HNS Newsletter Issue 146 - 27.01.2003. http://net-security.org This is a newsletter delivered to you by Help Net Security. It covers weekly roundups of security events that were in the news the past week. Visit Help Net Security for the latest security news - http://net-security.org. ----------------------------------------------------------------- SECURITY INCIDENT ALERT ----------------------------------------------------------------- Check your Web servers, FTP servers, Mail servers , DNS servers, firewalls, IDS systems, switchers and routers for over 900 up to date vulnerabilities. Secure your critical assets today! FREE System Security Test and Detailed Report http://www.net-security.org/lm/ads/ads.pl?banner=scannerx1 ----------------------------------------------------------------- Table of contents: 1) Security news 2) Vulnerabilities 3) Advisories 4) Articles 5) Interviews 6) Reviews 7) Security world 8) Security software 9) Virus news ----------------------------------------------------------------- MS SQL WORM ROUNDUP There is a new worm that attempts to exploit vulnerabilities in Microsoft SQL 2000 servers and is causing increased traffic on UDP port 1434. This roundup contains the analysis, latest news updates, solutions, security advisories and AV vendor releases on this worm. >> http://www.net-security.org/article.php?id=369 ----------------------------------------------------------------- [ Security news ] ---------------------------------------------------------------- SECURE TO THE CORE A holistic approach that balances policy, process and technology is paramount to a successful security program. >> http://www.net-security.org/news.php?id=1841 THE CANARY IN THE DATA MINE The government's "Total Information Awareness" project aims at protecting us from harm by burrowing deep into our lives. One lawmaker is rightfully suspicious. >> http://www.net-security.org/news.php?id=1842 KEEPING USERS IN CHECK Zonker covers two tools — the first is scponly, a tool that allows you to restrict users to using scp to copy files, and the other is the KNOPPIX live-on-CD Linux distribution. >> http://www.net-security.org/news.php?id=1843 TACTICAL SECURITY 101 You know information security is integral to IT operations and to business success. Building a strong defense isn't cheap, so wise management of funding and resources is crucial. >> http://www.net-security.org/news.php?id=1844 HOMEMADE GPS JAMMERS RAISE CONCERNS Communications experts are assessing the public safety and security implications of an article in Phrack that provides directions for making cheap devices that can jam GPS signals. >> http://www.net-security.org/news.php?id=1845 KEEPING SECURITY A SECRET Whitfield Diffie: If you depend on a secret for your security, what do you do when the secret is discovered? You could be vulnerable until you design another system. >> http://www.net-security.org/news.php?id=1846 KEVIN MITNICK SOON TO BE BACK ONLINE Kevin Mitnick gets off probation tomorrow and plans to dive back into the Internet. >> http://www.net-security.org/news.php?id=1847 NETWORK SOFTWARE AIMED AT RECOGNIZING HACKERS' HABITS Researchers are developing software that can generate highly personalized profiles of network users by analyzing the sequences of commands entered at each computer terminal. >> http://www.net-security.org/news.php?id=1852 VIRUS AUTHOR FACES FIVE YEARS IN JAIL A virus author who admitted infecting thousands of computers across the world with fast-spreading viruses is facing five years in jail. >> http://www.net-security.org/news.php?id=1853 DON'T BROADCAST INFO ABOUT WINDOWS SERVERS TO HACKERS Here are some tips to help you safeguard your Windows server information. >> http://www.net-security.org/news.php?id=1854 OPEN SOURCE HONEYPOTS: LEARNING WITH HONEYD In this article Lance Spitzner teaches us how to use Honeyd, an open source honeypot that is designed to be used on Unix-based operating systems. >> http://www.net-security.org/news.php?id=1855 SECURING LINUX 101 The last thing you want to do is run a professional webhosting service with outdated software that is exploitable. >> http://www.net-security.org/news.php?id=1862 HOW SAFE IS WIFI? BETTER TAKE SOME PRECAUTIONS Although the safety of WiFi networks is