SecurityFocus Microsoft Newsletter #157
----------------------------------------
This Issue is Sponsored By: ClearSight Networks
Do you remember the first time you jumped into a pool or the ocean wearing
a mask? Remember how clear the view underwater was?
ClearSight Networks has introduced a network analyzer that promises to
show you your network from a brand new visual perspective. It is easy-to-
use, visual, and quickly pinpoints problems. Download a full working
Trial Demo for free and see the difference.
Click here to get more information and a free product download.
http://www.securityfocus.com/sponsor/ClearSightNetworks_ms-secnews_03100
6
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Wireless Policy Development (Part Two)
2. Exploiting Cisco Routers (Part One)
3. Fame, Infame, All the Same
4. Linux vs. Windows Viruses
5. SPECIAL ANNOUNCEMENT
II. MICROSOFT VULNERABILITY SUMMARY
1. OmniCom winShadow Server Login Denial of Service Vulnerabili...
2. OmniCom winShadow hostname Buffer Overflow Vulnerability
3. Megacomputing Personal-WebServer Professional Remote Directo...
4. A-Cart MSG Cross-Site Scripting Vulnerability
5. Megacomputing Personal-WebServer Professional Denial Of Serv...
6. mIRC USERHOST Buffer Overflow Vulnerability
7. Half-Life Invalid Command Error Response Format String Vulne...
8. Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
9. Invision Power Board Insecure Permissions Vulnerability
10. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
11. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
12. MPNews PRO Directory Traversal Information Disclosure Vulner...
13. Mutant Penguin MPWeb PRO Directory Traversal Vulnerability
14. Microsoft Windows PostThreadMessage() Arbitrary Process Kill...
III. MICROSOFT FOCUS LIST SUMMARY
1. Wasn't someone looking for a Group Policy collection... (Thread)
2. R: Registry Settings for Group Policy Security Optio... (Thread)
3. Article Announcement: Linux vs. Windows Viruses (Thread)
4. windows ce exploits (Thread)
5. New exploit circulating for IE vulnerability (Thread)
6. Registry Settings for Group Policy Security Options (Thread)
7. IPsec vs any personal software firewall (Thread)
8. SecurityFocus Microsoft Newsletter #156 (Thread)
9. IPsec vs any personal software firewall (Thread)
10. Article Announcement: Lost in Translation (Thread)
11. Blocking and allowing ActiveX (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
1. East-Tec Eraser 2003 v4.0
2. ZoneAlarm Pro 4.0
3. ActiveScout Enterprise
4. Immunity CANVAS
5. Password Creator Pro
6. Advanced Cisco Security Agent
V. NEW TOOLS FOR MICROSOFT PLATFORMS
1. OpenSSL 0.9.7c
2. Glub Tech Secure FTP v2.0.10
3. mrtg v2.10.5
4. ACID-XML v1.0
5. borZoi v1.0.2
6. Shishi v0.0.7
VI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Wireless Policy Development (Part Two)
By Jamil Farshchi
This is the second of a two-part series that will help create a framework
for the most important aspect of any wireless security strategy -- policy
development.
http://www.securityfocus.com/infocus/1735
2. Exploiting Cisco Routers (Part One)
By Mark Wolfgang
This is the first of a three-part series that will focus on identifying
and then exploiting vulnerabilities and poor configurations in Cisco
routers.
http://www.securityfocus.com/infocus/1734
3. Fame, Infame, All the Same
By George Smith
Blowing the lid off the altruistic computer security town-crier angle.
http://www.securityfocus.com/columnists/189
4. Linux vs. Windows Viruses
By Scott Granneman
To mess up a Linux box, you need to work at it; to mess up your Windows
box, you just need to work on it.
http://www.securityfocus.com/columnists/188
5. SPECIAL ANNOUNCEMENT
SecurityFocus is pleased to announce the relaunch of our RSS feeds.
http://www.securityfocus.com/rss/index.shtml
II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. OmniCom winShadow Server Login Denial of Service Vulnerabili...
BugTraq ID: 8719
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8719
Summary:
OmniCom winShadow is a remote desktop tool designed for Microsoft Windows
platform. The software can be used to access remote systems through the
Internet or local area networks.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to cause a denial of service condition in the winShadow
server. The issue may present itself when an attacker sends long string
values to the server for user name and password during the login process.
This issue may cause the software to behave in an unstable manner leading
to a crash.
Successful exploitation of this issue may allow an attacker to cause the
software to crash or hang. It is not known if this condition may also be
exploited to execute arbitrary code.
OmniCom winShadow version 2.0 has been reported to be prone to this issue,
however other versions may be affected as well.
2. OmniCom winShadow hostname Buffer Overflow Vulnerability
BugTraq ID: 8720
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8720
Summary:
OmniCom winShadow is a remote desktop tool designed for Microsoft Windows
platform. The software can be used to access remote systems through the
Internet or local area networks.
A vulnerability has been reported to exist in the winShadow client that
may allow a remote attacker to gain unauthorized access to a vulnerable
system by executing arbitrary code on a vulnerable system. The condition
is present due to insufficient boundary checking.
It has been reported that winShadow saves hostnames in host files saved as
*.osh. The process responsible for reading hostnames from these files may
be prone to a buffer overflow condition if an attacker is able to pass an
extra 250 bytes in the hostname parameter. An attacker may leverage the
issue by exploiting an unbounded memory copy operation to overwrite the
saved return address/base pointer, causing the affected procedure to
return to an address of their choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
OmniCom winShadow version 2.0 has been reported to be prone to this issue,
however other versions may be affected as well.
3. Megacomputing Personal-WebServer Professional Remote Directo...
BugTraq ID: 8721
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8721
Summary:
Megacomputing Personal-WebServer Professional is a commercially-available
web server for personal websites. It is available for the Microsoft
Windows platform.
