HNS Newsletter Issue 129 - 30.09.2002 http://net-security.org This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://net-security.org. ----------------------------------------------------------------- *** ALERT! *** ALL OF THE FOLLOWING APPLICATIONS ARE VULNERABLE TO ATTACK!: *** Oracle *** Microsoft SQL Server *** Sybase *** Lotus Domino QUESTION: How Vulnerable are Your Applications? ANSWER: Find out by downloading AppDetective from: ******* http://www.appsecinc.com/products/#pentest AppDetective will DISCOVER Rogue Installations; Perform Zero Knowledge PENETRATION TESTS without Administrative Rights; and Perform In-Depth SECURITY AUDITS from the Inside-Out without Agents. DOWNLOAD YOUR FREE EVALUATION VERSION TODAY FROM: http://www.appsecinc.com/products/#pentest ----------------------------------------------------------------- Table of contents: 1) Security news 2) Vulnerabilities 3) Advisories 4) Articles 5) Security world 6) Featured review 7) Security software 8) Virus news [ General security news ] ---------------------------------------------------------------- SHADOWCON 2002 INFORMATION ShadowCon 2002 will be held on October 17, 2002 in Naval Surface Warfare Center Dahlgren with a keynote from Alan Paller, Director of Research, SANS Institute. >> http://www.net-security.org/news.php?id=1077 WHITE HOUSE DEFENDS CYBERSECURITY PLAN A White House official is standing behind the administration's draft recommendations on cybersecurity, asserting that they have not been weakened by lobbying from technology companies. >> http://www.net-security.org/news.php?id=1078 SPAM AND VIRUS CONTROL? On the one hand is high-volume spam, which is a deliberate marketing act; on the other is virus/worm infected e-mail, with its automated activity. Distinguishing between them is hard. >> http://www.net-security.org/news.php?id=1079 A CYBERSECURITY SLEEPING PILL From a White House given to dramatic warnings of electronic Pearl Harbors comes an incongruously meek national strategy. Did industry lobbyists slip someone a Mickey? >> http://www.net-security.org/news.php?id=1080 IT SECURITY SPENDING DEFIES RECESSION Security spending is buoyant despite the overall downturn, according to analyst house IDC. >> http://www.net-security.org/news.php?id=1082 HACKER ABUSES MSP’S E-MAIL ADDRESS TO SEND PORN IMAGES A senior MSP has called in detectives after a computer hacker used her parliamentary e-mail address to send pornographic images over the internet. >> http://www.net-security.org/news.php?id=1083 SPAMASSASSIN SPEEDUP SpamAssassin is a great program for stopping almost all spam. The defaults are quite good, but it can be a little slow. Here are three ways to speed it up. >> http://new.zill.net/spamd-speedup.html XDCC - AN .EDU ADMIN'S NIGHTMARE Slave computers on IRC are serving warez and a massive amount of bandwidth is being wasted. The author describes what's happening from an insiders view. >> http://www.net-security.org/news.php?id=1086 WHO SAYS PARANOIA DOESN'T PAY OFF? There's a business case for paranoia if you're a distributor of Linux. >> http://www.net-security.org/news.php?id=1087 CYBER-TERRORISM STILL A THREAT Computer users should not relax their guard just yet, with terrorist groups still suspected to be plotting cyber attacks. >> http://www.net-security.org/news.php?id=1088 CONFIGURING IPSEC/IKE ON SOLARIS PART THREE This article will discuss the configuration of an IPsec VPN tunnel between two Solaris hosts. >> http://www.net-security.org/news.php?id=1089 WHO'S ON YOUR NETWORK? Many organizations are finding that firewalls, antivirus software and user authentication policies aren't enough to keep networks safe. That explains the growing market for intrusion detection technology. >> http://www.net-security.org/news.php?id=1090 NEW LAWS MAKE HACKING A BLACK-AND-WHITE CHOICE Kevin Finisterre likes to hew close to the ethical line separating the "white hat" hackers from the bad guys, but little did he know that his company's actions would draw threats of a lawsuit from HP. >> http://www.net-security.org/news.php?id=1091 BOSTON'S LOGAN GETS ID AUTHENTICATION