improving, sensitive information crossing most existing systems can be stolen. The odds of it happening to you are greatly reduced if you take certain precautions. >> http://www.net-security.org/news.php?id=1863 THE TURKEY THAT BITES With last week's RIAA worm hoax, the scallywags at Gobbles raised security advisories to subversive performance art. >> http://www.net-security.org/news.php?id=1864 PORT80 SOFTWARE SURVEYS TOP 1000 CORPS' WEB SERVERS Port80 Software conducted a survey of the 1000 leading corporations' Web sites and discovered Microsoft IIS commands a strong 54% market share. >> http://www.net-security.org/news.php?id=1865 BUSINESSES GET TOOLS TO MANAGE ACCESS RIGHTS Vendors enhance identity-management applications to provide better control. >> http://www.net-security.org/news.php?id=1866 SANS IN NEED OF A SECURITY PLAN With attacks on the rise and security spending down, the last thing guardians of the network can afford is another exposed flank. >> http://www.net-security.org/news.php?id=1867 IDENTITY-THEFT COMPLAINTS ALMOST DOUBLE IN 2002 Complaints about identity theft nearly doubled in 2002 as the fast-growing crime topped the government's list of consumer frauds for a third consecutive year. >> http://www.net-security.org/news.php?id=1872 FACES AND EYES RIVAL PASSWORDS Biometric technology which identifies people by the shape of the face, pattern of the iris or fingerprint is soon going to play a greater part in our lives. >> http://www.net-security.org/news.php?id=1873 TOP 10 TIPS FOR SETTING A SECURE COMMUNICATIONS POLICY Here are the top 10 things IT policy-makers should consider when developing corporate e-mail policies. >> http://www.net-security.org/news.php?id=1874 SECURITY FLAW EXPOSES AOL ACCOUNTS The accounts of millions of AOL subscribers were jeopardized this week due to a serious flaw in the company's Web-based mail system. >> http://www.net-security.org/news.php?id=1875 UPDATES AND DOUBLE DATES If last year's seemingly endless rounds of security updates didn't seriously undermine the credibility of Microsoft's "Trusted Computing" initiative, 2003 continues to bring problems. >> http://www.net-security.org/news.php?id=1876 .NET DEMYSTIFIES ENCRYPTION .Net makes cryptography a little simpler by putting everything into one SDK. Find out how to encrypt and decrypt a text file with the System.Security.Cryptography namespace. >> http://www.net-security.org/news.php?id=1877 BUGWATCH: THE ATTACK OF THE SEQUELS Most computer virus creators are not original. As with Hollywood film executives they go with what works and then make a sequel. >> http://www.net-security.org/news.php?id=1878 GATES PLEDGES RENEWED SECURITY DRIVE Bill Gates said that the Microsoft has taken great strides to secure its products, but acknowledged that the company still has far to go to achieve "Trustworthy Computing." >> http://www.net-security.org/news.php?id=1881 AUSTRALIAN HACKERS LAUNCH SECURITY CONFERENCE A self-proclaimed "security conference for the Australian hacker community, organised by the Australian hacker community" has been set down for Sydney in April. >> http://www.net-security.org/news.php?id=1882 ---------------------------------------------------------------- [ Vulnerabilities ] All vulnerabilities are located here: http://www.net-security.org/archive_vuln.php ---------------------------------------------------------------- Blackboard 5.x & Patched 5.x Systems Password Retrieval Vulnerability >> http://www.net-security.org/vuln.php?id=2395 Slocate Local Buffer Overflow Vulnerability >> http://www.net-security.org/vuln.php?id=2394 Mailman Cross Site Scripting Vulnerability >> http://www.net-security.org/vuln.php?id=2393 SpamAssassin / spamc+BSMTP Rremote Buffer Overflow Vulnerability >> http://www.net-security.org/vuln.php?id=2392 YabbSE Remote Code Execution Vulnerability >> http://www.net-security.org/vuln.php?id=2391 Apache HTTP Server Path Parsing Errata >> http://www.net-security.org/vuln.php?id=2390 KCMS Library Service Daemon Arbitrary File Retrieval Vulnerability >> http://www.net-security.org/vuln.php?id=2389 WinRAR Buffer Overflow Vulnerability >> http://www.net-security.org/vuln.php?id=2388 Zorum Include File Vulnerability >> http://www.net-security.org/vuln.php?id=2387 MyRoom File Copy and