A problem has been identified in the handling of requests for files
outside of the web server root. Because of this, an attacker may be able
to gain unauthorized access to sensitive information.
The problem is in the handling of directory traversal requests. By
placing a request for a specific file outside the web root directory using
dot-dot-slash (../) or dot-dot-backslash (..\) requests, it is possible
for a user to gain unauthorized access with read permissions of the web
server process.
4. A-Cart MSG Cross-Site Scripting Vulnerability
BugTraq ID: 8722
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8722
Summary:
Alan Ward's A-Cart is a web based shopping cart application. It is
implemented in ASP, and designed for use with Microsoft Access under
Microsoft Windows based servers.
A-Cart has been reported prone to a cross-site scripting vulnerability.
The issue presents itself likely due to a lack of sufficient sanitization
performed on data contained in the 'msg' URI parameter that is passed to
signin.asp.
An attacker could exploit this condition to render arbitrary HTML in the
browser of a victim, stealing cookie authentication credentials or
performing other nefarious acts.
5. Megacomputing Personal-WebServer Professional Denial Of Serv...
BugTraq ID: 8723
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8723
Summary:
Megacomputing Personal-WebServer Professional is a commercially-available
web server for personal websites. It is available for the Microsoft
Windows platform.
A problem has been identified in the handling of requests of excessive
length by Megacomputing Personal-WebServer Professional. Because of this,
an attacker may be able to deny service to legitimate users of an affected
web server.
The problem is in the handling of strings of 255 or more bytes. By
placing a request for a URI of the previously mentioned length, it is
possible to crash the server. This condition may be due to a boundary
condition error, potentially resulting in memory corruption. If this is
the case, there is a possibility that this issue could be taken advantage
of to execute arbitrary code with the privileges of the web server
process. However, this theory has not yet been proven.
6. mIRC USERHOST Buffer Overflow Vulnerability
BugTraq ID: 8728
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8728
Summary:
mIRC is a chat client for the IRC protocol, designed for Microsoft Windows
based operating systems.
A vulnerability has been reported to exist in the mIRC client that may
allow a remote attacker to gain unauthorized access by executing arbitrary
code on a vulnerable system. The condition is present due to insufficient
boundary checking.
It has been reported that during the connection process mIRC client sends
a USERHOST request to the server to receive the user's host information.
This process may lead to a buffer overflow condition if the server
responds to the request with a string that is larger than 110 bytes. An
attacker may leverage the issue by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing the
affected procedure to return to an address of their choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
mIRC versions 6.01 to 6.1 have been reported to be prone to this issue,
however other versions may be affected as well.
7. Half-Life Invalid Command Error Response Format String Vulne...
BugTraq ID: 8730
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8730
Summary:
The Half-Life client is a component of the Half-Life game distributed by
Valve Software. It is available for Microsoft Windows operating systems.
A vulnerability has been reported for the Half-Life client. The problem
occurs when displaying error messages triggered by invalid commands.
Typically, when an invalid command is issued in a client console, the
command is sent to the server and an error message containing the command
is returned. This error is then displayed within the client console.
It has been reported that one of the functions used to display the error
information fails to sufficiently define format specifiers for the invalid
command. As a result, a format specifier embedded within the command will
be interpreted by the erroneous function call.
This vulnerability could theoretically be exploited to execute arbitrary
code with the privileges of the Half-Life client. This may be accomplished
via a malicious Half-Life server, or possibly a script file loaded and
executed by the victim.
8. Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
BugTraq ID: 8734
Remote: Yes
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8734
Summary:
Gamespy 3D is a Microsoft Windows based application used to find game
servers for various games. The software also has a built in IRC client
for chat and file sharing.
A vulnerability has been reported to exist in the Gamespy 3D IRC client
that may allow a remote attacker to gain unauthorized access by executing
arbitrary code on a vulnerable system. The condition is present due to
insufficient boundary checking.
It has been reported that during the connection process the IRC client
sends USER and NICK requests to the IRC server to receive the user
information. This process may lead to a buffer overflow condition if the
server responds to the request with a string that is larger than or equal
to 262 bytes. An attacker may leverage the issue by exploiting an
unbounded memory copy operation to overwrite the saved return address/base
pointer, causing the affected procedure to return to an address of their
choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
Gamespy 3D versions 2.63015 and prior have been reported to be prone to
this issue, however other versions may be affected as well.
9. Invision Power Board Insecure Permissions Vulnerability
BugTraq ID: 8737
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8737
Summary:
Invision Power Board is web forum software. It is implemented in PHP and
is available for Unix and Linux variants and Microsoft Windows operating
systems.
Invision Power Board has been reported prone to a configuration issue that
could allow attackers with local interactive access to modify Invision
Power Board '.php' source files. The issue has been reported to present
itself because Invision Power Board does not correctly set permissions on
folders during the installation process. Specifically all folders are
created with group write permissions. Any local user who is a member of
the same group as Invision Power Board may make modifications to Invision
Power Board source files.
A local attacker may exploit this condition to execute arbitrary code with
the privileges of the web server.
It should be noted that although this vulnerability has been reported to
affect Invision Power Board versions 1.1.1 and 1.1.2, other versions might
also be affected.
10. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
BugTraq ID: 8742
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8742
Summary:
IBM DB2 is a commercial relational database implementation that is
available for a number of operating systems including Microsoft Windows
and Unix/Linux variants.
IBM DB2 includes the LOAD command, which allows for data located in files,
pipes or devices to be stored within a database table. It has been
discovered that the application fails to carry out sufficient bounds
checking when handling the LOAD command.
