HNS Newsletter Issue 60 - 23.04.2001 http://net-security.org http://security-db.com This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Archive of the newsletter in TXT and PDF format is available here: http://www.net-security.org/news/archive/newsletter Current subscriber count to this digest: 2258 Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured products 5) Featured article 6) Security software 7) Defaced archives ======================================================== Advertisement - HAL 2001 ======================================================== Between 10th and 12th August, thousands of hackers will populate the green fields of the campus of the University of Twente, converting it into a large doubleplus-extrawired campsite. When not visiting lectures or workshops, we'll be engaged in technical or political discussions, or maybe just relaxing somewhere in the grass. If you can truly celebrate the Internet and embrace new technologies, without forgetting your responsibility to tell others that new technologies come with new risks to the individual and to society as a whole, then this is the place to be this summer. To be sure of an entrance ticket, register now! Visit us at http://www.hal2001.org ======================================================== General security news --------------------- ---------------------------------------------------------------------------- AVOIDING SECURITY HOLES WHEN DEVELOPING AN APPLICATION This series of articles tries to put the emphasis on the main security holes that can appear within applications. It shows ways to avoid those holes by changing development habits a little. This article, focuses on memory organization and layout and explains the relationship between a function and memory. The last section shows how to build shellcode. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://mercury.chem.pitt.edu/~tiho/LinuxFocus/English/March2001/article183.shtml USING GNUPG WITH PINE FOR SECURE E-MAIL Many people have no problems sending sensitive data via e-mail. Most of us do not know how easy it is for anybody to read it. Just because somebody holds the title of "Systems Administrator" does not mean they can be trusted. What is stopping them from reading your e-mail? Nothing. This is where PGP comes in; it is easy-to-use encryption meant for the common person. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxsecurity.com/feature_stories/feature_story-83.html EX-SOVIET STATES A HOTBED FOR HACKING Tonu Samuel says he is part of the solution to the growing threat from computer hackers and cybercriminals. The Estonian Internet company whose system Samuel hacked into says he is part of the problem. Their dispute is a small one in a small nation, but it captures the challenges facing companies and governments in the Internet age. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://chicagotribune.com/news/nationworld/article/0,2669,SAV-0104150339,FF.html PREPARING FOR THE SCRIPT-FORM ATTACK "Today we live in an electronic era, with the use of the Internet growing by leaps and bounds. Along with this growth, we have unfortunately witnessed an increase in the distribution of viruses, DoS attacks, and the break-in and modification of home pages on Web servers operated by government agencies, commercial organizations, and academia. The purpose of this article is to acquaint readers with a relatively new type of network-based attack that can cost your organization money. I will describe what I call a "script-form" attack; I will first examine how this attack can occur, and some prevention methods." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.sysadminmag.com/current/0105o/0105o.htm FROM TEEN HACKERS TO JOB HUNTERS At age 3, Patrick Roanhouse got his first computer. At 7, he figured out how to construct a modem out of scrap parts. By 14, he was running around cyberspace under the alias "Anarchist" and working up all sorts of havoc. Then he met the 2600 Club. The group, which publishes a popular hacker magazine, has an almost mythical reputation. It has been investigated by the Secret Service and has inspired monthly gatherings in more than 100 cities around the world. Patrick thought 2600 would teach him how to hack. Instead, it taught him about job hunting, stock options and business plans. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.washtech.com/news/media/9091-1.html CHINESE DEFACERS UNDER INVESTIGATION Chinese defacers, possibly angry about the downing of one of their nation's fighter jets last week, are under investigation by U.S. officials related to the defacement of nine U.S. Web sites. Link: http://www.law.com/cgi-bin/gx.cgi/AppLogic+FTContentServer?pagename=law/View&c=Article&cid=ZZZE6G3MILC&live=true&cst=1&pc=5&pa=0&s=News&ExpIgnore=true&showsummary=0 MANTRAP COMING TO INDIA 'Mantrap' will trap the attacker or any malicious intruder by employing 'decoys' at various strategic points of the system and will 'distract' him/her away from the original system. According to Times of India Online, the solution developed by PeakXV Networks, will be soon introduced in India. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.timesofindia.com/today/17info5.htm JUMPSTART FOR SOLARIS SYSTEMS PART II This is the second of two articles examining JumpStart, a tool that enables Solaris system administrators to install and configure systems remotely. In the first article we introduced Sun's JumpStart system as well as the JumpStart Architecture and Security Scripts (JASS) toolkit from Sun. We also showed how the JumpStart system allows a system administrator to automate the installation of Solaris systems, while the JASS toolkit builds on top of JumpStart to allow the automated installation of hardened systems. This article will focus on the use of the JASS toolkit in the installation of a bastion mail host. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/sun/articles/jumpstart2.html IP INSECURITY Stolen credit card numbers, hacked federal computer systems and other high profile online assaults have put many users on their guards and focused the attention of security managers on high-level intrusion-detection systems, chains of firewalls and other high-level defenses. But many forget that, no matter how hard they try to secure a site, vulnerabilities built into the fabric of the Internet still leave them at risk - even though measures to shut down the most glaringly common vulnerabilities are easily available. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computerworld.com/cwi/story/0,1199,NAV47_STO59610,00.html IPTABLES BASICS NHF "I'm sure many of you have been wondering how to use iptables to set up a basic firewall. I was wondering the same thing for a long time until I recently figured it out. I'll try to explain the basics to at least get you started." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.linuxnewbie.org/nhf/intel/security/iptables_basics.html FTP ATTACKS FTP used to be the king of the Internet. If you wanted to download something you went to your favorite ftp server or used Archie to find the file. Even today, the number of ftp servers is staggering, and many ftp sites contain several hundred gigabytes of online archives (take a look at your local sunsite). FTP was built to be an extremely flexible protocol, and therein lie many of it's problems. The FTP protocol not only allows you to transfer files from an ftp server to your machine but from one ftp server to another ftp server directly. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/closet/closet20010418.html INTRUSION DETECTION If a firewall is like having a security guard at your office door, checking the credentials of everyone coming and going, then an intrusion-detection system (IDS) is like having a network of sensors that tells you when someone has broken in, where they are and what they're doing. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.itworld.com/News/2001/4/CED010416STO59611/ INFECTABLE OBJECTS, PART FIVE - HTML AND OTHER SCRIPTS One of the more interesting developments in the virus world has been the extension of viruses from compiled executable files into script files. There is now an expanding range of script file types that can contain malicious code. This article,the fifth and final in a series by SecurityFocus writer Robert Vibert, will offer an overview of script file types that can contain viral code, including batch files, Java, JavaScript and HTML files. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/virus/articles/infobj5.html BUG WATCH: IS LINUX SAFE FROM ATTACK? Fresh concerns have come to light regarding the vulnerabilities of open source operating systems to virus attacks. Last week's Red Worm virus was the latest in a long line to target Linux. There's been a long-standing belief throughout the Linux community that hackers and virus writers had better things to do than target them with malicious attacks - a belief that is beginning to erode. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://thebusiness.vnunet.com/News/1120613 ACCUBYTE LEAVES CUSTOMER CREDIT CARD DETAILS EXPOSED Customers of computer components supplier Accubyte have been encouraged to check their credit card records for fraudulent misuse after it admitted that its previously lax security left confidential information exposed. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/18328.html NEW TOOLS ADDRESS DENIAL-OF-SERVICE THREAT Concerns about denial-of-service attacks are resulting in a growing number of products and services aimed at helping companies detect, trace and block the threat. But most of the technologies do little to prevent such attacks outright, users said. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cnn.com/2001/TECH/internet/04/17/dos.tools.idg/index.html 'SANDBOXING' TECHNOLOGY CAN STIFLE HACKERS Forget the popular myth of the teen hacker. An older, more sophisticated hacker is out there, spreading malicious code disguised as files and standard Internet apps into corporate networks. It's this fear of the unknown that's starting to scare some IT managers into adding behavior-blocking, or "sandboxing," technology, as a last line of defense at the desktop. Behavior blocking prevents malicious code from doing something it's not authorized to do. If a downloaded executable program tries to erase the PC's hard drive or copy its address book, for instance, the software stops it cold. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.networkweek.com/wire/story/TWB20010418S0011 INTERNET BANKS 'IN DENIAL' ON HACKING THEFTS At least four large internet banks in Britain have been attacked by computer hackers, it emerged yesterday at the launch of a national police unit to tackle cybercrime. It is believed that in each case at least hundreds of thousands of pounds was stolen, but the banks concerned have been reluctant to report the thefts for fear it will damage the credibility of banking online. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.guardianunlimited.co.uk/internetnews/story/0,7369,474815,00.html CRACKERS EXPAND PRIVATE WAR As China and the United States attempt to peacefully end their diplomatic standoff sparked by the mid-air collision between a U.S. spy plane and a Chinese fighter jet, crackers from both countries continue to wage private wars on the Internet. American cracker group PoizonBOx has defaced at least a hundred Chinese websites since April 4. Chinese hackers are now vowing to retaliate with a planned week-long all-out crack attack on American websites and networks which will start on May 1. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.wired.com/news/politics/0,1283,43134,00.html SECURITY OF CENSUS DATA 'GUARANTEED' The public and private agencies involved in the UK Census claim to have taken all precautions to guarantee that the data will be secure. Information held at the main purpose-built processing centre is stored on a closed network of servers with no connection to the outside world, said Census project service director Tom Rowe. "The system is on a local area network, with no network connections. Anything which people could hack wouldn't be allowed," he said. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://thebusiness.vnunet.com/News/1120701 IMMUNIX REVIEW If you get the security mailing list for your Linux distribution or browse CERT's advisories, you've probably noticed that a majority of security advisories are tied to buffer overflows. One aspect of security, then, is to prevent these attacks whenever possible. This is where WireX and their Immunix distribution and StackGuard compiler come in. WireX's StackGuard compiler is based on the egcs compiler, but has been rewritten to remove buffer overflow vulnerabilities. The Immunix distribution is based on Red Hat Linux 7.0, but the majority of the distribution has been compiled with the StackGuard compiler instead of the standard GNU compilers. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.unixreview.com/reviews/articles/0104/0104e.shtml CODED WARNING Hacking attacks are on the increase in the UK and concerns are mounting that the country's leading organisations are not fully prepared to cope with the problem. A report published last week claimed that a third of the UK's major companies and public sector organisations had been hacked into by cyber-terrorists. Speaking in the Commons, the foreign secretary, Robin Cook, said: "Computers now manage most of our critical national infrastructure but with these new opportunities there also comes the risk of new threats. A computer-based attack could cripple the nation more quickly than a military strike." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.guardian.co.uk/online/story/0,3605,474650,00.html THE UNWIELDY E-COMMERCE SECURITY QUESTION Government agencies and non-governmental nonprofit organizations have been very busy announcing massive Internet fraud cases. Furthermore, the news announcing cybercrimes has yet to ebb. One search engine lists more than 180,000 pages discussing the problem of credit card fraud. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.osopinion.com/perl/story/8993.html NETWORK ENCRYPTION KEYS [Q] My new 3Com wireless network has only one problem - each PC uses a different grid to enter the encryption key. [A]Those are just different ways to present the same number. An encryption key - used to secure transmissions from one PC to another in your home network - of 1122334455 will be displayed as 11.22.33.44.55 in the software on one computer and as 11223 34455 on another. As long as both include the same sequence of numbers, things will work. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.washtech.com/news/software/9146-1.html EUDORA ADDS NEW SECURITY IN VERSION 5.1 Eudora, a standalone e-mail program, is noteworthy for its support of the Macintosh operating system. The Eudora version that can be used under the Mac OS X is currently in beta. Version 5.1 enables more secure connections for sending and receiving e-mail and conducting online transactions over the Internet by employing the Secure Socket Layer Internet security standard. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0-1006-200-5671480.html PONYING UP FOR REAL-TIME SECURITY ALERTS CERT Coordination Center, formerly known as the Computer Emergency Response Team at Carnegie Mellon University, and the Electronic Industries Alliance (EIA), an electronics industry trade organization, on Thursday launched the Internet Security Alliance (ISA). The new organization will deliver up-to-the-minute warnings on viruses and security attacks to companies willing to pay anywhere from $2,500 to $70,000 annually for its service. Members will receive warnings roughly 45 days before the information is available to the public. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://news.cnet.com/news/0-1003-200-5665677.html FIREWALL DESIGN WHITE PAPER "First of all let's define what a firewall is but a bit differently. Here I will digress a bit from the commonly accepted wisdom, and will define a firewall as an access nexus in the digital communication infrastructure of any organization. That is you build a firewall not only to protect your internal data but to also be able to overall enhance your communication abilities. This paper here is not a set of instructions of how to built an access nexus it is more like a white paper of things you should expect from such a device and be able to ask for them from you vendor. Please do tell them that they are currently availlable on Open Source Servers." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.unix.gr/fwdesign.html $50,000 PRIZE TO HACK U.K. WEB SERVER Computer hackers from around the world are being invited to break into a locked-down Web server in a competition launched for to publicise Britain's largest security conference, Infosec. US-based security firm Argus Systems Group will offer the prize money to any hacker that can penetrate its PitBull security software, which is used commercially to secure Web sites from intruders. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.co.uk/news/2001/15/ns-22334.html CIH STILL A SERIOUS THREAT THREE YEARS LATER "Thursday, April 26, 2001 is the date that Win95.CIH is scheduled to once again drop its vicious payload. Chen Ing-Hau wrote Chernobyl, a variant of the CIH family, in May or June of 1998 while a student at the Tatung Institute of Technology. Some say that CIH may just be the most prolific virus in circulation, as well as having one of the most destructive payloads around. Chernobyl attempts to continuously overwrite the hard disk, which crashes the system, and overwrites the BIOS, which may render the computer unbootable. We at SecurityPortal want to remind our readers to install and use updated antivirus software NOW, to avoid Malware such as CIH before they strike. Malware in the CIH family continue to be major players in our Top 20 Virus/Malware list each week." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/cih20010420.html NETBSD SECURITY PROCESSES AND SERVICES "This document covers secure processes and services for NetBSD Operating Systems and Networks. Most of the information in this document can easily be translated to other BSD systems, however. The NetBSD Operating System comes with a full host of built in and (as of release 1.5) kernel level enabled by default security tools for the Systems and Networks Administrator. As of the 1.5 release, the default installation is bulletproof in regards to remote attacks, this makes it even more appealing." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.diverge.org/doc/nsps/ ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- QPC POPD BUFFER OVERFLOW VULNERABILITY The pop daemon that ships with the QVT/NET software suite contains an unchecked buffer in the logon function. When a username or password of 584 bytes or more gets fed to the server the buffer will overflow and will trigger an access violation, after which the server dies. Link: http://www.net-security.org/text/bugs/987418109,21193,.shtml QPC FTPD DIRECTORY TRAVERSAL VULNERABILITY The ftpd daemon that ships with above mentioned packages is vulnerable to a directory traversal problem. Adding '../' (''s excluded) to a listing request ('ls') any user can gain read access to other directories than his/her own. Link: http://www.net-security.org/text/bugs/987418481,53996,.shtml DEBIAN LINUX - MULTIPLE KERNEL PROBLEMS The kernels used in Debian GNU/Linux 2.2 have been found to have multiple security problems. Link: http://www.net-security.org/text/bugs/987418235,95064,.shtml DEBIAN LINUX - EXUBERANT-CTAGS PROBLEMS Colin Phipps discovered that the exuberant-ctags packages as distributed with Debian GNU/Linux 2.2 creates temporary files insecurely. This has been fixed in version 1:3.2.4-0.1 of the Debian package, and upstream version 3.5. Link: http://www.net-security.org/text/bugs/987418545,9980,.shtml RED HAT LINUX - UPDATED PINE PACKAGES Previous versions of the pine email client, and the pico editor have had various temporary file creation issues that allow any user with local system access, to cause files owned by anyone including root to potentially be overwritten if the right set of conditions are met. Link: http://www.net-security.org/text/bugs/987418417,29761,.shtml TREND MICRO INTERSCAN VIRUSWALL 3.01 VULNERABILITY A combination of bugs found in the ISADMIN service that would allow an attacker to remotely compromise a system running Trend Micro Interscan Viruswall 3.01. Notice, file paths may change between various distributions so they may not be totally accurate. Link: http://www.net-security.org/text/bugs/987418647,24350,.shtml SOLARIS IPCS VULNERABILITY Eeye: We have discovered a buffer overflow in the /usr/bin/i86/ipcs utility provided with Solaris 7. The problem exists in the parsing of the TZ (TIMEZONE) environment variable. By exploiting this vulnerability an attacker can achieve local sys group privileges. IPCS is used for gathering information on active inter-process communication facilities. Exploitation of this vulnerability would be very difficult, but not impossible. Link: http://www.net-security.org/text/bugs/987418882,57858,.shtml DCFORUM ALLOWS REMOTE READ/WRITE/EXECUTE In line 121 of file dcboard.cgi, there is a line "require < prefix>< az hidden form field>< suffix>;". (The exact line was not quoted do to copyright limitations.) The perl statement "require EXPR" will open the file EXPR, parse it, and execute it, as regular perl, as if the entire contents of that file appeared at that point. Therefore, an attacker who writes a file containing perl commands to the server will be able to execute them by setting the az field to the name of his file on the server. To make matters worse, no input checking is done on the az field, so as long the file is located anywhere on the server, an attacker can reference it, using double dots to undo the prefix and a %00 to truncate off the suffix. Getting the file onto the server is no problem either. DCForum, by default, allows any user to upload any file, by setting az=upload_file. However, there are other ways of getting files onto the server, so even servers that disable uploading are vulnerable. Link: http://www.net-security.org/text/bugs/987517406,83674,.shtml BUBBLEMON 1.31 VULNERABILITY Users can execute programs/shellscript by clicking on the bubblemon app. bubblemon is installed sgid kmem on FreeBSD and does not drop its egid before executing programs. Link: http://www.net-security.org/text/bugs/987517561,18230,.shtml ACTIVESYNC CAN ACCESS LOCKED WORKSTATION MS ActiveSync can access files (Outlook appts, contacts, synced files, etc) from a Win2K workstation even though the workstation has been locked. By simply dropping the HP into the dock, or hooking it up to the COM port (depending on which sync method is configured), it will sync and download data from a "locked" workstation. Link: http://www.net-security.org/text/bugs/987517714,84422,.shtml MICROSOFT ISA SERVER DENIAL OF SERVICE Microsoft ISA Server 1.0 on Windows 2000 Server SP1 is vulnerable to a simple network-based attack which stops all incoming and outgoing web traffic from passing through the firewall until the firewall is rebooted or the affected service is restarted. If the firewall is configured to use the "Web Publishing" feature (inbound HTTP proxy to a web server), this attack can be performed remotely. Link: http://www.net-security.org/text/bugs/987517821,75691,.shtml GUNINSKI - DANGERS OF DOUBLECLICKING By double clicking from Window Explorer or Internet Explorer on filenames with