Upload Vulnerabilities >> http://www.net-security.org/vuln.php?id=2386 PivX Multi-Vendor Game Server dDoS Vulnerabilities >> http://www.net-security.org/vuln.php?id=2385 phpBB SQL Injection Vulnerability >> http://www.net-security.org/vuln.php?id=2384 PHP-Nuke Remote Command Execution Vulnerability >> http://www.net-security.org/vuln.php?id=2383 Gabber 0.8.7 Leaks Presence Information Without User Authorization >> http://www.net-security.org/vuln.php?id=2382 phpTopsites Remote File Upload Vulnerability >> http://www.net-security.org/vuln.php?id=2381 phpLinks mail() abuse Vulnerability >> http://www.net-security.org/vuln.php?id=2380 CuteFTP 5.0 XP Buffer Overflow Vulnerability >> http://www.net-security.org/vuln.php?id=2379 Outreach Project Tool Multiple Vulnerabilities >> http://www.net-security.org/vuln.php?id=2378 phpPass SQL Injection Vulnerability >> http://www.net-security.org/vuln.php?id=2377 Geeklog 1.3.7 Multiple Cross Site Scripting Vulnerabilities >> http://www.net-security.org/vuln.php?id=2376 ---------------------------------------------------------------- [ Advisories ] All advisories are located at: http://www.net-security.org/archive_advi.php ---------------------------------------------------------------- Cisco Security Advisory - Microsoft SQL Server 2000 Vulnerabilities in Cisco >> http://www.net-security.org/advisory.php?id=1547 Cisco Security Advisory - MS SQL "Sapphire" Worm Mitigation Recommendations >> http://www.net-security.org/advisory.php?id=1546 CERT Advisory CA-2003-04 - MS-SQL Server Worm >> http://www.net-security.org/advisory.php?id=1545 Slackware Security Advisory - New CVS packages available >> http://www.net-security.org/advisory.php?id=1544 Slackware Security Advisory - New DHCP packages available >> http://www.net-security.org/advisory.php?id=1543 Mandrake Linux Security Advisory - printer-drivers >> http://www.net-security.org/advisory.php?id=1542 Microsoft Security Bulletin MS03-003 - Flaw in how Outlook 2002 handles V1 Exchange Server Security Certificates could lead to Information Disclosure >> http://www.net-security.org/advisory.php?id=1541 Microsoft Security Bulletin MS03-002 - Cumulative Patch for Microsoft Content Management Server >> http://www.net-security.org/advisory.php?id=1540 Microsoft Security Bulletin MS03-001 - Unchecked Buffer in Locator Service Could Lead to Code Execution >> http://www.net-security.org/advisory.php?id=1539 Microsoft Security Bulletin MS02-070 - Flaw in SMB Signing Could Enable Group Policy to be Modified (version 2.0) >> http://www.net-security.org/advisory.php?id=1538 CERT Advisory CA-2003-03 - Buffer Overflow in Windows Locator Service >> http://www.net-security.org/advisory.php?id=1537 CERT Advisory CA-2003-02 - Double-Free Bug in CVS Server >> http://www.net-security.org/advisory.php?id=1536 Conectiva Linux Security Announcement - libpng >> http://www.net-security.org/advisory.php?id=1535 Conectiva Linux Security Announcement - postgresql >> http://www.net-security.org/advisory.php?id=1534 Conectiva Linux Security Announcement - dhcp >> http://www.net-security.org/advisory.php?id=1533 Conectiva Linux Security Announcement - cvs (update) >> http://www.net-security.org/advisory.php?id=1532 Gentoo Linux Security Announcement - vim vim-core gvim >> http://www.net-security.org/advisory.php?id=1531 SuSE Security Announcement - cvs >> http://www.net-security.org/advisory.php?id=1530 SGI Security Advisory - Updated patches for SGI Advisories 20020903-02-P and 20021103-01-P >> http://www.net-security.org/advisory.php?id=1529 Debian Security Advisory - New kdesdk packages fix several vulnerabilities >> http://www.net-security.org/advisory.php?id=1528 Debian Security Advisory - New kdepim packages fix several vulnerabilities >> http://www.net-security.org/advisory.php?id=1527 Debian Security Advisory - New kdenetwork packages fix several vulnerabilities >> http://www.net-security.org/advisory.php?id=1526 Debian Security Advisory - New kdelibs packages fix several vulnerabilities >> http://www.net-security.org/advisory.php?id=1525 OpenPKG Security Advisory - wget >> http://www.net-security.org/advisory.php?id=1524 OpenPKG Security Advisory - python >> http://www.net-security.org/advisory.php?id=1523 Debian Security Advisory - New kdegraphics