An attacker with 'Connect' privileges could exploit this vulnerability
remotely, likely by passing excessive data as an argument to the LOAD
command. This would allow for sensitive stack variables adjacent to the
affected memory buffer to be overrun. An attacker could leverage this
memory corruption to influence the execution flow of IBM DB2, possibly
redirecting execution into a malicious payload.
All code executed in this manner will be run with the privileges of the
IBM DB2 process. This is typically the 'Administrators' group on Microsoft
Windows environments and either the 'db2as' or 'db2inst1' users on Linux
systems.
It should be noted that IBM has confirmed that the affected code is shared
amongst IBM DB2 v7 and v8, making both vulnerable to this condition.
11. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
BugTraq ID: 8743
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8743
Summary:
DB2 is the database implementation maintained and distributed by IBM. It
is available for the UNIX, Linux, and Microsoft Windows platforms.
A problem in IBM DB2 has been reported when specific queries are passed to
the INVOKE stored procedure. Because of this, an attacker may be able to
gain unauthorized access to system resources.
The problem is in the checking of bounds on the INVOKE stored procedure.
By passing a maliciously crafted string to the procedure, it is possible
to overwrite sensitive regions of stack memory. An attacker could take
advantage of this issue to execute code at an arbitrary location in memory
with the privileges of the database process.
This problem has been reported to occur in version 7.2 for Microsoft
Windows only.
12. MPNews PRO Directory Traversal Information Disclosure Vulner...
BugTraq ID: 8744
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8744
Summary:
MPNews PRO is a news server available for the Microsoft Windows operating
system.
It has been reported that MPNews PRO is prone to an information disclosure
vulnerability. The problem is believed to occur due to MPNews PRO failing
to sufficiently filter specific dot-dot-slash sequences (../).
Specifically, making a request for a file prefixed by a sequence of
"./../" may cause the request to be interpreted outside of the web root.
As a result, an attacker may be capable of viewing the contents of
arbitrary files on the local system.
Access to these files my expose sensitive information to the attacker that
could potentially be used in launching further attacks against the target
system.
13. Mutant Penguin MPWeb PRO Directory Traversal Vulnerability
BugTraq ID: 8745
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8745
Summary:
Mutant Penguin MPWeb PRO is a Microsoft Windows based web server. It
allows users to create and host dynamic web sites.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to traverse outside the server root directory in order
to access sensitive server readable files. The issue presents itself due
to insufficient sanitization of user-supplied input and may allow an
attacker to access unauthorized information by issuing '/./../' character
sequences.
This vulnerability may be successfully exploited to gain sensitive
information about a vulnerable host that could be used to launch further
attacks against the system.
MPWeb PRO version 1.1.2 has been reported to be affected by this issue,
however other versions may be vulnerable as well.
14. Microsoft Windows PostThreadMessage() Arbitrary Process Kill...
BugTraq ID: 8747
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8747
Summary:
The Microsoft Windows operating system includes a wide variety of API
function calls. One such call is the PostThreadMessage() function, which
can be used to send a variety of messages to a specified thread. This
function will fail if the specified thread does not include a message
queue. A queue will only be created if the thread has issued a Win32 USER
or GDI function call.
Included in the various messages that can be sent to a process are the
WM_QUIT, WM_DESTROY, and WM_CLOSE messages. These messages are
specifically designed to notify a process that it should subsequently be
terminated.
It has been discovered that processes sent these messages fail to
sufficiently verify their origin, and proceed to terminate. As a result,
an unprivileged program running with the privileges of any local user may
be capable of sending one of the three messages to an arbitrary process
and cause it to terminate. This will occur no matter what security level
the target process may be running at. As mentioned above, the targeted
process must include a message queue at the time of exploitation.
This vulnerability could be exploited by a local attacker to disable
various security-related software designed to limit a local users ability
to carry out various actions. Other processes may also be targeted.
III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Wasn't someone looking for a Group Policy collection... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340330
2. R: Registry Settings for Group Policy Security Optio... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340104
3. Article Announcement: Linux vs. Windows Viruses (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340103
4. windows ce exploits (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340102
5. New exploit circulating for IE vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339998
6. Registry Settings for Group Policy Security Options (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339997
7. IPsec vs any personal software firewall (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339820
8. SecurityFocus Microsoft Newsletter #156 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339667
9. IPsec vs any personal software firewall (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339664
10. Article Announcement: Lost in Translation (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339522
11. Blocking and allowing ActiveX (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339483
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. East-Tec Eraser 2003 v4.0
By: EAST Technologies
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.east-tec.com/eraser/index.htm
Summary:
East-Tec Eraser ("Eraser" in short) is an advanced security application
for Windows 95/98/Me/NT/2000/XP designed to help you completely eliminate
sensitive data from your computer and protect your computer and Internet
privacy.
Eraser introduces a new meaning for the verb TO ERASE. Erasing a file now
means wiping its contents beyond recovery, scrambling its name and dates
and finally removing it from disk. When you want to get rid of sensitive
files or folders beyond recovery, add them to the Eraser list of doomed
files and ask Eraser to do the job. Eraser offers tight integration with
the Windows shell, so you can drag files and folders from Explorer and
drop them in Eraser, or you can erase them directly from Explorer by
selecting Erase beyond recovery from the context menu.
2. ZoneAlarm Pro 4.0
By: Zone Labs
Platforms: Windows 2000, Windows 95/98, Windows XP
Relevant URL: http://www.zonelabs.com
Summary:
Hackers lurk everywhere on the Internet, waiting for an "in" into your
personal and financial information. Even legitimate Web sites have
sophisticated methods of snooping, such as cookies that track your
identity and browsing habits. You need nothing less than the industry's
best protection?ZoneAlarm Pro. It offers you the award-winning firewall
that Zone Labs is famous for. Plus, it stops annoying and potentially
malicious cookies and pop-ups from invading your system.