TECHNOLOGY Logan International Airport in Boston will be the first U.S. airport to install identity authentication technology to screen passports, drivers licenses, visas, and other forms of identification. >> http://www.net-security.org/news.php?id=1092 CRYPTO BOFFINS: LET'S GET PHYSICAL Researchers at MIT have developed a physical token, based on tiny glass spheres encased in epoxy resin, as a more secure alternative to generating cryptographic keys electronically. >> http://www.net-security.org/news.php?id=1093 SECURITY SCANNING 101 Network and system security scanning is the most practical way to find out what the vulnerabilities and threats are on and for your systems and networks. >> http://www.net-security.org/news.php?id=1094 VENDORS MAKE A WIRELESS END RUN Microsoft, Cisco and major wireless LAN hardware vendors plan to leapfrog the standards process and adopt new 802.11b security protocols by year's end. >> http://www.net-security.org/news.php?id=1097 FBI FINGERPRINT RESEARCH HELPS SPAWN AN INDUSTRY To a large extent, the modern biometrics industry was born out of efforts to commercialize the Federal Bureau of Investigation's groundbreaking fingerprint scanning technology. >> http://www.net-security.org/news.php?id=1098 HOW A BANK GOT E-MAIL SCAMMED A Detroit secretary is the latest to fall for an "urgent business proposition" and requests for "urgent assistance" from an official sounding foreigner, becoming another victim of the ubiquitous e-mail scam. >> http://www.net-security.org/news.php?id=1099 CYBERCRIME CODE READY Internet service providers are preparing for a new cybercrime code of conduct that will detail how much data they should keep on subscribers in order to co-operate with law enforcement agencies. >> http://www.net-security.org/news.php?id=1100 JUDGE RESERVES DECISION ON SPAM FIGHTER TRIAL A judge has reserved his decision on whether a "fearless spam fighter" should face trial for disrupting the $1,000-a-day business of a company which sends junk email, or "spam". >> http://www.net-security.org/news.php?id=1101 BIG FIRMS NEGLECT SECURITY: SURVEY IT security remains a cottage industry, according to Information Security Magazine's annual survey. >> http://www.net-security.org/news.php?id=1102 WI-FI IN THE WILD: A FREELOADER'S GUIDE The cryptic symbols began showing up on city sidewalks and walls this summer: small, squiggly lines scrawled in white chalk, surrounded by arcane strings of letters and numbers. But who created them? >> http://www.net-security.org/news.php?id=1103 MICROSOFT LABS TRY TO BALANCE SECURITY, INNOVATION Projects with code names such as "Sapphire" and "Sideshow" may not conjure up visions of futuristic technology, but they promise to deliver advancements in how computers process and secure information. >> http://www.net-security.org/news.php?id=1104 LINUX FIREWALL ON OUT OF DATE HARDWARE: KERNEL 2.2 OR 2.4? The people at Portazero.info are publishing a performance test, trying to understand what kernel is best suited for a Linux firewall based on an out of date PC. >> http://www.net-security.org/news.php?id=1107 NETWORK DATA MANAGEMENT PROTOCOL (NDMP) WHITE PAPER What is the primary goal of enterprise storage management? To back up and restore information in an intelligent, secure, timely, cost-effective manner over all enterprise-wide operating systems. >> http://www.net-security.org/news.php?id=1108 DIGITAL DEFENSE TEST This test is based on a list of best practices for individual users and home network users developed by CERT. >> http://www.net-security.org/news.php?id=1109 REMOTE MANAGEMENT OF WIN2K SERVERS: THREE SECURE SOLUTIONS This article will discuss three methods to make the remote management of Win2K servers more secure. >> http://www.net-security.org/news.php?id=1110 ENTERPRISES MUST ADDRESS ATYPICAL SECURITY THREATS IT consulting firm Yankee Group has released two reports this month predicting tremendous growth in the Denial of Service and managed security markets. >> http://www.net-security.org/news.php?id=1112 U.S. PUTS MONEY ON WORLD BANK "HACKTIVISTS" The U.S. advises system administrators to monitor