HNS Newsletter Issue 66 - 04.06.2001 http://net-security.org http://security-db.com This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://www.net-security.org. Subscribe to this weekly digest on: http://www.net-security.org/text/newsletter Archive of the newsletter in TXT and PDF format is available here: http://www.net-security.org/news/archive/newsletter Current subscriber count to this digest: 2496 Table of contents: 1) General security news 2) Security issues 3) Security world 4) Featured products 5) Featured article 6) Security software 7) Defaced archives ======================================================== Help Net Security T-Shirt available ======================================================== Thanks to our affiliate Jinx Hackwear we are offering you the opportunity to wear a nifty HNS shirt :) The image speaks for itself so follow the link and get yourself one, summer is just around the corner. Get one here: http://207.21.213.175:8000/ss?click&jinx&3af04db0 ======================================================== General security news --------------------- ---------------------------------------------------------------------------- CYBER-SECURITY HELP WANTED The administration's top security coordinator Richard Clarke once warned that the United States could face an "electronic Pearl Harbor" if the nation's electronic defenses were not strengthened. He painted an equally gloomy picture earlier this week. The increasing sophistication of electronic attackers, coupled with growing U.S. reliance on Web-based systems has created a very dangerous environment, Clarke said at the Global Internet Project, a gathering of high-tech executives. Clarke is the Bush Administration's national coordinator for security, infrastructure Protection, and counter-terrorism. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/01/05/28/news1.html FORMATGUARD 1.0 RELEASED FormatGuard is designed to provide a rapid, general solution to the large number of unknown format bugs expected to emerge in the next year. FormatGuard works by employing CPP's ability to distinguish macros with identical names but a different number of arguments. FormatGuard provides a macro definition of the printf function for each of one argument, two arguments, three arguments, etc., up to 100 arguments. Each of these macros in turn calls a safe wrapper that counts the number of % characters in the format string, and rejects the call if the number of arguments does not match the number of % directives. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://immunix.org/formatguard.html US PUTS NK ON CYBER WATCH LIST Digital Chosun: "The US Department of Defense is reportedly drawing up comprehensive countermeasures against possible cyber attacks from North Korea and China based on its judgment that the computer hacking ability of these two countries has reached the level of the US". Link: http://www.net-security.org/various/hnsforum/list.php?f=2&collapse=0 TRENDS IN HIGH-TECH SPYING Two very different, yet related, articles appeared in this week's Wall Street Journal - As Technology Evolves, Spy Agency Strugges to Preserve its Hearing, and Software Uses Clicking Patterns to Customize Ads. Each of these articles discuss how an organization is attempting to spy on the private activities of individuals. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/spying20010528.html SOURCEFORGE SERVER COMPROMISED Slashdot's reporting that a system on SourceForge was compromised. No mention is made of the issue on the site's front page, and the mail sent out to developers who may have been affected notes that potentially compromised passwords have been randomized, requiring users to get a new one. The e-mail sent to the developers as well as the discussion about this can be seen following the link below. Link: http://slashdot.org/article.pl?sid=01/05/28/2242201&mode=nocomment SOURCEFORGE BUGGY SCRIPTS An anonymous source reported to Security.nl that Sourceforge had been informed about the problem with their scripts 3 months ago. A screenshot of the problem can be found here: http://www.security.nl/misc/sourceforge.jpg Link: http://www.net-security.org/various/hnsforum/read.php?f=2&i=336&t=336 INSURER CONSIDERS MICROSOFT NT HIGH-RISK J.S. Wurzler Underwriting Managers, one of the first companies to offer hacker insurance, has begun charging its clients 5 percent to 15 percent more if they use Microsoft's Windows NT software in their Internet operations. Although several larger insurers said they won't increase their NT-related premiums, Wurzler's announcement indicates growing frustration with the ongoing discoveries of vulnerabilities in Microsoft's products. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/intweek/stories/news/0,4164,2766045,00.html TREND MICRO SEEKS CURE IN VIRUS BATTLE Eva Chen has been in the anti-virus game longer than some of the aspiring virus writers who keep her busy have been alive. In the 13 years since she helped found Trend Micro Inc., Chen, the chief technology officer, has been at the forefront of the battle against malicious code. Senior Writer Dennis Fisher caught up with Chen recently to discuss what has been a busy last year for the anti-virus industry and what kind of insidious viruses we can expect to see in the near future. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/eweek/stories/general/0,11011,2766000,00.html PRIVACY BECOMES A STRATEGIC ASSET The Privacy Amendment Act was put forward at the end of last year to ensure that the personal information kept by the private sector was both secure and accessible to individuals. But with a deadline of December this year, are companies ready or aware of what's needed to comply? Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com.au/biztech/security/story/0,2000010455,20224899,00.htm @HOME'S MIS-CONFIGURED PROXY A single misconfigured server exposed broadband provider Excite@Home's internal corporate network to hackers for at least three months, making its customer list of 2.95 million cable modem subscribers accessible to anyone with a Web browser and a modicum of cyber smarts, SecurityFocus has learned. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/19279.html CERT SUMMARY CS-2001-02 Each quarter, the CERT Coordination Center (CERT/CC) issues the CERT Summary to draw attention to the types of attacks reported to their incident response team, as well as other noteworthy incident and vulnerability information. This is there latest summary starring sadmind/IIS Worm, IIS vulnerabilities, snmpXdmid, cheese worm etc. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.cert.org/summaries/CS-2001-02.html ALLDAS.DE: ANALYSIS SECTION Fredrik Östergren from Alldas.de did an analysis on two different root kits that have been sent to Alldas.de team by anonymous individuals (root kits were found on compromised servers). Analysis of TeLeKiT: http://security.alldas.de/analysis/?aid=1 Analysis of YoYo.tar.gz: http://security.alldas.de/analysis/?aid=2 INTERVIEW WITH K2 Here's an interesting interview with K2, check it out! Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.active-security.org/K2_eng.html RESTORING SULFNBK.EXE If you've been fooled by the recent Sulfnbk.exe hoax you may want to restore the file that you deleted from your hard drive. Follow the instructions below to restore Sulfnbk.exe to your drive. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://securityportal.com/articles/sulfnbk20010529.html PROTECTION FROM ELECTRONIC MESSAGE VIRUSES The most important thing to remember about anti-virus (AV) protection is that no system is infallible. No matter how good your AV protection is and how stringent your security processes are, there is still the chance that a completely new virus will enter your organization and disrupt operations. Of course, completely isolating your systems from the Internet and removing them from external e-mail will greatly minimize your exposure, but in today's digital economy that is no longer a practical option. This article is intended to provide readers with a checklist of things that can be done to minimize their organization's vulnerability to e-mail borne computer threats. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/virus/articles/grupe1.html DECSS ARGUMENTS INVOKE FREE SPEECH Supplementary briefs have been submitted by both contestants in the appeal of 2600 publisher Emmanuel Goldstein, who was barred from posting or linking to the DeCSS descrambling utility last summer by US District Judge Lewis Kaplan. After hearing oral arguments for and against publishing DeCSS, which defeats the Content Scrambling System of DVDs back on 1 May, the Second Circuit US Court of Appeals in Manhattan requested supplementary written briefs addressing the issue of whether Corley's First Amendment rights as a publisher had been violated by the district court. On the 2600 side, lawyer Kathleen Sullivan argues, among other things, that outlawing links to DeCSS inhibits the free exchange of technical information. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/8/19323.html CONFIGURING LINUX AND SQUID AS A WEB PROXY A web proxy server is a useful service to have on your network, or between your network and the Internet, as it provides an extra security layer that insulates your users from the Internet. A proxy server can also act as a cache, allowing users to share downloads transparently and speeding up Internet access, especially for frequently-used files. Squid is a high-performance and relatively secure web proxy server that includes good caching facilities. It is one of the most commonly used proxy servers on the Internet. This article will give a general overview of setting up Linux and Squid as a web proxy server. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.securityfocus.com/focus/linux/articles/squid.html SULFNBK: VIRUS OR HOAX... OR BOTH? Sophos has received a large number of calls from users concerned about a virus known as SULFNBK or SULFNBK.EXE. The file itself is a regular part of Microsoft Windows, but the Magistr virus is capable of emailing infected copies of SULFNBK.EXE to innocent users. Mass mails say that you must delete the file, but you should watch out that you don't delete it without purpose. Link: http://www.net-security.org/various/hnsforum/read.php?f=2&i=338&t=338 Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.sophos.com/virusinfo/articles/sulfnbk.html NOT SO NAKED JENNIFER LOPEZ VBS/Lovelet-CM is an email-aware worm. The worm copies itself to a file called JENNIFERLOPEZ_NAKED.JPG.vbs in the Windows directory. It then forwards itself via email to every contact in the Microsoft Outlook address book with the subject "Where are you?". Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.sophos.com/virusinfo/analyses/vbsloveletcm.html THEMES.ORG DEFACED Themes.org got defaced today by Fluffy Bunny. If you followed the story regarding SourceForge.net hack, you will be interested in the sequel (and the prequel btw). Apache.org shadow file and various sniffs were also pasted on Themes.org defacement. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://defaced.alldas.de/mirror/2001/05/31/themes.org/ APACHE.ORG INTRUSION Brian Behlendorf, President of Apache Software Foundation - "Earlier this month, a public server of the Apache Software Foundation (ASF) was illegally accessed by unknown crackers. The intrusion into this server, which handles the public mail lists, web services, and the source code repositories of all ASF projects was quickly discovered, and the server immediately taken offline." Link: http://www.net-security.org/various/hnsforum/read.php?f=2&i=341&t=341 PORTAL SECURITY: IT'S ALL ABOUT TRUST If you're planning to spend a bundle of money and time building a corporate enterprise portal, don't overlook what could be the most important factor in its success: Security. Experts at a recent Intermedia Group portal conference in Boston stressed not to underestimate security's importance to users. Any plan to build Web portals, which enable businesses to collaborate, communicate, and engage in e-commerce with their customers, must be matched with a vigorous program to protect data. "Failure to implement these privacy programs risks alienating customers," warned David Cearley, senior vice president and co-research director at Meta Group in Stamford, Conn., one of the conference's keynote speaker. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://itmanagement.earthweb.com/entapp/article/0,,11980_776441,00.html IPTABLES TUTORIAL I'm sure many of you have been wondering how to use iptables to set up a basic firewall. I was wondering the same thing for a long time until I recently figured it out. I'll try to explain the basics to at least get you started. Link: http://pinehead.com/articles.php?view=371 LAYOFFS LEAD TO REVENGE HACKING When someone cracked Slip.net's computer system, altered customer accounts and deleted important databases, the Internet service provider didn't need to look far to find the attacker. It was Nicholas Middleton, a former computer administrator for Slip.net, who had been unhappy at the San Francisco company and recently quit. Middleton fought the resulting criminal charges on a legal technicality but lost and got three years' probation. Federal investigators say this type of computer crime is on the rise. As layoffs become more common at technology companies, an increasing number of disgruntled or fired employees are hacking their companies in revenge. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.usatoday.com/life/cyber/tech/2001-05-31-revenge-hacking.htm INSIDE THE DDOS ATTACK ON GRC.COM When a 13-year-old script kiddie marshalled hundreds of zombied PCs into a denial of service attack on GRC.com, Gibson Research Corporation president Steve Gibson decided to turn some lemons into lemonade. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.pc-radio.com/otr/gibson.html INTERNET FOUNDER WORRIED OVER EU CYBERCRIME PLANS Vint Cerf, a founding father of today's Internet, said on Thursday that European Union plans for new rules to fight crime on the Web risked clashing with existing EU privacy regulations. He told Reuters in an interview that Internet traffic should be retained only for billing purposes and was too cumbersome to be stored for police investigations. Privacy and the need to combat crime against the 407 million users of the Internet are concerns of the Commission - the European Union's executive. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/intweek/stories/news/0,4164,2767085,00.html CYBER-CRIME JUSTIFIES WORLD GOVERNMENT The Council of Europe, enthused by considerable American guidance and support, has issued a proposed final draft for an international cybercrime treaty to harmonize statutes related to electronic criminal activity, cross border police cooperation, and judicial policy throughout Europe and North America, more or less along lines preferred by the United States. Organized gangsters, terrorists and sexually-exploited children loom large in the document, as they always do when the natural rights of innocent adults are to be sacrificed to law-enforcement expedience. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.theregister.co.uk/content/6/19321.html THOUSANDS SPAMMED BY SETI@HOME ATTACKERS Attackers have escaped with around 50,000 email addresses, after the Seti@home project was hacked last weekend. A number of the email addresses taken have since been subjected to a major spam attack. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.vnunet.com/News/1122333 SADMIN/IIS WORM AND THE LION WORM "While doing some research for the Sadmin/IIS worm and the Lion worm we found that these worms are still very active. Using hotbot to search for web sites that have been defaced by these worms we found more then 1000 results for both. Fortunately most of these site where recovered." Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.safemode.org/records/1i0n-crew.html Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.safemode.org/records/sysadmcn.html RADIO NETHERLANDS ON ECHELON Radio Netherlands has a story on Echelon and they talked with Jan Marinus Wiersma, a member of the European Parliament committee about it. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.rnw.nl/hotspots/html/echelon010601.html 21 YEAR OLD ARRESTED IN BEIJING The People's Procuratorate of Beijing's Haidian District arrested Lu Chun, a suspect of Beijing's first "hacker" case on May 29. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://english.peopledaily.com.cn/200105/31/eng20010531_71479.html JUDGE OKS FBI HACK OF RUSSIAN COMPUTERS Upholding the rights of law enforcement to cross national borders in pursuit of cyberspace criminals, a federal judge has ruled that FBI agents did not act improperly when they tricked a pair of suspected hackers out of passwords and account numbers and then downloaded evidence from their computers in Russia. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.zdnet.com/zdnn/stories/news/0,4586,2767013,00.html OPENBSD DROPS FIREWALL PROGRAM IN LICENSING DISPUTE When an Australian software developer tightened licensing restrictions on his firewall program last month, he set off a chain of events that has caused a big controversy among the open-source developers who work on the OpenBSD operating system. For the past five years, OpenBSD has included a firewall application called IPFilter 3.4 that tracks all information packets traveling in and out of network servers running the operating system. But last month, Darren Reed, the Australia-based author of IPFilter, clarified the licensing language for his program to ensure that anyone wanting to make changes to the software could only do so with his prior approval. On his e-mail listserve on the Internet, Reed wrote that IPFilter had always had a restrictive license and that was merely making that fact more clear. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computerworld.com/cwi/stories/0,1199,NAV47-68-84-88_STO61038,00.html SOHOWARE BROADGUARD SECURE CABLE/DSL ROUTER So, you just ordered your high-speed broadband Internet service. But what are you going to connect it to? You need a device that will meet your functionality requirements and provide the security needed for a network behind a broadband connection. There are several such products available. In this review, I will focus on one in particular: the SOHOware BroadGuard Secure Cable/DSL Router. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://unixreview.com/articles/2001/0105/0105o/0105o.htm INTERVIEW WITH WIETSE VENEMA This article is an interview with Wietse Venema. He is a well-known and proven Unix programmer and author of various software tools and security articles. One of Venema's widely-used tools is tcp_wrappers, also called TCPD; it can be used for monitoring and filtering incoming network requests. This tcpd program is included with numerous Unix-type operating systems; commonly it is used with inetd (the "internet super-server"), but also various other programs include its functionality by using libwrap which is based on Wietse Venema's tcp_wrappers. Recently, there's been a lot of discussion and news about Darren Reed's IP Filter licensing. The IP Filter code license has the exact same "Redistribution and use in source and binary forms are permitted" statement as Venema's tcp_wrappers code. Regular BSD-type licenses say the same thing, but they also include: "with or without modification". Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.bsdtoday.com/2001/June/Features496.html MOST CANADIAN SURFERS ANXIOUS ABOUT VIRUS ATTACKS Almost half of all Canadian Web users have been victimized at some time by a virus and three out of four worry about future attacks, according to a study just released. The survey showed that Canadians have significant concerns about the potential of new computer viruses, with 46 percent claiming to have been hit by digital bugs that have cost them time and money. The research, by market research company Ipsos-Reid, found that over 78 percent of Canadian Internet users are worried about being bitten by a computer virus sometime in the future. Link: http://www.net-security.org/cgi-bin/news.cgi?url=http://www.computeruser.com/news/01/06/03/news7.html ALLDAS.DE WEBSITE UNDER DoS Alldas.de announcement: "After our ISP Kvalito has been under heavy DDOS Attacks for over 24 hours yesterday, dropping their whole Network with all other Web/Shellservers, they decided to pull the plug on Alldas.de more or less." They are now back online, but they need a new web host. Link: http://www.alldas.de/?doc=news#7 ---------------------------------------------------------------------------- Security issues --------------- All vulnerabilities are located at: http://net-security.org/text/bugs ---------------------------------------------------------------------------- FREESTYLE CHAT SERVER VULNERABILITY Freestyle Chat server is http chat environment. It is vulnerable to a variation of the dot dot bug. Freestyle also suffers from a device name denial of service. Link: http://www.net-security.org/text/bugs/991053539,69155,.shtml INOCULATEIT FOR LINUX VULNERABILITY There is a vulnerability in InoculateIT for Linux, and probably other Unix versions of InoculateIT, which allows local non-root users to delete any file on the system, and under some circumstances to overwrite any file on the system, next time the "update_signature" is run by root. If the recommendations in the documentation are followed, this will happen every day at 1am. Link: http://www.net-security.org/text/bugs/991053631,15257,.shtml REMOTE VULNERABILITIES IN OMNIHTTPD If malicious user sends lot requests to some existing or non-existing PHP script on web-server it will consume 100% percent of processor speed. Why does this happend? Every time you send request for PHP script, OmniHTTPd server starts PHP.exe and then tries to run script rather then making it memory-resident. Link: http://www.net-security.org/text/bugs/991053823,81804,.shtml TURBOLINUX SECURITY ANNOUNCEMENT - PMAKE In the Turbolinux