3. ActiveScout Enterprise
By: ForeScout Technologies
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.forescout.com/enterprise.html
Summary:
ActiveScout Enterprises actively protects a network with multiple access
points. In addition to the identification of attackers and automatic
action to stop them, this solution offers full management capabilities,
from configuration and reporting, to the sharing of threat information
between multiple deployed scouts.
4. Immunity CANVAS
By: Immunity, Inc.
Platforms: Linux, Windows 2000
Relevant URL: http://www.immunitysec.com/CANVAS/
Summary:
Immunity CANVAS is 100% pure Python, and every license includes full
access to the entire CANVAS codebase. Python is one of the easiest
languages to learn, so even novice programmers can be productive on the
CANVAS API, should they so chose.
Immunity CANVAS is both a valuable demonstration tool for enterprise
information security teams or system adminstrators, and an advanced
development platform for exploit developers, or people learning to become
exploit developers.
5. Password Creator Pro
By: TransDigital Solutions
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: https://www.transdig.com/products/pcp/pcp.cfm
Summary:
Password Creator Professional is an extremely full featured password
generator utility for Windows.
6. Advanced Cisco Security Agent
By: Cisco Systems
Platforms: Solaris, Windows 2000, Windows NT, Windows XP
Relevant URL:
http://www.cisco.com/en/US/products/sw/secursw/ps5057/index.html
Summary:
The advanced Cisco Security Agent product provides threat protection for
server and desktop computing systems, also known as endpoints. The Cisco
Security Agent goes beyond conventional host and desktop security
solutions by identifying and preventing malicious behavior before it can
occur, thereby removing potential known and unknown ("Day Zero") security
risks that threaten enterprise networks and applications. The Cisco
Security Agent aggregates and extends multiple endpoint security functions
by providing host intrusion prevention, distributed firewall, malicious
mobile code protection, operating system integrity assurance, and audit
log consolidation all within a single agent package.
V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. OpenSSL 0.9.7c
By: The OpenSSL Project Team <openssl (at) openssl (dot) org [email concealed]>
Relevant URL: http://www.openssl.org/
Platforms: UNIX, Windows NT
Summary:
The OpenSSL Project is a collaborative effort to develop a robust,
commercial-grade, fully featured, and Open Source toolkit implementing the
Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as
well as a full-strength general-purpose cryptography library.
2. Glub Tech Secure FTP v2.0.10
By: glub
Relevant URL: http://secureftp.glub.com
Platforms: MacOS, UNIX, Windows 2000, Windows 95/98, Windows NT, Windows
XP
Summary:
Glub Tech Secure FTP is a command-line utility that allows FTP connections
to be made using SSL.
3. mrtg v2.10.5
By: Tobias Oetiker
Relevant URL: http://people.ee.ethz.ch/~oetiker/webtools/mrtg/
Platforms: POSIX, Windows 2000, Windows NT
Summary:
The Multi Router Traffic Grapher (MRTG) is a tool to monitor the traffic
load on network-links. MRTG generates HTML pages containing GIF/PNG images
which provide a live visual representation of this traffic.
4. ACID-XML v1.0
By: Sleepy
Relevant URL: http://www.maximumunix.org/ACID-XML/
Platforms: FreeBSD, Linux, NetBSD, OpenBSD, Windows 2000, Windows 95/98,
Windows XP
Summary:
ACID XML is a stand alone application that can read and parse snort
xml logs. It was inspired by ACID, but was designed so you can get up and
running quickly
with your logs rather than spending hours getting ACID requirments
together and
working.it uses QT and expat and it is fully open source.
5. borZoi v1.0.2
By: Anthony Mulcahy
Relevant URL: http://dragongate-technologies.com/products.html
Platforms: Windows 2000, Windows 95/98, Windows NT
Summary:
borZoi is an elliptic curve cryptography library for developers who want a
simple means of adding privacy protection to their applications. Ease of
use and a minimum risk of security problems due to incorrect use are its
strong points.
6. Shishi v0.0.7
By: Simon Josefsson
Relevant URL: http://www.gnu.org/software/shishi/
Platforms: UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:
Shishi is a (still incomplete) implementation of Kerberos 5, which can be
used to authenticate users in distributed systems. It contains a library
that can be used by application developers, and a command line utility for
users. Shishi supports Kerberos authenticated telnet client/server, IMAP
client/server (via GSSAPI), SSH client/server (via GSSAPI), rsh/rlogin
client, and a PAM module for host security.
VI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored By: ClearSight Networks
Do you remember the first time you jumped into a pool or the ocean wearing
a mask? Remember how clear the view underwater was?
ClearSight Networks has introduced a network analyzer that promises to
show you your network from a brand new visual perspective. It is easy-to-
use, visual, and quickly pinpoints problems. Download a full working
Trial Demo for free and see the difference.
Click here to get more information and a free product download.
http://www.securityfocus.com/sponsor/ClearSightNetworks_ms-secnews_03100
6
------------------------------------------------------------------------
------------------------------------------------------------------------
---
Visual & Easy-to-use are not words that you think of when talking about
network analyzers. Need to share problem information with colleagues that
do not read packets?
Download ClearSight Networks Analyzer and see a new network analysis tool
that makes the complex - easy
http://www.securityfocus.com/sponsor/ClearSightNetworks_focus-ms_031006
------------------------------------------------------------------------
---
----------------------------------------
This Issue is Sponsored By: ClearSight Networks
Do you remember the first time you jumped into a pool or the ocean wearing
a mask? Remember how clear the view underwater was?
ClearSight Networks has introduced a network analyzer that promises to
show you your network from a brand new visual perspective. It is easy-to-
use, visual, and quickly pinpoints problems. Download a full working
Trial Demo for free and see the difference.