their systems for computer attacks planned during this week's meeting of the World Bank and the IMF. >> http://www.net-security.org/news.php?id=1113 EXPLOITING COMMON VULNERABILITIES IN PHP APPLICATIONS Shaun Clowes: "This paper is based on my speech during the Blackhat briefings in Singapore and Hong Kong in April 2001." >> http://www.net-security.org/news.php?id=1114 CHINA DENIES HACKING DALAI LAMA COMPUTER Responding to accusations that China's government tried to break into the Dalai Lama's computer network, a government spokeswoman said Wednesday that Beijing opposes all computer hacking. >> http://www.net-security.org/news.php?id=1115 UNIVERSITIES TAPPED TO BUILD SECURE NET Because of concerns over attacks, the National Science Foundation has enlisted five university computer science departments to develop a secure, decentralized Internet infrastructure. >> http://www.net-security.org/news.php?id=1116 BOOK REVIEW: LINUX ADMINISTRATION HANDBOOK The Unix Administration Handbook has long been regarded as one of the must-haves for *nix system admins, so Zonker was a bit excited to check out the new one revamped exclusively for Linux systems. >> http://www.net-security.org/news.php?id=1117 SECURITY GROUP COMES OUT OF THE SHADOWS After nearly a year in the shadows, the Organization for Internet Safety on Thursday formally announced its formation. >> http://www.net-security.org/news.php?id=1118 ANTI-SPAM LAWS A TOUGH 'CELL' California has a new bill that bans cell-phone spam. Some (irked) cell-phone owners are afraid the legislation doesn't go far enough. >> http://www.net-security.org/news.php?id=1119 THE CHALLENGES IN A WIRELESS WORLD This week's feature focuses on making wireless a realistic and secure part of the network. Wired solutions abound, but wireless is still the stepchild trying to fit in. >> http://www.net-security.org/news.php?id=1120 DISTRIBUTED.NET COMPLETES RC5-64 PROJECT On 14 July, a PIII-450 computer in Tokyo returned the winning key to the distributed.net keyservers. The key produces the plaintext output: "The unknown message is: some things are better left unread". >> http://www.net-security.org/news.php?id=1121 PROFITS FROM PIRACY Evidence is mounting that cracking down on software copyright infringement may not be good for business. >> http://www.net-security.org/news.php?id=1122 IT TESTING LAWS LEAVE LAWYERS LAUGHING IT managers are rejecting elaborate waivers pushed by IT security vendors for routine penetration testing, but legal concerns have been accelerating since the introduction of the Cybercrime Act (2001). >> http://www.net-security.org/news.php?id=1123 LINUX NEWBIE ADMINISTRATOR GUIDE This is a complete reference for new Linux users who wish to set up and administer their own Linux home computer, workstation and/or their home or small office network. >> http://sunsite.dk/linux-newbie P2P FOES DEFEND HACKING BILL Supporters of a new bill set to thwart peer-to-peer piracy have hitback at criticis, accusing them of using 'scare tactics'. >> http://www.net-security.org/news.php?id=1125 ---------------------------------------------------------------- ------------------------------------------------- HNS COVERAGE FROM RSA CONFERENCE 2002 EUROPE ------------------------------------------------- The Help Net Security staff will attend the conference and all the appropriate exhibitions and classes. Be sure to expect all the scoops, photos and interviews from the conference. The coverage from the conference is sponsored by ScannerX - http://www.scannerx.com/free1.htm ------------------------------------------------- [ Vulnerabilities ] All vulnerabilities are located here: http://www.net-security.org/archive_vuln.php ---------------------------------------------------------------- Exploitable Buffer Overflow in gv >> http://www.net-security.org/vuln.php?id=2079 Microsoft PPTP Server and Client Remote Vulnerability >> http://www.net-security.org/vuln.php?id=2078 PHP-Nuke Denial of Service Vulnerability >> http://www.net-security.org/vuln.php?id=2077 OpenVMS POP Server Local Vulnerability >> http://www.net-security.org/vuln.php?id=2076 