharing, email, online storage, and instant messaging. It integrates multi-user based security into email, instant messaging, and file storage and sharing in one unique package. It provides real time communication for text and data transfers in a multi-user secure environment. The security and usability of CryptoHeaven is well-balanced; even the no-so-technically oriented computer users can enjoy this crypto product with very high level of encryption.
4. XArp 0.1
By: Christoph Mayer
Relevant URL: http://www.chrismc.de
Platforms: Windows 2000, Windows XP
Summary:
XArp is a graphical tool to monitor the ARP cache. It periodically requests the local ARP cache and reports changes in the IP to MAC mapping. Thus it can be used to recognize ARP poisoning which is used to prepare 'man in the middle' attacks on switched networks.
5. Honeynet Security Console 1.0
By: Activeworx, Inc.
Relevant URL: http://www.activeworx.org
Platforms: Windows 2000, Windows XP
Summary:
Honeynet Security Console is an analysis tool to view events on your personal honeynet. It gives you the power to view events from Snort, TCPDump, Firewall, Syslog and Sebek logs. It also allows you to correlate events from each of these data types to have a full grasp of the attackers' actions.
6. LogMonitor 1.0
By: Adam Richard/SécurIT Informatique Inc.
Relevant URL: ftp://ftp.digitalvoodoo.org/pub/mirrors/securit/Logmon10free.zip
Platforms: Windows 2000, Windows NT, Windows XP
Summary:
LogMonitor is a log analysis console. It is 75% based on LogIDS, excepted for the GUI which is a complete makeover. Instead of focusing on network location, LogMonitor presents the data in a set of floating windows grouped by application, which may be a more intuitive interface to some people. The analysis is performed by defining the fields of each log we are monitoring, and then by using these fields to define rules as to what is important data or not.
VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe (at) securityfocus (dot) com [email concealed] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email listadmin (at) securityfocus (dot) com [email concealed] and ask to be manually removed.
VII. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored By: SecurityFocus
Want to keep up on the latest security vulnerabilities? Don't have time to
visit a myriad of mailing lists and websites to read the news? Just add the
new SecurityFocus RSS feeds to your freeware RSS reader, and see all the
latest posts for Bugtraq and the SF Vulnernability database in one
convenient place. Or, pull in the latest news, columnists and feature
articles in the SecurityFocus aggregated news feed, and stay on top of
what's happening in the community!
----------------------------------------
This Issue is Sponsored By: SecurityFocus
Want to keep up on the latest security vulnerabilities? Don't have time to
visit a myriad of mailing lists and websites to read the news? Just add the
new SecurityFocus RSS feeds to your freeware RSS reader, and see all the
latest posts for Bugtraq and the SF Vulnernability database in one
convenient place. Or, pull in the latest news, columnists and feature
articles in the SecurityFocus aggregated news feed, and stay on top of
what's happening in the community!
http://www.securityfocus.com/rss/index.shtml
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Close the E-Mail Wiretap Loophole
2. Multi-Layer Intrusion Detection Systems
II. MICROSOFT VULNERABILITY SUMMARY
1. vBulletin newreply.php Cross-Site Scripting Vulnerability
2. MPlayer GUI File Name Buffer Overflow Vulnerability
3. McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Scrip...
4. Apache ap_escape_html Memory Allocation Denial Of Service Vu...
5. Sun Java Runtime Environment Font Object Assertion Failure D...
6. Microsoft Internet Explorer Cross-Domain Frame Loading Vulne...
7. IBM Lotus Domino IMAP Quota Changing Vulnerability
8. Netegrity IdentityMinder Multiple Cross-Site Scripting Vulne...
9. Qbik WinGate Information Disclosure Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
1. supressing IE (Thread)
2. Non Admin Rights + Visual Studio (Thread)
3. Consumer Security Web Site (Thread)
4. Administrivia: Out of Office Autoreplies (Thread)
5. Article Announcement: Redmond's Butterfly Effect (Thread)
6. SecurityFocus Microsoft Newsletter #195 (Thread)
7. RE: Consumer Security Web Site (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
1. Network Time System
2. Anon-Encrypt
3. RSI
4. WiSSH
5. Firewall RuleMaker
6. CAT Cellular Authentication Token and eAuthentication Servic...
V. NEW TOOLS FOR MICROSOFT PLATFORMS
1. Ettercap v0.7.0 pre2
2. Athena 1.0
3. CryptoHeaven v2.4.0
4. XArp 0.1
5. Honeynet Security Console 1.0
6. LogMonitor 1.0
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Close the E-Mail Wiretap Loophole
By Mark Rasch
Some pretty sleazy operators are slipping through a hole in a federal
wiretap law that arguably leaves your e-mail unprotected from snooping.