Click here to get more information and a free product download.
http://www.securityfocus.com/sponsor/ClearSightNetworks_ms-secnews_03100
6
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Wireless Policy Development (Part Two)
2. Exploiting Cisco Routers (Part One)
3. Fame, Infame, All the Same
4. Linux vs. Windows Viruses
5. SPECIAL ANNOUNCEMENT
II. MICROSOFT VULNERABILITY SUMMARY
1. OmniCom winShadow Server Login Denial of Service Vulnerabili...
2. OmniCom winShadow hostname Buffer Overflow Vulnerability
3. Megacomputing Personal-WebServer Professional Remote Directo...
4. A-Cart MSG Cross-Site Scripting Vulnerability
5. Megacomputing Personal-WebServer Professional Denial Of Serv...
6. mIRC USERHOST Buffer Overflow Vulnerability
7. Half-Life Invalid Command Error Response Format String Vulne...
8. Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
9. Invision Power Board Insecure Permissions Vulnerability
10. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
11. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
12. MPNews PRO Directory Traversal Information Disclosure Vulner...
13. Mutant Penguin MPWeb PRO Directory Traversal Vulnerability
14. Microsoft Windows PostThreadMessage() Arbitrary Process Kill...
III. MICROSOFT FOCUS LIST SUMMARY
1. Wasn't someone looking for a Group Policy collection... (Thread)
2. R: Registry Settings for Group Policy Security Optio... (Thread)
3. Article Announcement: Linux vs. Windows Viruses (Thread)
4. windows ce exploits (Thread)
5. New exploit circulating for IE vulnerability (Thread)
6. Registry Settings for Group Policy Security Options (Thread)
7. IPsec vs any personal software firewall (Thread)
8. SecurityFocus Microsoft Newsletter #156 (Thread)
9. IPsec vs any personal software firewall (Thread)
10. Article Announcement: Lost in Translation (Thread)
11. Blocking and allowing ActiveX (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
1. East-Tec Eraser 2003 v4.0
2. ZoneAlarm Pro 4.0
3. ActiveScout Enterprise
4. Immunity CANVAS
5. Password Creator Pro
6. Advanced Cisco Security Agent
V. NEW TOOLS FOR MICROSOFT PLATFORMS
1. OpenSSL 0.9.7c
2. Glub Tech Secure FTP v2.0.10
3. mrtg v2.10.5
4. ACID-XML v1.0
5. borZoi v1.0.2
6. Shishi v0.0.7
VI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Wireless Policy Development (Part Two)
By Jamil Farshchi
This is the second of a two-part series that will help create a framework
for the most important aspect of any wireless security strategy -- policy
development.
http://www.securityfocus.com/infocus/1735
2. Exploiting Cisco Routers (Part One)
By Mark Wolfgang
This is the first of a three-part series that will focus on identifying
and then exploiting vulnerabilities and poor configurations in Cisco
routers.
http://www.securityfocus.com/infocus/1734
3. Fame, Infame, All the Same
By George Smith
Blowing the lid off the altruistic computer security town-crier angle.
http://www.securityfocus.com/columnists/189
4. Linux vs. Windows Viruses
By Scott Granneman
To mess up a Linux box, you need to work at it; to mess up your Windows
box, you just need to work on it.
http://www.securityfocus.com/columnists/188
5. SPECIAL ANNOUNCEMENT
SecurityFocus is pleased to announce the relaunch of our RSS feeds.
http://www.securityfocus.com/rss/index.shtml
II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. OmniCom winShadow Server Login Denial of Service Vulnerabili...
BugTraq ID: 8719
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8719
Summary:
OmniCom winShadow is a remote desktop tool designed for Microsoft Windows
platform. The software can be used to access remote systems through the
Internet or local area networks.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to cause a denial of service condition in the winShadow
server. The issue may present itself when an attacker sends long string
values to the server for user name and password during the login process.
This issue may cause the software to behave in an unstable manner leading
to a crash.
Successful exploitation of this issue may allow an attacker to cause the
software to crash or hang. It is not known if this condition may also be
exploited to execute arbitrary code.
OmniCom winShadow version 2.0 has been reported to be prone to this issue,
however other versions may be affected as well.
2. OmniCom winShadow hostname Buffer Overflow Vulnerability
BugTraq ID: 8720
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8720
Summary:
OmniCom winShadow is a remote desktop tool designed for Microsoft Windows
platform. The software can be used to access remote systems through the
Internet or local area networks.
A vulnerability has been reported to exist in the winShadow client that
may allow a remote attacker to gain unauthorized access to a vulnerable
system by executing arbitrary code on a vulnerable system. The condition
is present due to insufficient boundary checking.
It has been reported that winShadow saves hostnames in host files saved as
*.osh. The process responsible for reading hostnames from these files may
be prone to a buffer overflow condition if an attacker is able to pass an
extra 250 bytes in the hostname parameter. An attacker may leverage the
issue by exploiting an unbounded memory copy operation to overwrite the
saved return address/base pointer, causing the affected procedure to
return to an address of their choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
OmniCom winShadow version 2.0 has been reported to be prone to this issue,
however other versions may be affected as well.
3. Megacomputing Personal-WebServer Professional Remote Directo...
BugTraq ID: 8721
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8721
Summary:
Megacomputing Personal-WebServer Professional is a commercially-available
web server for personal websites. It is available for the Microsoft
Windows platform.
A problem has been identified in the handling of requests for files
outside of the web server root. Because of this, an attacker may be able
to gain unauthorized access to sensitive information.
The problem is in the handling of directory traversal requests. By
placing a request for a specific file outside the web root directory using
dot-dot-slash (../) or dot-dot-backslash (..\) requests, it is possible
for a user to gain unauthorized access with read permissions of the web
server process.