innocent extensions the user may be tricked to execute arbitrary programs. Link: http://www.net-security.org/text/bugs/987594992,20897,.shtml IPLANET WEB SERVER 4.X PRODUCT ALERT iPlanet has identified a security vulnerability in the iPlanet Web Server Enterprise Edition 4.x products. This problem does not affect any releases of the product prior to the 4.x versions; however it does affect all iPlanet applications operating on the iPlanet Web Server platform. A patch and implementation instructions to address it are now available. Link: http://www.net-security.org/text/bugs/987595169,63098,.shtml LOTUS DOMINO WEBSERVER PATH REVEALING Lotus Domino is a webserver. It has a simple physical path revealing problem. Link: http://www.net-security.org/text/bugs/987595856,48919,.shtml SAMBA 2.0.8 SECURITY FIX This release fixes a significant security vulnerability that allows local users to corrupt local devices (such as raw disks).For most users the Samba Team recommends Samba 2.2.0 which has just been released. Version 2.2.0 has all the security fixes plus many new features and other bug fixes. Version 2.0.8 is meant for very conservative sites that want a absolutely minimal security fix rather than a large update. Link: http://www.net-security.org/text/bugs/987595922,56064,.shtml EUDORA FILE LEAKAGE PROBLEM An attacker may be able to get any file from a users hard drive if he can make the recieving party to forward a mail containing a false attachment reference to this local file. Link: http://www.net-security.org/text/bugs/987596714,99006,.shtml DEBIAN LINUX - SAMBA SYMLINK ATTACK Marcus Meissner discovered that samba was not creating temporary files safely in two places: When a remote user queried a printer queue samba would create a temporary file in which the queue data would be written. This was doing using a predictable filename and insecurely, allowing a local attacker to trick samba into overwriting arbitrary files. smbclient "more" and "mput" commands also create temporary files in /tmp insecurely. Both problems have been fixed in version 2.0.7-3.2. and we recommand that you upgrade your samba package immediately. Link: http://www.net-security.org/text/bugs/987596849,60354,.shtml NETSCAPE REMOTE JAVASCRIPT VULNERABILITY There is a vulnerability related to javascript in versions below 4.77 of Netscape that allow a remote webserver (which the user is accessing at a particular time) to, for example, obtain information about the client using the "about:" protocol, such as browser history (about:global) or even browser configuration (about:config). Link: http://www.net-security.org/text/bugs/987596977,37269,.shtml PROBLEM WITH IPLANET CALENDAR SERVER 5.0P2 the standard install of iPlanet Calendar server stores the NAS LDAP admin username and password in plaintext in the world readable file: -rw-r--r-- 1 icsuser icsgroup 37882 Feb 20 10:18 /opt/SUNWics5/cal/bin/config/ics.conf in the fields local.authldapbinddn (username) and local.authldapbindcred (password) this potentially gives all local users full read/write access to the underlying NAS LDAP database (which is normally used for admin facilities such as storing user / group profiles, passwords, ACLs, SSL certificates and/or other sensitive company information), and full administrative control of the local NAS server. this access could in turn lead to compromise of other facilities such as web/e-commerce sites, directories etc. Link: http://www.net-security.org/text/bugs/987674342,69070,.shtml LINUX-MANDRAKE - KERNEL UPDATE A number of security problems have been found in the Linux kernels prior to the latest 2.2.19 kernel. Link: http://www.net-security.org/text/bugs/987680482,55033,.shtml DEBIAN - SAMBA FOR SPARC WAS INCORRECTLY BUILT The updated samba packages that were mentioned in DSA-048-1 were unfortunately compiled incorrectly: the stable chroot we used turned out to be running unstable instead. A new package with version 2.0.7-3.2.1 have been made that are correctly compiled. Link: http://www.net-security.org/text/bugs/987680525,81086,.shtml VMWARE SYMLINK PROBLEMS While mounting virtual disk drives using the vmware-mount.pl script, a temporary file named vmware-mount.pl.PID where PID is the current pid of the command will be created in an insecure manner. This allows an attacker to overwrite any local file, if root mounts a VMware's virtual partition (mounting is usually done as root). Link: http://www.net-security.org/text/bugs/987747822,9604,.shtml NETOPIA MAC OS X TIMBUKTU VULNERABILITY At the login screen of the freshly updated Mac OS X with preview version of Timbuktu for Mac OS X we have found a Timbuktu icon in the upper left hand portion of the screen. The menu contains all of the goodies (open timbuktu, turn tcp on/off, about, etc) Timbuktu users have known and loved from the classic OS. The menu About Timbuktu when clicked on gives you full control to the apple menu and system preferences without even being logged into OS X. Having access to the System Preferences without being logged in can allow access to the users panel where someone could change passwords or any system setting. Essentially, you've got admin access to the entire system prefs window and the users panel even shows the hidden admin/root user. Link: http://www.net-security.org/text/bugs/987748824,30773,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- SG2000 CARRIER-CLASS NET SECURITY GATEWAY - [16.04.2001] ServGate Technologies, Inc., a pioneer in next generation network processor based security gateways, today unveiled a network security gateway designed to meet the rigorous demands of service providers and large enterprises, the ServGate SG2000. The ServGate SG2000 is an all-in-one security device that supports gigabit wire-speed stateful inspection firewall and 3DES IPSec VPN performance. Based on next-generation network processor technology, the SG2000 meets the rigorous