platforms referenced above, the pmake binary is installed setuid root. A local user could run pmake with root privileges. This could lead to a possibility of an attacker exploiting vulnerabilities in other programs that pmake uses. Link: http://www.net-security.org/text/bugs/991082510,86407,.shtml TURBOLINUX SECURITY ANNOUNCEMENT - OPENSSL There are four security fixes that have been applied to this update of openssl: -The behavior of OpenSSL has been modified to avoid using environment variables when running as root. -A checking scheme has been implemented to check the result of RSA-CRT. This reduces the possibility of deducing the private key from an incorrectly calculated signature. -A prevention measure against Bleichenbacher's DSA attack is also added. -The premaster secret is zeroed after deriving the master secret in DH ciphersuites. Link: http://www.net-security.org/text/bugs/991082563,46459,.shtml CESARFTP V0.98B VULNERABILITIES CesarFTP v0.98b has a triple dot directory traversal vulnerability and weak password encryption. Link: http://www.net-security.org/text/bugs/991082700,19241,.shtml GUILDFTPD BUFFER OVERFLOW GuildFTPD contains two different problems: 1. Buffer overrun in the SITE command with the ability to execute arbitrary code 2. A memory leak in the input parsing code Link: http://www.net-security.org/text/bugs/991082815,71868,.shtml SPEARHEAD NETGAP VULNERABILITY Using Unicode encoding techniques, a user (or a malicious web site) can bypass NetGap's filtering engine. Link: http://www.net-security.org/text/bugs/991082947,48348,.shtml VULNERABILITY IN SOLARIS MAILTOOL(1) The mailtool program is installed setgid mail by default in Solaris, a buffer overrun exists in the OPENWINHOME environment variable. By specifying a long environment buffer containing machine executable code, it is possible to execute arbitrary command(s) as gid mail. Link: http://www.net-security.org/text/bugs/991083056,43876,.shtml UNSAFE SIGNAL HANDLING IN SENDMAIL Sendmail signal handlers used for dealing with specific signals (SIGINT, SIGTERM, etc) are vulnerable to numerous race conditions, including handler re-entry, interrupting non-reentrant libc functions and entering them again from the handler. This set of vulnerabilities exist because of unsafe library function calls from signal handlers (malloc, free, syslog, operations on global buffers, etc). Link: http://www.net-security.org/text/bugs/991224075,23518,.shtml SPOONFTP BUFFER OVERFLOW VULNERABILITIES The SpoonFTP server doesn't correctly apply boundary checks on the 'CWD' and 'LIST' commands. Issueing one of these to the server followed by respectively 530 and 531 bytes of data or more will cause the server to die. Altough in the majority of the attempts internal errors will kill the SpoonFTP process before any data can be passed on to the stack, it is possible to use this to overwrite eip and execute arbitrary code on the target machine. Link: http://www.net-security.org/text/bugs/991308604,33512,.shtml PROGENY - GNUPG FORMAT STRING VULNERABILITY Gnu Privacy Guard (GnuPG, aka GPG) is an encryption program that provides functionality similar to PGP. It contains a format string vulnerability that can be used to invoke shell commands with the currently logged-on user's privileges. Link: http://www.net-security.org/text/bugs/991308816,57206,.shtml YAHOO AND HOTMAIL SCRIPTING VULNERABILITY Cross-site-scripting holes in Yahoo and Hotmail make it possible to replicate a Melissa-type worm through those webmail services. Link: http://www.net-security.org/text/bugs/991337681,22419,.shtml IMP-2.2.4 CREATES INSECURE TEMPORARY FILES Imp-webmail uses predictable temporary filenames when handling uploaded attachments or when 'viewing' attachments. Link: http://www.net-security.org/text/bugs/991337796,92493,.shtml ACME.SERVER DIRECTORY BROWSING VULNERABILITY Browsing of directories and files allowed to unauthorized users. Link: http://www.net-security.org/text/bugs/991478983,4413,.shtml CALDERA LINUX - WEBMIN ROOT ACCOUNT LEAK When starting system daemons from the webmin webfrontend, webmin does not clear its environment variables. Since these variables contain the authorization of the administrator, any daemon gets these variables. A simple attack would be to write a CGI scripts which just dumps all environment variables and wait for the administrator to restart apache using webmin. Link: http://www.net-security.org/text/bugs/991479060,57715,.shtml IPC@CHIP DEVELOPERS ISSUE FIXES This week, some alleged security risks with the BECK IPC@CHIP were published, you can read more here: http://www.net-security.org/text/bugs/990733767,69798,.shtml In this text we would like to comment to these possible security risks. Link: http://www.net-security.org/text/bugs/991479358,30522,.shtml INTERSCAN VIRUSWALL FOR NT REMOTE CONFIGURATION Trend Micro InterScan VirusWall for Windows NT is an antivirus software program and has capabilities to control remotely via pre-insalled CGI programs. There is a vulnerability that could allow for a malicious remote user to make unexpected modifications for the configuration of software. Link: http://www.net-security.org/text/bugs/991479507,9815,.shtml WFTPD 32-BIT (X86) 3.00 R5 VULNERABILITIES WFTPD v3.00 R5 is vulnerable to a directory traversal bug that allows remote users to browse through any directory on the victim's harddrive. Link: http://www.net-security.org/text/bugs/991599228,98820,.shtml ---------------------------------------------------------------------------- Security world -------------- All