4. A-Cart MSG Cross-Site Scripting Vulnerability
BugTraq ID: 8722
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8722
Summary:
Alan Ward's A-Cart is a web based shopping cart application. It is
implemented in ASP, and designed for use with Microsoft Access under
Microsoft Windows based servers.
A-Cart has been reported prone to a cross-site scripting vulnerability.
The issue presents itself likely due to a lack of sufficient sanitization
performed on data contained in the 'msg' URI parameter that is passed to
signin.asp.
An attacker could exploit this condition to render arbitrary HTML in the
browser of a victim, stealing cookie authentication credentials or
performing other nefarious acts.
5. Megacomputing Personal-WebServer Professional Denial Of Serv...
BugTraq ID: 8723
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8723
Summary:
Megacomputing Personal-WebServer Professional is a commercially-available
web server for personal websites. It is available for the Microsoft
Windows platform.
A problem has been identified in the handling of requests of excessive
length by Megacomputing Personal-WebServer Professional. Because of this,
an attacker may be able to deny service to legitimate users of an affected
web server.
The problem is in the handling of strings of 255 or more bytes. By
placing a request for a URI of the previously mentioned length, it is
possible to crash the server. This condition may be due to a boundary
condition error, potentially resulting in memory corruption. If this is
the case, there is a possibility that this issue could be taken advantage
of to execute arbitrary code with the privileges of the web server
process. However, this theory has not yet been proven.
6. mIRC USERHOST Buffer Overflow Vulnerability
BugTraq ID: 8728
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8728
Summary:
mIRC is a chat client for the IRC protocol, designed for Microsoft Windows
based operating systems.
A vulnerability has been reported to exist in the mIRC client that may
allow a remote attacker to gain unauthorized access by executing arbitrary
code on a vulnerable system. The condition is present due to insufficient
boundary checking.
It has been reported that during the connection process mIRC client sends
a USERHOST request to the server to receive the user's host information.
This process may lead to a buffer overflow condition if the server
responds to the request with a string that is larger than 110 bytes. An
attacker may leverage the issue by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing the
affected procedure to return to an address of their choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
mIRC versions 6.01 to 6.1 have been reported to be prone to this issue,
however other versions may be affected as well.
7. Half-Life Invalid Command Error Response Format String Vulne...
BugTraq ID: 8730
Remote: Yes
Date Published: Sep 29 2003
Relevant URL: http://www.securityfocus.com/bid/8730
Summary:
The Half-Life client is a component of the Half-Life game distributed by
Valve Software. It is available for Microsoft Windows operating systems.
A vulnerability has been reported for the Half-Life client. The problem
occurs when displaying error messages triggered by invalid commands.
Typically, when an invalid command is issued in a client console, the
command is sent to the server and an error message containing the command
is returned. This error is then displayed within the client console.
It has been reported that one of the functions used to display the error
information fails to sufficiently define format specifiers for the invalid
command. As a result, a format specifier embedded within the command will
be interpreted by the erroneous function call.
This vulnerability could theoretically be exploited to execute arbitrary
code with the privileges of the Half-Life client. This may be accomplished
via a malicious Half-Life server, or possibly a script file loaded and
executed by the victim.
8. Gamespy 3d IRC Client Remote Buffer Overflow Vulnerability
BugTraq ID: 8734
Remote: Yes
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8734
Summary:
Gamespy 3D is a Microsoft Windows based application used to find game
servers for various games. The software also has a built in IRC client
for chat and file sharing.
A vulnerability has been reported to exist in the Gamespy 3D IRC client
that may allow a remote attacker to gain unauthorized access by executing
arbitrary code on a vulnerable system. The condition is present due to
insufficient boundary checking.
It has been reported that during the connection process the IRC client
sends USER and NICK requests to the IRC server to receive the user
information. This process may lead to a buffer overflow condition if the
server responds to the request with a string that is larger than or equal
to 262 bytes. An attacker may leverage the issue by exploiting an
unbounded memory copy operation to overwrite the saved return address/base
pointer, causing the affected procedure to return to an address of their
choice.
Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the client in order to gain unauthorized
access to a vulnerable system.
Gamespy 3D versions 2.63015 and prior have been reported to be prone to
this issue, however other versions may be affected as well.
9. Invision Power Board Insecure Permissions Vulnerability
BugTraq ID: 8737
Remote: No
Date Published: Sep 30 2003
Relevant URL: http://www.securityfocus.com/bid/8737
Summary:
Invision Power Board is web forum software. It is implemented in PHP and
is available for Unix and Linux variants and Microsoft Windows operating
systems.
Invision Power Board has been reported prone to a configuration issue that
could allow attackers with local interactive access to modify Invision
Power Board '.php' source files. The issue has been reported to present
itself because Invision Power Board does not correctly set permissions on
folders during the installation process. Specifically all folders are
created with group write permissions. Any local user who is a member of
the same group as Invision Power Board may make modifications to Invision
Power Board source files.
A local attacker may exploit this condition to execute arbitrary code with
the privileges of the web server.
It should be noted that although this vulnerability has been reported to
affect Invision Power Board versions 1.1.1 and 1.1.2, other versions might
also be affected.
10. IBM DB2 Remote LOAD Command Buffer Overrun Vulnerability
BugTraq ID: 8742
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8742
Summary:
IBM DB2 is a commercial relational database implementation that is
available for a number of operating systems including Microsoft Windows
and Unix/Linux variants.
IBM DB2 includes the LOAD command, which allows for data located in files,
pipes or devices to be stored within a database table. It has been
discovered that the application fails to carry out sufficient bounds
checking when handling the LOAD command.