packages fix several vulnerabilities >> http://www.net-security.org/advisory.php?id=1522 Debian Security Advisory - New kdeadmin packages fix several vulnerabilities >> http://www.net-security.org/advisory.php?id=1521 OpenPKG Security Advisory - php, apache >> http://www.net-security.org/advisory.php?id=1520 OpenPKG Security Advisory - cvs >> http://www.net-security.org/advisory.php?id=1519 OpenPKG Security Advisory - vim >> http://www.net-security.org/advisory.php?id=1518 SCO Security Advisory - Linux: canna buffer overflow and denial of service >> http://www.net-security.org/advisory.php?id=1517 SGI Security Advisory - IRIX ToolTalk RPC Server Format String Vulnerability update >> http://www.net-security.org/advisory.php?id=1516 Red Hat Security Advisory - Updated python packages fix predictable temporary file >> http://www.net-security.org/advisory.php?id=1515 Conectiva Linux Security Announcement - cvs >> http://www.net-security.org/advisory.php?id=1514 Debian Security Advisory - New cvs packages fix arbitrary code execution >> http://www.net-security.org/advisory.php?id=1513 Gentoo Linux Security Announcement - cvs >> http://www.net-security.org/advisory.php?id=1512 SCO Security Advisory - Linux: Multiple Security Vulnerabilities in the Common Unix Printing System (CUPS) >> http://www.net-security.org/advisory.php?id=1511 Red Hat Security Advisory - Updated CVS packages available >> http://www.net-security.org/advisory.php?id=1510 SuSE Security Announcement - dhcp >> http://www.net-security.org/advisory.php?id=1509 Debian Security Advisory - New CUPS packages fix several vulnerabilities >> http://www.net-security.org/advisory.php?id=1508 OpenPKG Security Advisory - dhcpd >> http://www.net-security.org/advisory.php?id=1507 Conectiva Linux Update Announcement - sasl >> http://www.net-security.org/advisory.php?id=1506 SuSE Security Announcement - susehelp >> http://www.net-security.org/advisory.php?id=1505 Gentoo Linux Security Announcement - kde-2.2.x >> http://www.net-security.org/advisory.php?id=1504 Conectiva Linux Update Announcement - postfix >> http://www.net-security.org/advisory.php?id=1503 Debian Security Advisory - New dhcp3 packages fix arbitrary code execution >> http://www.net-security.org/advisory.php?id=1502 ---------------------------------------------------------------- [ Featured articles ] All articles are located at: http://www.net-security.org/articles_main.php Articles can be contributed to staff@net-security.org ---------------------------------------------------------------- NEW FLASH MEMORY DEVICE WITH ADVANCED SECURITY FEATURES AMD introduced a 64 Mbit page-mode Flash memory device with security features with multiple security modes including 64-bit password protection. >> http://www.net-security.org/article.php?id=356 NEW WIRELESS LAN SECURITY SERVICE AirDefense and NCS DataCom announced a partnership whereby NCS DataCom has launched the AirPatrol managed service. >> http://www.net-security.org/article.php?id=358 ARUBA WIRELESS NETWORKS ANNOUNCES MAJOR WI-FI BREAKTHROUGHS Aruba's new Wi-Fi switching system is the first to combine wireless network access and air monitoring with high-speed Gigabit Ethernet switching and higher-layer packet processing technologies. >> http://www.net-security.org/article.php?id=360 ABIT BRINGS LOW COST SECURITY TO THE SERVER MOTHERBOARD As a result of a partnership between ABIT and Cavium Networks, ABIT's SI-1Ns server motherboard is shipping with Cavium's NITROX Security Macro Processor. >> http://www.net-security.org/article.php?id=362 DETECTING WIRELESS LAN MAC ADDRESS SPOOFING This paper describes some of the techniques attackers utilize to disrupt wireless networks through MAC address spoofing, demonstrated with captured traffic. >> http://www.net-security.org/article.php?id=364 ASTARO SECURITY LINUX V4 ANNOUNCED AT LINUXWORLD EXPO New features contain VLAN and WLAN support, extended virus protection for POP3 email accounts, comprehensive heuristic spam blocking and more. >> http://www.net-security.org/article.php?id=365 CROSS-SITE TRACING (XST) WhiteHat staff discovered a new web security attack technique that is able not only to bypass the httpOnly mechanism present in i.e. 6 service pack 1, but in addition the ability to xss "just