performance, availability, and scalability demands of today's rapidly changing network security environment. Press release: < http://www.net-security.org/text/press/987433347,44793,.shtml > ---------------------------------------------------------------------------- RED HAT ANNOUNCES RED HAT LINUX 7.1 - [16.04.2001] Red Hat, Inc., the leader in developing, deploying and managing open source solutions, announced today the availability of Red Hat Linux 7.1, the latest version of the world's most popular open source server operating environment. Red Hat Linux 7.1 includes the new 2.4 kernel with improved SMP support for superior performance on Intel multi-processor platforms. Red Hat Linux 7.1 also delivers new configuration tools that enable users to effortlessly set up and administer DNS, Web and print servers. This release features Red Hat Network connectivity, including software manager. Press release: < http://www.net-security.org/text/press/987433963,40528,.shtml > ---------------------------------------------------------------------------- SERVERPROTECT CERT. FOR CITRIX METAFRAME SERVERS - [16.04.2001] Awarded Citrix MetaFrame 1.8 Certification by Independent Testing Lab; Advances to Premier Level of Citrix Business Alliance Trend Micro Inc., a worldwide leader in network antivirus and Internet content security solutions, announced that its file server antivirus solution, ServerProtect 5, has earned certification for Citrix MetaFrame 1.8 software. WTS-Center, a German independent testing laboratory, certified that ServerProtect successfully met rigorous functionality and performance criteria. Press release: < http://www.net-security.org/text/press/987439949,90898,.shtml > ---------------------------------------------------------------------------- SECURITY INTELLIGENCE PRODUCT LAUNCHED - [17.04.2001] SecureInfo Corporation delivers a web-based security intelligence service, focusing on Information Systems Security and the protection of critical corporate data. Powered by over 300 years of combined security industry experience, TESS stands alone in the groundbreaking Security Intelligence for Business Continuity (SI4BC) category of security products. To further strengthen it’s leadership position in the SI4BC category and remain true to it’s industry trademark “The One Stop Security Shop”, SecureInfo Corporation has created a suite of applications that empower Information Technology Professionals to proactively create and take charge of their organization’s network security policy and certification process. Press release: < http://www.net-security.org/text/press/987516593,52439,.shtml > ---------------------------------------------------------------------------- SANDSTORM ANNOUNCES PHONESWEEP 3.0 - [17.04.2001] Sandstorm Enterprises announces the new release of its popular PhoneSweep telephone scanner, used by security professionals to audit telephone systems for vulnerabilities. Now used in more than 30 countries, PhoneSweep discovers undocumented or misconfigured modems that are exploitable by criminals, hackers and "crackers." PhoneSweep is similar to an attacker's "war dialer," in that it will dial a large block or set of telephone numbers and report its findings. But PhoneSweep 3.0's capabilities extend beyond mere hacker freeware. PhoneSweep includes a recognition engine that can identify hundreds of different remote access systems. The program can dynamically control many modems simultaneously, slashing scanning time. And PhoneSweep can repeatedly call a set of known "good" numbers to confirm the availability and proper operation of modems required for emergency remote access. Press release: < http://www.net-security.org/text/press/987516790,14570,.shtml > ---------------------------------------------------------------------------- INTRUSION.COM'S CHANNELPLUS PROGRAM - [17.04.2001] Intrusion.com, Inc., a leading provider of enterprise security solutions for the information-driven economy, today strengthened its commitment to helping companies meet the growing demand for security solutions through the launch of its ChannelPlus program. The new program provides channel partners with a deeper level of product and customer knowledge to meet the needs of customers seeking market-leading security solutions. Press release: < http://www.net-security.org/text/press/987516844,27925,.shtml > ---------------------------------------------------------------------------- CYBERGUARD SPONSORS SC MAGAZINE AWARDS - [17.04.2001] As information security breaches continue to dominate headlines around the world and hackers and cyberthieves grow bolder, the spotlight on companies who provide world-leading security solutions shines brighter. For the fifth year, SC Magazine, a division of WestCoast Publishing, will hold a major awards event in London in conjunction with an important information security conference. At the banquet, to be held on April 24 at the Royal Lancaster Hotel in Hyde Park, London, winners in a number of general and specific security categories will be announced. Press release: < http://www.net-security.org/text/press/987516933,50154,.shtml > ---------------------------------------------------------------------------- MERILUS COLLABORATES WITH RSA SECURITY - [17.04.2001] Merilus, Inc., a leader in digital security innovation, announced that is has joined the RSA Security's RSA Secured Partner Program to support interoperability between Merilus GateKeeper products and RSA SecurID authentication and RSA BSAFE encryption technology. As part of the program, the Merilus GateKeeper product has been awarded both the "RSA Secured RSA SecurID Ready" certification and "RSA Secured RSA BSAFE enabled" certification signaling its compatibility with RSA Security's authentication and encryption software. The RSA Secured certification ensures that Merilus GateKeeper products are compatible with RSA Security's market-leading security