press releases are located at: http://net-security.org/text/press ---------------------------------------------------------------------------- RSA: SECURITY MIDDLEWARE FOR PLAYSTATION2 - [28.05.2001] RSA Security Inc. (Nasdaq: RSAS) today announced that it has joined the Sony Computer Entertainment's Tools and Middleware Licensed program. As part of this program, RSA Security will offer security middleware for the development of software applications for PlayStation2, enabling developers to create secure, Internet-based gaming, content and commerce applications for the PlayStation2 computer entertainment system. Press release: < http://www.net-security.org/text/press/991054815,52230,.shtml > ---------------------------------------------------------------------------- PROTEGRITY CHECK POINT/OPSEC ANNOUNCEMENT - [28.05.2001] Protegrity, Inc., the leading provider of solutions that protect franchise data, announced that its Secure.Data data-privacy solution has been certified by Check Point Software Technologies Open Platform for Security Alliance for interoperability with Check Point’s industry-leading Secure Virtual Network (SVN) architecture. Protegrity’s Secure.Data, the only privacy-management system for the protection of sensitive data within corporate databases, is the first product to earn OPSEC certification using Check Point’s UserAuthority interface. Customers can now extend Check Point strong VPN-1/FireWall-1 security to the Secure.Data encryption and access control process to protect confidential database information. Press release: < http://www.net-security.org/text/press/991082279,63390,.shtml > ---------------------------------------------------------------------------- EXODUS TEAMS WITH COUNTERPANE - [30.05.2001] Emphasizing the importance of managed security services, Exodus Communications, Inc., the leader in complex Internet hosting and management services, and Counterpane Internet Security, Inc., developer and leading provider of Managed Security Monitoring, announced a reseller agreement to provide Exodus customers with a comprehensive Managed Security Monitoring solution. Press release: < http://www.net-security.org/text/press/991227265,29402,.shtml > ---------------------------------------------------------------------------- BLUE RIBBON AWARD FOR 'CLEARTRUST SECURECONTROL' - [30.05.2001] Securant Technologies - the company that secures eBusiness - announced that ClearTrust SecureControl has received the coveted Blue Ribbon Award from Network World magazine as the best Web Access Control product. In a head-to-head comparative review that appeared in the May 29 issue, ClearTrust SecureControl was judged to be superior in all categories to competing offerings from Entrust Technologies, Netegrity, Oblix, OpenNetwork Technologies, and Symantec Corporation. Press release: < http://www.net-security.org/text/press/991227228,95537,.shtml > ---------------------------------------------------------------------------- NORTON INTERNET SECURITY TO SHIP WITH INTEL BOARDS - [30.05.2001] Symantec Corp. announced that Intel Corp., the world's largest chip maker, has chosen Norton Internet Security 2001 Family Edition to ship with selected Intel Desktop Boards to PC manufacturers. The combination of Symantec's award-winning security software with the performance and quality of Intel Desktop Boards provides a solid foundation with superior Internet protection for consumers' home office and small business environments. Press release: < http://www.net-security.org/text/press/991227377,31876,.shtml > ---------------------------------------------------------------------------- CYBERWALLPLUS 7.0 TO SECURE THE MOBILE USER - [30.05.2001] Network-1 Security Solutions, Inc., a technology leader in active intrusion prevention solutions for e-Business networks, introduced CyberwallPLUS 7.0, the latest version of its advanced host-based Internet security solutions for network servers and end-user computers. CyberwallPLUS 7.0 secures the machines of mobile enterprise users to counteract the vulnerabilities in the wireless standard 802.11B. In addition, dial-up Internet access has been added to existing high-speed access to protect remote users. Press release: < http://www.net-security.org/text/press/991229243,53005,.shtml > ---------------------------------------------------------------------------- F-SECURE INTRODUCES FILECRYPTO FOR SYMBIAN OS - [31.05.2001] F-Secure Corporation today introduced F-Secure FileCrypto for Symbian OS, a file encryption application for encrypting information stored in handheld devices. The product provides the strongest available protection against unauthorized access to data in devices using the Symbian OS, a software platform for next generation mobile phones. Press release: < http://www.net-security.org/text/press/991308337,30988,.shtml > ---------------------------------------------------------------------------- KASPERSKY PROTECTS 3 MILLION MAIL.RU MAILBOXES - [01.06.2001] Kaspersky Lab, an international data-security software-development company, and the first-rate Russian Internet holding Port.ru (www.port.ru) announce the start of a joint project to provide users of the popular public e-mail service MAIL.RU with free anti-virus correspondence scanning. Press release: < http://www.net-security.org/text/press/991406749,61120,.shtml > ---------------------------------------------------------------------------- SOPHOS: TOP TEN VIRUSES IN MAY 2001 - [01.06.2001] This is the latest in a series of monthly charts counting down