about" anything from "just about" anywhere. This technique allows client side scripting languages, such as javascript, and possibly other client-side technologies like vbscript, flash, java, etc., the ability access http web authentication credentials, with the added bonus of achieving this result over ssl. >> http://www.net-security.org/article.php?id=368 ---------------------------------------------------------------- [ Interviews ] All interviews are located at: ---------------------------------------------------------------- 3COM MARKETING MANAGER ON WIRELESS SECURITY Here are the opinions on wireless security issues by Gabor Szabo, 3Com EMEA Marketing Manager. >> http://www.net-security.org/article.php?id=357 WIRELESS PRODUCT MARKETING MANAGER AT SMC ON WIRELESS SECURITY Betty Chan has over ten years of experience in the high-tech industry and has been involved in the Wireless Networking area for the past three years. Here's her take on wireless security issues. >> http://www.net-security.org/article.php?id=359 INTERVIEW WITH ADI RUPPIN, MANAGING DIRECTOR OF SOFAWARE SofaWare Technologies, a Check Point company, makes secure Internet access simple and affordable for small businesses, consumers, and service providers seeking to deliver security services. >> http://www.net-security.org/article.php?id=361 SCOTT C. NEVINS, CEO OF PROTEGRITY ON DATABASE SECURITY We talked with Scott C. Nevins, President and CEO of Protegrity, about the company and database security issues. >> http://www.net-security.org/article.php?id=363 INTERVIEW WITH THE VICE PRESIDENT OF SALES AND MARKETING AT AUTHENTIFY In this interview Mr. John Zurawski talks about Authentify and various security issues. >> http://www.net-security.org/article.php?id=366 CTO OF DATAPOWER TECHNOLOGY ON XML SECURITY Eugene Kuznetsov, CTO of DataPower Technology, talks about the company and XML Security issues. >> http://www.net-security.org/article.php?id=367 ---------------------------------------------------------------- [ Reviews ] All reviews are located at: http://www.net-security.org/reviews.php ---------------------------------------------------------------- UNDERSTANDING PKI If you are planning to deploy PKI inside your company, "Understanding PKI" will provide an extensive amount of information you need to understand, to see how the things work. >> http://www.net-security.org/review.php?id=25 NETWORK INTRUSION DETECTION 3RD EDITION What gives this book great value is a variety of examples we get from intrusion detection mechanisms. This is much more helpful in understanding how things work than just theory. >> http://www.net-security.org/review.php?id=26 ---------------------------------------------------------------- [ Security world ] All press releases are located at: http://www.net-security.org/press_main.php ---------------------------------------------------------------- WhiteHat Discovers Serious Security Flaw Affecting All Web Servers >> http://www.net-security.org/press.php?id=1213 Diversinet Approves Reverse Stock Split >> http://www.net-security.org/press.php?id=1212 SecureInfo Wins $8.3 Million Air Force Computer Network Defense Contract >> http://www.net-security.org/press.php?id=1211 Intrusion Inc. Announces Financial Release Date and Conference Call >> http://www.net-security.org/press.php?id=1210 Damovo Becomes NetScreen Authorised Support Centre >> http://www.net-security.org/press.php?id=1209 New Survey Finds Fortune 1000 Companies Firmly Entrenched In Microsoft Web Server Technology >> http://www.net-security.org/press.php?id=1208 SecureInfo Wins $8.3 Million Air Force Computer Network Defense Contract >> http://www.net-security.org/press.php?id=1207 Zix Corporation Selected by National Health Service of West Surrey to Provide Secure e-Messaging for Healthcare Community >> http://www.net-security.org/press.php?id=1206 Neoteris Announces Agreement With IBM To Secure Access To Industry-Leading Enterprise Applications >> http://www.net-security.org/press.php?id=1205 Bluesocket Signs Partnerships with Airpath Wireless, GRIC Communications and iPass to Make Public Internet Access Simple, Secure >> http://www.net-security.org/press.php?id=1204 Matthew Powell to Lead Vernier Networks as President and CEO >> http://www.net-security.org/press.php?id=1203 