http://www.securityfocus.com/columnists/253
2. Multi-Layer Intrusion Detection Systems
By Nathan Einwechter
This article discusses framework for a mIDS, a system that brings together
many layers of technology into a single monitoring and analysis engine,
from integrity monitoring software like Tripwire to system logs, IDS logs,
and firewall logs.
http://www.securityfocus.com/infocus/1788
II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. vBulletin newreply.php Cross-Site Scripting Vulnerability
BugTraq ID: 10612
Remote: Yes
Date Published: Jun 26 2004
Relevant URL: http://www.securityfocus.com/bid/10612
Summary:
vBulletin is reportedly affected by a cross-site scripting vulnerability in the newreply.php script. This issue is due to a failure of the application to properly sanitize user-supplied URI input.
An attacker may exploit this issue to have malicious HTML or script code executed in the browser of an unsuspecting user and within the context of a visited web site. This may potentially lead to theft of cookie based authentication credentials, other attacks are also possible.
2. MPlayer GUI File Name Buffer Overflow Vulnerability
BugTraq ID: 10615
Remote: Yes
Date Published: Jun 28 2004
Relevant URL: http://www.securityfocus.com/bid/10615
Summary:
It has been reported that MPlayer when used with the graphical user interface (GUI) is affected by a buffer overflow vulnerability. This issue is due to a failure of the application to properly handle user-supplied strings when copying them into finite buffers.
Successful exploitation would immediately produce a denial of service condition in the affected process. This issue may also be leveraged to execute code on the affected system within the security context of the user running the vulnerable process.
3. McMurtrey/Whitaker & Associates Cart32 GetLatestBuilds Scrip...
BugTraq ID: 10617
Remote: Yes
Date Published: Jun 28 2004
Relevant URL: http://www.securityfocus.com/bid/10617
Summary:
Cart32 is reported prone to a cross-site scripting vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.
A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If a user follows this link, the hostile code renders in the web browser of the victim user. Theft of cookie-based authentication credentials and other attacks is possible.
Cart32 version 5.0 and prior are considered prone to this issue.
4. Apache ap_escape_html Memory Allocation Denial Of Service Vu...
BugTraq ID: 10619
Remote: Yes
Date Published: Jun 28 2004
Relevant URL: http://www.securityfocus.com/bid/10619
Summary:
Apache Web Server is reportedly affected by a memory allocation based denial of service vulnerability. This issue is due to a failure of the server to handle excessivley long HTTP header strings.
This issue would allow an attacker to cause the affected application to crash, denying service to legitimate users.
Although Apache version 2.0.49 reportedly affected by this issue, it is likely that earlier versions are affected as well.
5. Sun Java Runtime Environment Font Object Assertion Failure D...
BugTraq ID: 10623
Remote: Yes
Date Published: Jun 28 2004
Relevant URL: http://www.securityfocus.com/bid/10623
Summary:
The Sun Java Runtime Environment Font object is reportedly vulnerable to an assertion failure denial of service vulnerability. This issue is due to a failure of the process to handle exceptional conditions when processing font objects.
This issue is reported to affect Java Runtime Environment versions 1.4.1 through 1.4.2; it is likely however that other versions are also affected. This issue will crash Internet browsers running an affected Java plug-in as well.
This issue may be exploited by an attacker to cause a vulnerable application, as well as all processes spawned from the application, to crash, denying service to legitimate users. Due to the scope of the crash, data loss may occur.
6. Microsoft Internet Explorer Cross-Domain Frame Loading Vulne...
BugTraq ID: 10627
Remote: Yes
Date Published: Jun 29 2004
Relevant URL: http://www.securityfocus.com/bid/10627
Summary:
Microsoft Internet Explorer is reported prone to a cross-domain frame loading vulnerability. It is reported that if the name of a frame rendered in a target site is known, then an attacker may potentially render arbitrary HTML in the frame of the target site.