An attacker with 'Connect' privileges could exploit this vulnerability
remotely, likely by passing excessive data as an argument to the LOAD
command. This would allow for sensitive stack variables adjacent to the
affected memory buffer to be overrun. An attacker could leverage this
memory corruption to influence the execution flow of IBM DB2, possibly
redirecting execution into a malicious payload.
All code executed in this manner will be run with the privileges of the
IBM DB2 process. This is typically the 'Administrators' group on Microsoft
Windows environments and either the 'db2as' or 'db2inst1' users on Linux
systems.
It should be noted that IBM has confirmed that the affected code is shared
amongst IBM DB2 v7 and v8, making both vulnerable to this condition.
11. IBM DB2 Invoke Stored Procedure Buffer Overflow Vulnerabilit...
BugTraq ID: 8743
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8743
Summary:
DB2 is the database implementation maintained and distributed by IBM. It
is available for the UNIX, Linux, and Microsoft Windows platforms.
A problem in IBM DB2 has been reported when specific queries are passed to
the INVOKE stored procedure. Because of this, an attacker may be able to
gain unauthorized access to system resources.
The problem is in the checking of bounds on the INVOKE stored procedure.
By passing a maliciously crafted string to the procedure, it is possible
to overwrite sensitive regions of stack memory. An attacker could take
advantage of this issue to execute code at an arbitrary location in memory
with the privileges of the database process.
This problem has been reported to occur in version 7.2 for Microsoft
Windows only.
12. MPNews PRO Directory Traversal Information Disclosure Vulner...
BugTraq ID: 8744
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8744
Summary:
MPNews PRO is a news server available for the Microsoft Windows operating
system.
It has been reported that MPNews PRO is prone to an information disclosure
vulnerability. The problem is believed to occur due to MPNews PRO failing
to sufficiently filter specific dot-dot-slash sequences (../).
Specifically, making a request for a file prefixed by a sequence of
"./../" may cause the request to be interpreted outside of the web root.
As a result, an attacker may be capable of viewing the contents of
arbitrary files on the local system.
Access to these files my expose sensitive information to the attacker that
could potentially be used in launching further attacks against the target
system.
13. Mutant Penguin MPWeb PRO Directory Traversal Vulnerability
BugTraq ID: 8745
Remote: Yes
Date Published: Oct 01 2003
Relevant URL: http://www.securityfocus.com/bid/8745
Summary:
Mutant Penguin MPWeb PRO is a Microsoft Windows based web server. It
allows users to create and host dynamic web sites.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to traverse outside the server root directory in order
to access sensitive server readable files. The issue presents itself due
to insufficient sanitization of user-supplied input and may allow an
attacker to access unauthorized information by issuing '/./../' character
sequences.
This vulnerability may be successfully exploited to gain sensitive
information about a vulnerable host that could be used to launch further
attacks against the system.
MPWeb PRO version 1.1.2 has been reported to be affected by this issue,
however other versions may be vulnerable as well.
14. Microsoft Windows PostThreadMessage() Arbitrary Process Kill...
BugTraq ID: 8747
Remote: No
Date Published: Oct 02 2003
Relevant URL: http://www.securityfocus.com/bid/8747
Summary:
The Microsoft Windows operating system includes a wide variety of API
function calls. One such call is the PostThreadMessage() function, which
can be used to send a variety of messages to a specified thread. This
function will fail if the specified thread does not include a message
queue. A queue will only be created if the thread has issued a Win32 USER
or GDI function call.
Included in the various messages that can be sent to a process are the
WM_QUIT, WM_DESTROY, and WM_CLOSE messages. These messages are
specifically designed to notify a process that it should subsequently be
terminated.
It has been discovered that processes sent these messages fail to
sufficiently verify their origin, and proceed to terminate. As a result,
an unprivileged program running with the privileges of any local user may
be capable of sending one of the three messages to an arbitrary process
and cause it to terminate. This will occur no matter what security level
the target process may be running at. As mentioned above, the targeted
process must include a message queue at the time of exploitation.
This vulnerability could be exploited by a local attacker to disable
various security-related software designed to limit a local users ability
to carry out various actions. Other processes may also be targeted.
III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Wasn't someone looking for a Group Policy collection... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340330
2. R: Registry Settings for Group Policy Security Optio... (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340104
3. Article Announcement: Linux vs. Windows Viruses (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340103
4. windows ce exploits (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/340102
5. New exploit circulating for IE vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339998
6. Registry Settings for Group Policy Security Options (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339997
7. IPsec vs any personal software firewall (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339820
8. SecurityFocus Microsoft Newsletter #156 (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339667
9. IPsec vs any personal software firewall (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339664
10. Article Announcement: Lost in Translation (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339522
11. Blocking and allowing ActiveX (Thread)
Relevant URL:
http://www.securityfocus.com/archive/88/339483
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. East-Tec Eraser 2003 v4.0
By: EAST Technologies
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.east-tec.com/eraser/index.htm
Summary:
East-Tec Eraser ("Eraser" in short) is an advanced security application
for Windows 95/98/Me/NT/2000/XP designed to help you completely eliminate
sensitive data from your computer and protect your computer and Internet
privacy.
Eraser introduces a new meaning for the verb TO ERASE. Erasing a file now
means wiping its contents beyond recovery, scrambling its name and dates
and finally removing it from disk. When you want to get rid of sensitive
files or folders beyond recovery, add them to the Eraser list of doomed
files and ask Eraser to do the job. Eraser offers tight integration with
the Windows shell, so you can drag files and folders from Explorer and
drop them in Eraser, or you can erase them directly from Explorer by
selecting Erase beyond recovery from the context menu.