Invision Board System Information Disclosure Vulnerability >> http://www.net-security.org/vuln.php?id=2075 acWEB HTTP Multiple Vulnerabilities >> http://www.net-security.org/vuln.php?id=2074 Shana Informed v3.05 Stores Random Data in Clear Text >> http://www.net-security.org/vuln.php?id=2073 IMG Attack - 6 Content Management Systems Vulnerable >> http://www.net-security.org/vuln.php?id=2072 PHP-NUKE 6 Cross Site Scripting Vulnerability >> http://www.net-security.org/vuln.php?id=2071 Tomcat 4.x JSP Source Code Exposure Vulnerability >> http://www.net-security.org/vuln.php?id=2070 Xoops RC3 Script Injection Vulnerability >> http://www.net-security.org/vuln.php?id=2069 HP Procurve 4000M Stacked Switch HTTP Reset Vulnerability >> http://www.net-security.org/vuln.php?id=2068 Dino's WebServer Directory Traversal Vulnerability >> http://www.net-security.org/vuln.php?id=2067 Internet Explorer 6 SSL Certificate Chain Verification >> http://www.net-security.org/vuln.php?id=2066 Technical Information About the Vulnerabilities Fixed by MS02-52 >> http://www.net-security.org/vuln.php?id=2065 JAWmail Multiple Cross Site Scripting Vulnerabilities >> http://www.net-security.org/vuln.php?id=2064 phpWebSite PHP Source Injection Vulnerability >> http://www.net-security.org/vuln.php?id=2063 Trillian 'raw 221' Buffer Overflow Vulnerability >> http://www.net-security.org/vuln.php?id=2062 Trillian 'JOIN' Buffer Overflow Vulnerability >> http://www.net-security.org/vuln.php?id=2061 Squirrel Mail 1.2.7 Cross SIte Scripting Vulnerabilitry >> http://www.net-security.org/vuln.php?id=2060 ---------------------------------------------------------------- [ Advisories ] All advisories are located at: http://www.net-security.org/archive_advi.php ---------------------------------------------------------------- Compaq Security Bulletin - WEBES Service Tools (HP Tru64 UNIX, HP OpenVMS, Windows) Potential File Access Vulnerability (Revision #3) >> http://www.net-security.org/advisory.php?id=1071 Red Hat Security Advisory - Updated Zope packages are available >> http://www.net-security.org/advisory.php?id=1070 Debian Security Advisory - New glibc packages fix >> http://www.net-security.org/advisory.php?id=1069 Microsoft Security Bulletin MS02-053 - Buffer Overrun in SmartHTML Interpreter Could Allow Code Execution >> http://www.net-security.org/advisory.php?id=1068 Gentoo Linux Security Announcement - tomcat >> http://www.net-security.org/advisory.php?id=1067 NetBSD Security Advisory - Multiple vulnerabilities in OpenSSL code (updated 2002/9/22) >> http://www.net-security.org/advisory.php?id=1066 Conectiva Linux Security Advisory - xchat >> http://www.net-security.org/advisory.php?id=1065 Compaq Security Bulletin - WEBES Service Tools (HP Tru64 UNIX, HP OpenVMS, Windows) Potential File Access Vulnerability >> http://www.net-security.org/advisory.php?id=1064 Conectiva Linux Security Advisory - kdelibs >> http://www.net-security.org/advisory.php?id=1063 ---------------------------------------------------------------- [ Featured articles ] All articles are located at: http://www.net-security.org/articles_main.php Articles can be contributed to staff@net-security.org ---------------------------------------------------------------- INTERVIEW WITH MARCEL GAGNÉ Marcel Gagné writes the "Cooking with Linux" column for Linux Journal, the online series, "Sysadmin's Corner," and is a regular columnist for UNIX Review and Sys Admin Magazine. >> http://www.net-security.org/article.php?id=190 OWASP GUIDE TO BUILDING SECURE WEB APPLICATIONS VERSION 1.1 The Guide covers various web application security topics from architecture to preventing attack specifics like cross site scripting, cookie poisoning and SQL injection. >> http://www.net-security.org/article.php?id=191 A NOTE ON PROACTIVE PASSWORD CHECKING Nowadays, proactive password checking algorithms are based on the philosophy of the dictionary attack, and they often fail to prevent some weak passwords with low entropy. In this paper, a new approach is proposed to deal with this new class of weak passwords by (roughly) measuring entropy. >> http://www.net-security.org/article.php?id=192 