An attacker may exploit this vulnerability to spoof an interface of a trusted web site.
7. IBM Lotus Domino IMAP Quota Changing Vulnerability
BugTraq ID: 10642
Remote: Yes
Date Published: Jun 30 2004
Relevant URL: http://www.securityfocus.com/bid/10642
Summary:
IBM Lotus Domino server is reported to improperly allow users to alter their own mail storage quota values.
A user's mailbox is assigned a quota to limit the amount of data that can be consumed by email on the server. This quota is assigned by the administrator of the application.
An attacker could possibly use this vulnerability to raise their mailbox's quota to a very large amount, and then proceed to fill the mail servers storage device. This will result in a denial of service condition, where new mail will not be able to be stored on the full disk.
Domino version 6.5.0 and 6.5.1 are reported vulnerable to this issue.
8. Netegrity IdentityMinder Multiple Cross-Site Scripting Vulne...
BugTraq ID: 10645
Remote: Yes
Date Published: Jul 01 2004
Relevant URL: http://www.securityfocus.com/bid/10645
Summary:
Netegrity IdentityMinder is a tool designed for the Microsoft Windows platform to manage and maintain users and user accounts. The tool supports a web based interface for creating and removing users in multi-user environments.
It has been reported that Netegrity IdentityMinder is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials as well as arbitrary application command execution.
9. Qbik WinGate Information Disclosure Vulnerability
BugTraq ID: 10646
Remote: Yes
Date Published: Jul 02 2004
Relevant URL: http://www.securityfocus.com/bid/10646
Summary:
WinGate is reported susceptible to an information disclosure vulnerability in its HTTP proxy server.
An internal web server contained in WinGate improperly allows attackers access to read arbitrary files outside of its document root. WinGate by default runs as the localsystem user, therefore this vulnerability allows remote attackers to read system files.
An attacker can exploit this issue to read arbitrary files contained on the WinGate computer. These files may contain sensitive information that may aid in further attacks.
III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. supressing IE (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/368056
2. Non Admin Rights + Visual Studio (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367999
3. Consumer Security Web Site (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367705
4. Administrivia: Out of Office Autoreplies (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367638
5. Article Announcement: Redmond's Butterfly Effect (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367635
6. SecurityFocus Microsoft Newsletter #195 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367553
7. RE: Consumer Security Web Site (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/367497
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. Network Time System
By: Softros Systems Inc.
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://nts.softros.com/
Summary:
Network Time System - Secure, fast and accurate time sync software across entire network.
2. Anon-Encrypt
By: RiserSoft Corporation
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://risersoft.com/anon-encrypt.php
Summary:
Surf the Internet Totally Anonymous, and Fully Encrypted with our Internet Explorer Pluging!
3. RSI
By: Digital Labs, LLC
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.digitallabs.net/rsi/
Summary:
Remote System Information audits your network for critical hardware and software information and displays the results in a clear, exportable spreadsheet view.
Remote Registry technology provides the ability to dynamically scan your network without the need to install client software.
4. WiSSH
By: Digital Labs, LLC
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.wissh.com
Summary:
WiSSH (Windows over SSH) utilizes SSH tunneling technology to secure Microsoft's RDP protocol. Allows access to multiple hosts behind your network perimeter with only a single host's SSH port open to the Internet
5. Firewall RuleMaker
By: The Net Memetic Pte Ltd
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://firewall.rulemaker.net
Summary:
Firewall RuleMaker is a Windows-based firewall configuration version control software product for managers of Cisco PIX and Netscreen firewalls.
6. CAT Cellular Authentication Token and eAuthentication Servic...
By: Mega AS Consulting Ltd
Platforms: Java, Linux, OpenBSD, Os Independent, SecureBSD, Solaris, UNIX, Windows 2000, Windows NT
Relevant URL: http://www.megaas.co.nz
Summary:
Low cost, easy to use Two Factor Authentication One Time Password token using the Cellular. Does not use SMS or communication, manages multiple OTP accounts - new technology. For any business that want a safer access to its Internet Services. More information at our site.