2. ZoneAlarm Pro 4.0
By: Zone Labs
Platforms: Windows 2000, Windows 95/98, Windows XP
Relevant URL: http://www.zonelabs.com
Summary:
Hackers lurk everywhere on the Internet, waiting for an "in" into your
personal and financial information. Even legitimate Web sites have
sophisticated methods of snooping, such as cookies that track your
identity and browsing habits. You need nothing less than the industry's
best protection?ZoneAlarm Pro. It offers you the award-winning firewall
that Zone Labs is famous for. Plus, it stops annoying and potentially
malicious cookies and pop-ups from invading your system.
3. ActiveScout Enterprise
By: ForeScout Technologies
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.forescout.com/enterprise.html
Summary:
ActiveScout Enterprises actively protects a network with multiple access
points. In addition to the identification of attackers and automatic
action to stop them, this solution offers full management capabilities,
from configuration and reporting, to the sharing of threat information
between multiple deployed scouts.
4. Immunity CANVAS
By: Immunity, Inc.
Platforms: Linux, Windows 2000
Relevant URL: http://www.immunitysec.com/CANVAS/
Summary:
Immunity CANVAS is 100% pure Python, and every license includes full
access to the entire CANVAS codebase. Python is one of the easiest
languages to learn, so even novice programmers can be productive on the
CANVAS API, should they so chose.
Immunity CANVAS is both a valuable demonstration tool for enterprise
information security teams or system adminstrators, and an advanced
development platform for exploit developers, or people learning to become
exploit developers.
5. Password Creator Pro
By: TransDigital Solutions
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: https://www.transdig.com/products/pcp/pcp.cfm
Summary:
Password Creator Professional is an extremely full featured password
generator utility for Windows.
6. Advanced Cisco Security Agent
By: Cisco Systems
Platforms: Solaris, Windows 2000, Windows NT, Windows XP
Relevant URL:
http://www.cisco.com/en/US/products/sw/secursw/ps5057/index.html
Summary:
The advanced Cisco Security Agent product provides threat protection for
server and desktop computing systems, also known as endpoints. The Cisco
Security Agent goes beyond conventional host and desktop security
solutions by identifying and preventing malicious behavior before it can
occur, thereby removing potential known and unknown ("Day Zero") security
risks that threaten enterprise networks and applications. The Cisco
Security Agent aggregates and extends multiple endpoint security functions
by providing host intrusion prevention, distributed firewall, malicious
mobile code protection, operating system integrity assurance, and audit
log consolidation all within a single agent package.
V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. OpenSSL 0.9.7c
By: The OpenSSL Project Team <openssl (at) openssl (dot) org [email concealed]>
Relevant URL: http://www.openssl.org/
Platforms: UNIX, Windows NT
Summary:
The OpenSSL Project is a collaborative effort to develop a robust,
commercial-grade, fully featured, and Open Source toolkit implementing the
Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as
well as a full-strength general-purpose cryptography library.
2. Glub Tech Secure FTP v2.0.10
By: glub
Relevant URL: http://secureftp.glub.com
Platforms: MacOS, UNIX, Windows 2000, Windows 95/98, Windows NT, Windows
XP
Summary:
Glub Tech Secure FTP is a command-line utility that allows FTP connections
to be made using SSL.
3. mrtg v2.10.5
By: Tobias Oetiker
Relevant URL: http://people.ee.ethz.ch/~oetiker/webtools/mrtg/
Platforms: POSIX, Windows 2000, Windows NT
Summary:
The Multi Router Traffic Grapher (MRTG) is a tool to monitor the traffic
load on network-links. MRTG generates HTML pages containing GIF/PNG images
which provide a live visual representation of this traffic.
4. ACID-XML v1.0
By: Sleepy
Relevant URL: http://www.maximumunix.org/ACID-XML/
Platforms: FreeBSD, Linux, NetBSD, OpenBSD, Windows 2000, Windows 95/98,
Windows XP
Summary:
ACID XML is a stand alone application that can read and parse snort
xml logs. It was inspired by ACID, but was designed so you can get up and
running quickly
with your logs rather than spending hours getting ACID requirments
together and
working.it uses QT and expat and it is fully open source.
5. borZoi v1.0.2
By: Anthony Mulcahy
Relevant URL: http://dragongate-technologies.com/products.html
Platforms: Windows 2000, Windows 95/98, Windows NT
Summary:
borZoi is an elliptic curve cryptography library for developers who want a
simple means of adding privacy protection to their applications. Ease of
use and a minimum risk of security problems due to incorrect use are its
strong points.
6. Shishi v0.0.7
By: Simon Josefsson
Relevant URL: http://www.gnu.org/software/shishi/
Platforms: UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:
Shishi is a (still incomplete) implementation of Kerberos 5, which can be
used to authenticate users in distributed systems. It contains a library
that can be used by application developers, and a command line utility for
users. Shishi supports Kerberos authenticated telnet client/server, IMAP
client/server (via GSSAPI), SSH client/server (via GSSAPI), rsh/rlogin
client, and a PAM module for host security.
VI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored By: ClearSight Networks
Do you remember the first time you jumped into a pool or the ocean wearing
a mask? Remember how clear the view underwater was?
ClearSight Networks has introduced a network analyzer that promises to
show you your network from a brand new visual perspective. It is easy-to-
use, visual, and quickly pinpoints problems. Download a full working
Trial Demo for free and see the difference.
Click here to get more information and a free product download.
http://www.securityfocus.com/sponsor/ClearSightNetworks_ms-secnews_03100
6
------------------------------------------------------------------------
------------------------------------------------------------------------
---
Visual & Easy-to-use are not words that you think of when talking about
network analyzers. Need to share problem information with colleagues that
do not read packets?
Download ClearSight Networks Analyzer and see a new network analysis tool
that makes the complex - easy
http://www.securityfocus.com/sponsor/ClearSightNetworks_focus-ms_031006
------------------------------------------------------------------------
---
[ reply ]