NORTEL NETWORKS ALTEON SWITCHED FIREWALL The Alteon Switched Firewall, integrating Check Point FireWall-1 Next Generation, is specifically designed to provide a total solution that allows you to ensure high levels of security without giving up the data center performance that is truly critical to business success. >> http://www.net-security.org/article.php?id=193 INTERNET RELATED SECURITY THREATS Some basic safety measures can prevent the Internet connection from becoming a problem instead of an advantage. >> http://www.net-security.org/article.php?id=189 SECURITY PATCHES FOR 602PRO LAN SUITE 2002, SQUIRREL MAIL 1.2.7 AND BRU WORKSTATION 17.0 Some of the vulnerabilities we add to our list don't have vendor replies inside them. These are some of the patches released after the vulnerability was disclosed to the BugTraq mailing list. >> http://www.net-security.org/article.php?id=188 ---------------------------------------------------------------- [ Security world ] All press releases are located at: http://www.net-security.org/press_main.php ---------------------------------------------------------------- Distributed Team Collaborates to Solve Secret-Key Challenge >> http://www.net-security.org/press.php?id=1029 Trend Micro Expert to Address Prestigious "VB2002" Virus Bulletin Conference >> http://www.net-security.org/press.php?id=1028 Utimaco Safeware AG - Financial Year 2001/2002 >> http://www.net-security.org/press.php?id=1027 F-Secure Plays Key Role In Slapping Down Slapper Worm >> http://www.net-security.org/press.php?id=1026 Guardian Digital Launches New EnGarde Secure Server Software >> http://www.net-security.org/press.php?id=1025 Panda Software Reports on Variants B and C of the Linux/Slapper Worm >> http://www.net-security.org/press.php?id=1024 Secos Introduces SecoScorpio >> http://www.net-security.org/press.php?id=1023 SSH to Introduce Two New Application Versions for the SSH Certifier PKI Product Family >> http://www.net-security.org/press.php?id=1022 Central Command Releases Its Annual Computer Security Survey Results for 2002 >> http://www.net-security.org/press.php?id=1021 SafeGuard PrivateDisk: The Electronic Safe for Files >> http://www.net-security.org/press.php?id=1020 Experian Uses RSA Security Technology to Expedite Credit Checks >> http://www.net-security.org/press.php?id=1019 Check Point Unveils Roadmap for Multi-Vendor Security Management >> http://www.net-security.org/press.php?id=1018 Microsoft Deploys Activcard Identity Management System >> http://www.net-security.org/press.php?id=1017 Activcard Unveils Activcard Identity Management System >> http://www.net-security.org/press.php?id=1016 Bull Evidian Adds Ubizen Professional Services to its List of Web Security Resellers >> http://www.net-security.org/press.php?id=1015 The European IT Oscar Goes To BitDefender >> http://www.net-security.org/press.php?id=1014 ---------------------------------------------------------------- [ Review ] All reviews are located at: http://www.net-security.org/reviews.php ---------------------------------------------------------------- ADVANCED LINUX NETWORKING This is a good advanced Linux networking book with some interesting tidbits and details on system administration. It succeds to cover, explain and help you get most out of your server. >> http://www.net-security.org/review.php?id=13 ---------------------------------------------------------------- [ Security Software ] Windows software is located at: http://net-security.org/software_main.php?cat=1 Linux software is located at: http://net-security.org/software_main.php?cat=2 ---------------------------------------------------------------- HOTFIX REPORTER 3.2 Hotfix Reporter is a free utility that works in conjunction with the Microsoft Network Security Hotfix Checker (HfNetChk) tool to scan your Windows NT 4, Windows 2000, or Windows XP server for missing patches. >> http://www.net-security.org/software.php?id=285 PACKETMON 1.0 AnalogX PacketMon allows you to capture IP packets that pass through your network interface - whether they originated from the machine on which