the ten most frequently occurring viruses as compiled by Sophos, a world leader in corporate anti-virus protection. Press release: < http://www.net-security.org/text/press/991411352,30099,.shtml > ---------------------------------------------------------------------------- SC MAGAZINE: CYBERWALLPLUS GLOWING REVIEW - [01.06.2001] Network-1 Security Solutions, Inc., a technology leader in active intrusion prevention solutions for e-Business networks, announced today that CyberwallPLUS 6.1, its host intrusion prevention product for Windows NT/2000 servers, was featured in glowing terms in SC Magazine's June issue which was devoted to Internet security solutions. The product review mentions the entire Network-1 intrusion prevention product line, calling its overall security coverage "regal." Press release: < http://www.net-security.org/text/press/991411856,53303,.shtml > ---------------------------------------------------------------------------- PIVX SOLUTIONS PRESENTS INVISIWALL - [03.06.2001] PivX Solutions today presented the business model for Invisiwall, the company's patented network intrusion security system, to more than 60 venture capitalists attending VentureNet 2001 (http://www.venturenet.org), the premier capital conference for software, Internet, biomedical, optical or wireless companies with a strong software component. Press release: < http://www.net-security.org/text/press/991600154,13068,.shtml > ---------------------------------------------------------------------------- MANDRAKESOFT UNFOLDS LINUX SECURITY STRATEGY - [03.06.2001] In a much awaited move, MandrakeSoft today outlines its Linux Security strategy aimed at individual, small office home office (SoHo) and small and medium enterprise (SME) users, and announces the availability of the "Single Network Firewall." In line with its continuing commitment to open source, all MandrakeSecurity products are being developed and made available for free download via the Internet under the General Public License. Press release: < http://www.net-security.org/text/press/991600242,99426,.shtml > ---------------------------------------------------------------------------- Featured products ------------------- The HNS Security Database is located at: http://www.security-db.com Submissions for the database can be sent to: staff@net-security.org ---------------------------------------------------------------------------- KEYTOOLS CRYPTO In certain environments (constrained devices, non-standard operating systems) highly portable, stable, low-footprint cryptographic libraries are required. KeyTools Crypto is designed to offer core cryptographic services and algorithm implementation, enabling application developers to build strong information security systems based on state-of-the-art techniques. Using KeyTools Crypto, almost any application can be developed to include any the most popular and trusted cryptographic algorithms, such as RSA, DSA, Diffie-Hellman, DES, Triple-DES, RC2 and RC4 etc. Read more: < http://www.security-db.com/product.php?id=33 > This is a product of Baltimore Technologies, for more information: < http://www.security-db.com/info.php?id=9 > ---------------------------------------------------------------------------- DRAGON SQUIRE Dragon Squire is a host monitor. It looks at system logs for evidence of malicious or suspicious application activity in real time. It also monitors key system files for evidence of tampering. Dragon Squire has been tuned to prevent high load levels and minimize any negative impact to a server´s performance. Besides being an excellent system security tool, Dragon Squire can also analyze firewall logs, router events and just about anything that can speak SNMP or SYSLOG. Read more: < http://www.security-db.com/product.php?id=293 > This is a product of Enterasys Networks - Network Security Wizards, for more information: < http://www.security-db.com/info.php?id=58 > ---------------------------------------------------------------------------- ZYAN FIREWALL Zyan Firewall security service is a network-based, stateful inspection firewall ideal for protecting residences or companies with no servers on their LAN that will need to be accessed by the outside. Anything originating from the Internet that does not match the client´s request will not be allowed to pass. Read more: < http://www.security-db.com/product.php?id=227 > This is a product of Zyan Communications, for more information: < http://www.security-db.com/info.php?id=41 > ---------------------------------------------------------------------------- Featured articles ----------------- All articles are located at: http://www.net-security.org/text/articles Articles can be contributed to staff@net-security.org ---------------------------------------------------------------------------- NETWORK MONITORING WITH DSNIFF In order to properly understand how your network operates and to debug any problems with network congestion, and other network issues, network monitoring is essential. It helps to quickly find out if your local network is having a problem, a particular host, or if some hosts are using up an excessive amount of bandwidth. It can also be used to just provide a historical analysis of how the network is being used. Read more: < http://www.net-security.org/text/articles/dsniff.shtml > ---------------------------------------------------------------------------- Security Software ------------------- All programs are located at: http://net-security.org/various/software ---------------------------------------------------------------------------- NABOU 1.7 nabou is a Perl script which can be used to monitor changes to your system. It provides file integrity checking, and can also watch crontabs, suid files and user accounts for changes. It stores all data in standard dbm databases. Info/Download: < http://www.net-security.org/various/software/991478847,22596,linux.shtml > ---------------------------------------------------------------------------- ACTIVE PORTS Active Ports - easy to use tool for Windows NT/2000/XP that enables you to monitor all open TCP/IP and UDP ports on the local computer. Active Ports maps ports to the owning application so you can watch which process has opened which port. It also displays a local and remote IP address for each connection and allows you to close any port. Active Ports can help you to detect trojans and other malicious programs. Info/Download: < http://www.net-security.org/various/software/991478257,60876,windows.shtml > ---------------------------------------------------------------------------- SECURITY DEPARTMENT 1.5 Security Department is a resident file system protector for Windows 95 and Windows 98. It provides several levels of protection for different folders and files . You can prevent various actions for folders and files : copying, moving, deleting, renaming and so on. In addition to the two standard protection levels "Read Only" and "Full protection", there is the Custom Protection level that allows you to fine tune the access of specific folders and files. Access to various folders and files can also be set differently for each user on a single PC. Info/Download: < http://www.net-security.org/various/software/991478643,12617,windows.shtml > ---------------------------------------------------------------------------- MASKER 1.5 Masker loads any file and encrypts it for protection using the RC4 algorithm. The encrypted files will then be hidden in the carrierfile. The carrierfile can be: imagefile (bmp, gif, jpg, tif); audiofile (wav, mid, snd, mp3); programfile (exe, dll); videofile (avi, mov, mpg). It is not possible to recognize that the carrierfile contains hidden files. Also the carrierfile will remain fully functional. Images can be viewed, sounds can be played and videos can be displayed on the monitor. Only you, using your password, are allowed to obtain access to the hidden files. MASKER is a very userfriendly program, you will have full control of the hidden files. Try it out and get the total security! Info/Download: < http://www.net-security.org/various/software/991478744,98708,windows.shtml > ---------------------------------------------------------------------------- Defaced archives ------------------------ [28.05.2001] Original: http://www.borland.com.pt/ Defaced: http://defaced.alldas.de/mirror/2001/05/28/www.borland.com.pt/ OS: Windows Original: http://www.dragonball.com/ Defaced: http://defaced.alldas.de/mirror/2001/05/28/www.dragonball.com/ OS: Windows [29.05.2001] Original: http://lmic1.co.nrcs.usda.gov/ Defaced: http://defaced.alldas.de/mirror/2001/05/29/lmic1.co.nrcs.usda.gov/ OS: Windows Original: http://libwww.library.phila.gov/ Defaced: http://defaced.alldas.de/mirror/2001/05/29/libwww.library.phila.gov/ OS: Windows Original: http://racer.pamd.uscourts.gov/ Defaced: http://defaced.alldas.de/mirror/2001/05/29/racer.pamd.uscourts.gov/ OS: Windows Original: http://www.navak.navy.mil/ Defaced: http://defaced.alldas.de/mirror/2001/05/29/www.navak.navy.mil/ OS: Windows Original: http://www.fms2.treas.gov/ Defaced: http://defaced.alldas.de/mirror/2001/05/29/www.fms2.treas.gov/ OS: Windows [30.05.2001] Original: http://www.mazda.com.tr/ Defaced: http://defaced.alldas.de/mirror/2001/05/30/www.mazda.com.tr/ OS: Windows Original: http://www.mwrswest.navy.mil/ Defaced: http://defaced.alldas.de/mirror/2001/05/30/www.mwrswest.navy.mil/ OS: Windows Original: http://www.sacramento.navy.mil/ Defaced: http://defaced.alldas.de/mirror/2001/05/30/www.sacramento.navy.mil/ OS: Windows Original: http://www.kinkaid.navy.mil/ Defaced: http://defaced.alldas.de/mirror/2001/05/30/www.kinkaid.navy.mil/ OS: Windows [31.05.2001] Original: http://themes.org/ Defaced: http://defaced.alldas.de/mirror/2001/05/31/themes.org/ OS: Linux Original: http://www.epson.gr/ Defaced: http://defaced.alldas.de/mirror/2001/05/31/www.epson.gr/ OS: Windows [01.06.2001] Original: http://proxy.intechworld.net/ Defaced: http://defaced.alldas.de/mirror/2001/06/01/proxy.intechworld.net/ OS: Linux [02.06.2001] Original: http://www.cybernanny.net/ Defaced: http://defaced.alldas.de/mirror/2001/06/02/www.cybernanny.net/ OS: Unknown Original: http://cdserver.er.usgs.gov/ Defaced: http://defaced.alldas.de/mirror/2001/06/02/cdserver.er.usgs.gov/ OS: Windows Original: http://www.library.gov.vi/ Defaced: http://defaced.alldas.de/mirror/2001/06/02/www.library.gov.vi/ OS: Windows ---------------------------------------------------------------------------- ======================================================== Advertisement - HNS Security Database ======================================================== HNS Security Database consists of a large database of security related companies, their products, professional services and solutions. HNS Security Database will provide a valuable asset to anyone interested in implementing security measures and systems to their companies' networks. Visit us at http://www.security-db.com ======================================================== Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org http://security-db.com