products and technologies. Press release: < http://www.net-security.org/text/press/987517015,43546,.shtml > ---------------------------------------------------------------------------- SECUREINFO CORPORATION HIPAA SOLUTION - [18.04.2001] Don Richey, Administrator of Guadalupe Valley Hospital and Keith Frederick, President and CEO of SecureInfo Corporation, will meet in Seguin, Texas to sign a Consulting Services Agreement; to help fulfill part of their mission statement “To serve, our community, patients…with the best possible healthcare…delivered efficiently…” Guadalupe Valley Hospital is dedicated to ensuring that the appropriate information privacy and information security measures are implemented to protect their patient’s records. With the Information Security Expertise of SecureInfo Corporation, applying the privacy and security standards of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), they will take the steps necessary to keep their neighbor’s medical records confidential and secure. Press release: < http://www.net-security.org/text/press/987599218,10869,.shtml > ---------------------------------------------------------------------------- INTRUSION PREVENTION FOR ITANIUM PROCESSOR - [19.04.2001] Argus Systems Group, Inc., an international vendor of Internet security and intrusion prevention systems, today announced its pending support of Intel Itanium-based enterprise servers with its PitBull LX intrusion prevention systems. PitBull LX for the Itanium-based platform is to run on the Linux 2.4.x operating system kernel and is estimated to be available in Q3 2001. Press release: < http://www.net-security.org/text/press/987599807,825,.shtml > ---------------------------------------------------------------------------- 'TOTAL ENTERPRISE SECURITY SERVICE' PRESENTED - [19.04.2001] SecureInfo Corporation delivers a web-based security intelligence service, focusing on Information Systems Security and the protection of critical corporate data. Powered by over 300 years of combined security industry experience, TESS stands alone in the groundbreaking Security Intelligence for Business Continuity (SI4BC) category of security products. Press release: < http://www.net-security.org/text/press/987679170,57137,.shtml > ---------------------------------------------------------------------------- MAC CLIENT SUPPORT FOR INTEL VPN PRODUCTS - [20.04.2001] PGP Security, a Network Associates company, today introduced Virtual Private Networking client software that will enable Intel VPN Gateways to support the Mac Operating System. PGP Security's award winning VPN client technology paired with Intel VPN Gateways provides Mac OS users with a secure encrypted tunnel to transfer information among partners, employees and customers across organizations and locations. Press release: < http://www.net-security.org/text/press/987747653,17172,.shtml > ---------------------------------------------------------------------------- GUARDENT JOINS INTERNET SECURITY ALLIANCE - [20.04.2001] Guardent, Inc., the leading provider of security and privacy programs for Global 2000 organizations, today announced its full support of the Internet Security Alliance (ISA). Formally launched today, ISA assembles a roster of global leaders from multiple industry segments to create the most comprehensive, business-led network for up-to-the-minute threat reports, best practice standards, risk management strategies, certification and more. Press release: < http://www.net-security.org/text/press/987747705,78850,.shtml > ---------------------------------------------------------------------------- Featured products ------------------- The HNS Security Database is located at: http://www.security-db.com Submissions for the database can be sent to: staff@net-security.org ---------------------------------------------------------------------------- LT AUDITOR+ Blue Lance´s LT Auditor+ is a Windows-based intrusion detection/audit trail security software solution. LT Auditor+ is designed to protect organizational assets accessible through NT and/or Novell networks. LT Auditor+ provides around-the-clock monitoring of network activity across the enterprise. LT Auditor+ is used to secure corporate assets against unauthorized access, fraud and theft. Read more: < http://www.security-db.com/product.php?id=436 > This is a product of Blue Lance, for more information: < http://www.security-db.com/info.php?id=97 > ---------------------------------------------------------------------------- GENUITY SITE SCAN Genuity Site Scan Service can help a business strengthen its network perimeter security by periodically looking for potential weaknesses and generating recommendations about how to fix them. With Genuity Site Scan, organizations can reduce their susceptibility to Internet attacks. Read more: < http://www.security-db.com/product.php?id=147 > This is a product of Genuity, for more information: < http://www.security-db.com/info.php?id=27 > ---------------------------------------------------------------------------- QUADRASOLVE SECURE SERVER APPLIANCE The QuadraSolve Secure Server Appliance ships with the easy to use, browser based remote administration tool -RSAM, making configuration and management simple. Setting up the QuadraSolve for Web hosting can be done in minutes. These servers are razor-thin when it comes to form-factor…if you´re an ISP, you can squeeze 41 of these into a single data center cabinet, providing long term cost savings on that real estate. Read more: < http://www.security-db.com/product.php?id=253 > This is a product of LinuxSolve, for more information: < http://www.security-db.com/info.php?id=47 > ---------------------------------------------------------------------------- Featured article ---------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org ---------------------------------------------------------------------------- STARTING POINTS OF A SECURE LINUX