We also provide eAuthentication service for businesses that will not buy an Authentication product but would prefer to pay a monthly charge for authentication services from our our CAT Server.
V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. Ettercap v0.7.0 pre2
By: ALoR <alor (at) users.sourceforge (dot) net [email concealed]>
Relevant URL: http://ettercap.sourceforge.net/
Platforms: FreeBSD, Linux, MacOS, NetBSD, Windows 2000, Windows NT, Windows XP
Summary:
Ettercap is a network sniffer/interceptor/logger for ethernet LANs. It supports active and passive dissection of many protocols (even ciphered ones, like SSH and HTTPS). Data injection in an established connection and filtering on the fly is also possible, keeping the connection synchronized. Many sniffing modes were implemented to give you a powerful and complete sniffing suite. Plugins are supported. It has the ability to check whether you are in a switched LAN or not, and to use OS fingerprints (active or passive) to let you know the geometry of the LAN.
2. Athena 1.0
By: Steve Lord
Relevant URL: http://www.buyukada.co.uk/projects/athena/
Platforms: Windows 2000, Windows XP
Summary:
Athena is a search engine query tool designed to help find information leakage vulnerabilties using 'googledork' strings. Athena uses an extensible configuration format that supports multiple search engines (Yahoo and Google included). Athena is designed with ease of use in mind and a full illustrated manual is included featuring a full walkthrough.
3. CryptoHeaven v2.4.0
By: Marcin Kurzawa <marcin (at) cryptoheaven (dot) com [email concealed]>
Relevant URL: http://www.cryptoheaven.com/
Platforms: UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:
CryptoHeaven offers secure email and online file sharing/storage. Its main features are secure and highly encrypted services such as group collaboration, file sharing, email, online storage, and instant messaging. It integrates multi-user based security into email, instant messaging, and file storage and sharing in one unique package. It provides real time communication for text and data transfers in a multi-user secure environment. The security and usability of CryptoHeaven is well-balanced; even the no-so-technically oriented computer users can enjoy this crypto product with very high level of encryption.
4. XArp 0.1
By: Christoph Mayer
Relevant URL: http://www.chrismc.de
Platforms: Windows 2000, Windows XP
Summary:
XArp is a graphical tool to monitor the ARP cache. It periodically requests the local ARP cache and reports changes in the IP to MAC mapping. Thus it can be used to recognize ARP poisoning which is used to prepare 'man in the middle' attacks on switched networks.
5. Honeynet Security Console 1.0
By: Activeworx, Inc.
Relevant URL: http://www.activeworx.org
Platforms: Windows 2000, Windows XP
Summary:
Honeynet Security Console is an analysis tool to view events on your personal honeynet. It gives you the power to view events from Snort, TCPDump, Firewall, Syslog and Sebek logs. It also allows you to correlate events from each of these data types to have a full grasp of the attackers' actions.
6. LogMonitor 1.0
By: Adam Richard/SécurIT Informatique Inc.
Relevant URL: ftp://ftp.digitalvoodoo.org/pub/mirrors/securit/Logmon10free.zip
Platforms: Windows 2000, Windows NT, Windows XP
Summary:
LogMonitor is a log analysis console. It is 75% based on LogIDS, excepted for the GUI which is a complete makeover. Instead of focusing on network location, LogMonitor presents the data in a set of floating windows grouped by application, which may be a more intuitive interface to some people. The analysis is performed by defining the fields of each log we are monitoring, and then by using these fields to define rules as to what is important data or not.
VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe (at) securityfocus (dot) com [email concealed] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email listadmin (at) securityfocus (dot) com [email concealed] and ask to be manually removed.
VII. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored By: SecurityFocus
Want to keep up on the latest security vulnerabilities? Don't have time to
visit a myriad of mailing lists and websites to read the news? Just add the
new SecurityFocus RSS feeds to your freeware RSS reader, and see all the
latest posts for Bugtraq and the SF Vulnernability database in one
convenient place. Or, pull in the latest news, columnists and feature
articles in the SecurityFocus aggregated news feed, and stay on top of
what's happening in the community!
http://www.securityfocus.com/rss/index.shtml
------------------------------------------------------------------------
[ reply ]