GFI Releases Latest Version of its Acclaimed Network Security Scanner >> http://www.net-security.org/press.php?id=1202 realtime North America Introduces bioLock, the First SAP Certified Biometric Access And Function Control >> http://www.net-security.org/press.php?id=1201 ---------------------------------------------------------------- [ Security Software ] Windows software is located at: http://net-security.org/software_main.php?cat=1 Linux software is located at: http://net-security.org/software_main.php?cat=2 ---------------------------------------------------------------- SERVERMASK 2.0 FOR IIS ServerMask 2.0 removes or modifies unnecessary response data. The software provides control over what Server header data, if any, is visible in HTTP responses. >> http://www.net-security.org/software.php?id=434 PWGEN 1.15 PWGen is a password generator capable of creating *cryptographically strong* passwords or passphrases with lengths up to 2048 bits. It can also be used to create binary key files/discs or files consisting of purely random data. >> http://www.net-security.org/software.php?id=435 NAST 0.1.5 Nast is a packet sniffer and a LAN analyzer based on Libnet and Libpcap. It can sniff in normal mode or in promiscuos mode the packets on a network interface. It dumps the headers of packets and the payload in ascii or ascii-hex format. >> http://www.net-security.org/software.php?id=436 SECURE DATA MANAGER 1.0.1 The SDM application was created to help you manage your passwords and other private information for web sites, computers, and other programs within one secure application. A fully functional, open source, free, password manager! No limit or restrictions to the application. >> http://www.net-security.org/software.php?id=437 OPEN1X Open1x is an open source implementation of the IEEE 802.1x protocol. This project includes support for the authenticator and supplicant, while other projects (e.g., FreeRADIUS) provide support for the authentication server. >> http://www.net-security.org/software.php?id=438 BITDEFENDER ANTI SLAMMER SQL WORM This is a removal tool for an Internet worm that spreads using a known vulnerability in MS SQL Server. >> http://www.net-security.org/software.php?id=439 ---------------------------------------------------------------- [ Virus News ] All virus news are located at: http://www.net-security.org/viruses.php ---------------------------------------------------------------- MS SQL Worm Roundup >> http://www.net-security.org/virus_news.php?id=170 Panda Software Reports the Appearance of Redlof.B >> http://www.net-security.org/virus_news.php?id=169 Sophos Poll Says Virus Writer's Sentence is Not Satisfactory >> http://www.net-security.org/virus_news.php?id=168 Two Years Jail For UK Virus Writer >> http://www.net-security.org/virus_news.php?id=167 Virus Bulletin Conference 2003 Issues Call For Papers >> http://www.net-security.org/virus_news.php?id=166 Weekly Virus Report - Opaserv, Horo and Sahay Worms and W32.Sevic Trojan >> http://www.net-security.org/virus_news.php?id=165 Female Virus Writer Attacks Her Fellow Coders >> http://www.net-security.org/virus_news.php?id=164 Kaspersky Labs - Year 2002 Virus Review >> http://www.net-security.org/virus_news.php?id=163 ---------------------------------------------------------------- Questions, contributions, comments or ideas go to: Help Net Security staff staff@net-security.org http://net-security.org ---------------------- Subscribe to this weekly digest on: http://www.net-security.org/subscribe.php Unsubscribe by sending your e-mail address to: info@net-security.org with UNSUBSCRIBE in the message body. The archive of the newsletter in TXT and PDF format is available http://www.net-security.org/newsletter_archive.php ----------------------------------------------------------------- SECURITY INCIDENT ALERT ----------------------------------------------------------------- Check your Web servers, FTP servers, Mail servers , DNS servers, firewalls, IDS systems, switchers and routers for over 900 up to date vulnerabilities. Secure your critical assets today! FREE System Security Test and Detailed Report http://www.net-security.org/lm/ads/ads.pl?banner=scannerx1 -----------------------------------------------------------------