PacketMon is installed, or a completely different machine on your network! >> http://www.net-security.org/software.php?id=286 VIRUSMD PERSONAL FIREWALL 3.0 VirusMD Personal Firewall is the tool of choice for diagnosing and treating Trojan horse infections. When combined with an updated virus scanner, VirusMD Personal Firewall will help keep you safe from intrusion. >> http://www.net-security.org/software.php?id=287 TGB::BOB! 2.31 For professional users working from home or "on the road", TGB::BOB! is the perfect protection against Eavesdropping, Hacker attacks, (spying on your data, controling your computer remotely, denial of service, etc.). It protects your PC while you are connected to the Internet or to a LAN. >> http://www.net-security.org/software.php?id=288 SPYSITES 1.0 SpySites includes a database of over 1,500 known Spy/Sleaze sites and guides you through the simple process of including them in Internet Explorer's Restricted Zone and setting policies to prevent them from performing intrusive acts on your PC. >> http://www.net-security.org/software.php?id=289 HOST MONITOR 3.26 HostMonitor is a network monitor program. You can create a list of jobs and tests in advance on a "set and forget" basis. Among the many checks it can do, it can monitor any TCP service, ping a host, retrieve an URL, check the available disk space, check integrity of your files and web site, test your SQL servers, check SMTP/POP/ IMAP/DNS/LDAP servers, test Windows NT services, monitor CPU Usage, and much more. >> http://www.net-security.org/software.php?id=290 K9 1.0 K9 is a Windows tool for passive OS detection. It uses WinPCAP to capture network traffic and a user friendly interface to handle results, fingerprint database, etc. >> http://www.net-security.org/software.php?id=291 TRANSPARENT SCREEN LOCK This program is ideal for system administrators, kiosks and retail stores. For a list of features visit the URL below. >> http://www.net-security.org/software.php?id=292 SPAMASSASSIN PRO 1.6 SpamAssassin Pro spam filtering software is built on the most popular and successful anti-spam filtering technology available: SpamAssassin. SpamAssassin Pro is the preferred choice of Technical Information Specialists and Managers on more than 30,000 email servers across America. >> http://www.net-security.org/software.php?id=293 EMAILTRACKERPRO 2.0A eMailTrackerPro is the e-mail analysis tool that enables you to track Internet e-mails back to the sender! People who hide behind 'anonymous' e-mail services like Yahoo and Hotmail might be very surprised to know that clues as to their true identity are being revealed within every e-mail sent! >> http://www.net-security.org/software.php?id=294 ---------------------------------------------------------------- [ Virus News ] All virus news are located at: http://www.net-security.org/viruses.php ---------------------------------------------------------------- Weekly Virus Report - Look at 3 Trojans and 2 Slapper Versions >> http://www.net-security.org/virus_news.php?id=86 Panda Software reports on Inwi Trojan >> http://www.net-security.org/virus_news.php?id=85 Tricks Used by Viruses to Lure Young Computer Users >> http://www.net-security.org/virus_news.php?id=84 F-Secure Notifies Admins of Slapper Infected Hosts >> http://www.net-security.org/virus_news.php?id=83 Panda Software Weekly Virus Report >> http://www.net-security.org/virus_news.php?id=82 Security in Java Applets and Active X Controls >> http://www.net-security.org/virus_news.php?id=81 Arrest for Slapper Worm Author >> http://www.net-security.org/virus_news.php?id=80 ISS Alerts on Slapper Worm Modification >> http://www.net-security.org/virus_news.php?id=79 ---------------------------------------------------------------- Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org ---------------------- Subscribe to this weekly digest on: http://www.net-security.org/subscribe.php Unsubscribe by sending your e-mail address to: info@net-security.org with UNSUBSCRIBE in the message body. The archive of the newsletter in TXT and PDF format is available http://www.net-security.org/newsletter_archive.php