SYSTEM by Aleksandar Stancin Here we go again. After some time has passed, I decided to write another article concerning some overall security aspects of installing and running linux, and as you can see it's connected to the very first one 'Securing a default linux installation' and makes a good reading companion to it. To keep it short and simple, here are some good pointers to enhancing your system's security. But remember, there's no absolute security, so keep your eyes open, subscribe yourself to good sec-related mailing lists, and keep your software up-to-date. Read more: < http://www.net-security.org/text/articles/starting.shtml > ---------------------------------------------------------------------------- Security Software ------------------- All programs are located at: http://net-security.org/various/software ---------------------------------------------------------------------------- ELDOS KEEPER 2.5.4 EldoS Keeper is designed to keep all your passwords and account-related information in secure, encrypted files so that you don't need to remember or write down the information. The only thing you need to remember is the password to the file where all the information is stored. EldoS Keeper keeps all records in a hierarchical form, allowing you to organize the data as you like. Version 2.54 adds password expiration tracking. Info/Download: < http://www.net-security.org/various/software/988018687,61436,windows.shtml > ---------------------------------------------------------------------------- SUBSEVEN: FIREWALL 1.0 From the developer: "This is a remarkable trojan blocker, and fake server. If you are being hacked using Subseven then go for this program. It has many features. Including chatting to the client. This is a must download for internet security. You can even sometimes preprogram the ports to stop other trojans like T3000 etc." Info/Download: < http://www.net-security.org/various/software/988018773,18730,windows.shtml > ---------------------------------------------------------------------------- Defaced archives ------------------------ [16.04.2001] Original: http://www.xerox.com.cn/ Defaced: http://defaced.alldas.de/mirror/2001/04/16/www.xerox.com.cn/ OS: Windows Original: http://wwwgps.incra.gov.br/ Defaced: http://defaced.alldas.de/mirror/2001/04/16/wwwgps.incra.gov.br/ OS: Windows Original: http://www.systematics.co.il/ Defaced: http://defaced.alldas.de/mirror/2001/04/16/www.systematics.co.il/ OS: Windows Original: http://office.lefcobank.ru/ Defaced: http://defaced.alldas.de/mirror/2001/04/16/office.lefcobank.ru/ OS: Linux Original: http://www.governmentclub.org/ Defaced: http://defaced.alldas.de/mirror/2001/04/16/www.governmentclub.org/ OS: Windows [17.04.2001] Original: http://www.carlsberg-beer.co.kr/ Defaced: http://defaced.alldas.de/mirror/2001/04/17/www.carlsberg-beer.co.kr/ OS: Windows Original: http://esenler-bld.gov.tr/ Defaced: http://defaced.alldas.de/mirror/2001/04/17/esenler-bld.gov.tr/ OS: SCO [18.04.2001] Original: http://audiology.meei.harvard.edu/ Defaced: http://defaced.alldas.de/mirror/2001/04/18/audiology.meei.harvard.edu/ OS: Windows Original: http://crnet.mgh.harvard.edu/ Defaced: http://defaced.alldas.de/mirror/2001/04/18/crnet.mgh.harvard.edu/ OS: Windows Original: http://www.puma.co.jp/ Defaced: http://defaced.alldas.de/mirror/2001/04/18/www.puma.co.jp/ OS: Windows Original: http://www.nato.lv/ Defaced: http://defaced.alldas.de/mirror/2001/04/18/www.nato.lv/ OS: Windows [19.04.2001] Original: http://www.microsoft.be/ Defaced: http://defaced.alldas.de/mirror/2001/04/19/www.microsoft.be/ OS: Windows Original: http://www.ericsson.com.tw/ Defaced: http://defaced.alldas.de/mirror/2001/04/19/www.ericsson.com.tw/ OS: Windows Original: http://www.cybernanny.net/ Defaced: http://defaced.alldas.de/mirror/2001/04/19/www.cybernanny.net/ OS: FreeBSD Original: http://www.jenniferaniston.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/19/www.jenniferaniston.com/ OS: Windows Original: http://www.melgibson.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/19/www.melgibson.com/ OS: Windows [20.04.2001] Original: http://www.emicrosoft.org/ Defaced: http://defaced.alldas.de/mirror/2001/04/20/www.emicrosoft.org/ OS: Windows Original: http://www.poderjudicial.gov.bo/ Defaced: http://defaced.alldas.de/mirror/2001/04/20/www.poderjudicial.gov.bo/ OS: Linux Original: http://www.chinaconsulatechicago.org/ Defaced: http://defaced.alldas.de/mirror/2001/04/20/www.chinaconsulatechicago.org/ OS: Windows Original: http://www.microsoft.com.gr/ Defaced: http://defaced.alldas.de/mirror/2001/04/20/www.microsoft.com.gr/ OS: SCO Original: http://www.hackers.com.mx/ Defaced: http://defaced.alldas.de/mirror/2001/04/20/www.hackers.com.mx/ OS: Linux [21.04.2001] Original: http://molbio.princeton.edu/ Defaced: http://defaced.alldas.de/mirror/2001/04/21/molbio.princeton.edu/ OS: Windows Original: http://www.fellows.lanl.gov/ Defaced: http://defaced.alldas.de/mirror/2001/04/21/www.fellows.lanl.gov/ OS: Windows Original: http://www.quantum.com/ Defaced: http://defaced.alldas.de/mirror/2001/04/21/www.quantum.com/ OS: Windows Original: http://www.e-net.com.tw/ Defaced: http://defaced.alldas.de/mirror/2001/04/21/www.e-net.com.tw/ OS: Windows ---------------------------------------------------------------------------- ======================================================== Advertisement - HNS Security Database ======================================================== HNS Security Database consists of a large database of security related companies, their products, professional services and solutions. HNS Security Database will provide a valuable asset to anyone interested in implementing security measures and systems to their companies' networks. Visit us at http://www.security-db.com ======================================================== Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org http://security-db.com