NEOHAPSIS - Peace of Mind Through Integrity and Insight

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com

Neohapsis > Archives > SAC/Security Express> 2002

From: Network Computing and The SANS Institute (sans+ZZ51349830940325134_at_sans.org)
Date: Thu Nov 07 2002 - 13:27:27 CST

Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Re: Your personalized newsletter

                 -- Security Alert Consensus --
                       Number 044 (02.44)
                  Thursday, November 7, 2002
                       Created for you by
            Network Computing and the SANS Institute
                      Powered by Neohapsis

----------------------------------------------------------------------

Welcome to the latest edition of Security Alert Consensus! Below
you should find information pertaining only to the categories you
requested. Information on how to manage your subscription can be found
at the bottom of the newsletter. If you have any problems or questions,
please e-mail us at <consensusnwc.com>.

************************* Begin Advertisement ************************

This issue sponsored by Network Computing's Tech Library and Bitpipe
Inc.

How secure are your Web-based applications?

FREE Internet Security Systems White Paper: Web Application Protection
- Using Existing Protection Solutions

This paper highlights emerging threats specific to Web application
security and provides guidance on effective approaches to Web
application protection.

http://techlibrary.networkcomputing.com/data/detail?id=1032958097_44&type=RES&x=1942521078&src=email

************************** End Advertisement *************************

AIX admins will be busy this week; IBM released a batch of new
security-related APARs. A few new bugs will let local attackers gain
root privileges.

Microsoft also released a few patches. This week's IIS cumulative patch
isn't as critical as ones past, so there's no urgent rush to apply it
(unless you're a Web hosting provider). A patch for the PPTP buffer
overflow previously reported also was released.

Until next week,
--Security Alert Consensus Team

************************************************************************

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

TABLE OF CONTENTS:

{02.44.017} Win - MS02-062: IIS cumulative patch 11/2002
{02.44.018} Win - MS02-063: PPTP buffer overflow
{02.44.019} Win - MS02-064: Win2K root folder improper permissions
{02.44.029} Win - Pablo FTP server multiple format string
            vulnerabilities
{02.44.031} Win - Xeneo HTTP server percent DoS
{02.44.009} Linux - Update {01.45.013}: teTeX insecure temp file and
            dvips invocation
{02.44.010} Linux - Update {02.29.004}: libpng progressive image
            loading overflows
{02.44.011} Linux - Update {02.39.003}: GNU tar file extraction
            directory traversal
{02.44.012} Linux - Update {02.43.007}: ypserv memory leak DoS
{02.44.013} Linux - Update {02.41.008}: heartbeat daemon format string
            overflow
{02.44.014} Linux - Update {02.42.013}: Apache mod_ssl host name CSS
{02.44.015} Linux - Update {02.41.012}: syslog-ng macro expansion
            overflow
{02.44.016} Linux - Update {02.30.003}: chfn /etc/ptmp lockfile
            vulnerability
{02.44.020} Linux - Update {02.38.013}: Multiple Mozilla 1.0
            vulnerabilities
{02.44.030} Linux - Update {02.40.013}: Apache host name CSS, ab
            overflow and shared memory vulnerabilities
{02.44.001} AIX - autofs executable map command execution
{02.44.002} AIX - Update {02.32.029}: rpc.ttdbserverd _TT_CREATE_FILE()
            heap overflow
{02.44.003} AIX - Update {02.26.002}: DNS libresolve/resolver buffer
            overflow
{02.44.004} AIX - Update {02.31.009}: RPC XDR array decoding overflow
{02.44.005} AIX - dump_smutil.sh insecure temp file handling
{02.44.006} AIX - nslookup local buffer overflow
{02.44.007} AIX - AIX ypserv security vulnerability
{02.44.022} NApps - Iomega NAS A300U multiple vulnerabilities
{02.44.025} NApps - Linksys BEFSR41 Gozila.cgi DoS
{02.44.026} NApps - NetScreen SSH DoS
{02.44.033} NApps - Cisco ONS multiple vulnerabilities
{02.44.036} Other - Tru64 TruCluster interconnect DoS
{02.44.008} Cross - Update {02.42.020}: Heimdal kadmind multiple
            vulnerabilities
{02.44.021} Cross - log2mail message overflow
{02.44.023} Cross - PHPNuke account manager SQL injection
{02.44.024} Cross - Prometheus CGI framework code execution
{02.44.027} Cross - Abuse game -net parameter overflow
{02.44.028} Cross - ion-p CGI page parameter file retrieval
{02.44.032} Cross - gBook CGI admin login bypass
{02.44.034} Cross - Oracle iSQLPlus user name overflow
{02.44.035} Cross - IPFilter FTP module state tracking vulnerability
{02.44.037} Cross - Perl Mail::Mailer command execution

- --- Windows News -------------------------------------------------------

*** {02.44.017} Win - MS02-062: IIS cumulative patch 11/2002

Microsoft released MS02-062 ("IIS cumulative patch 10/2002"). The
cumulative patch fixes four new vulnerabilities: local, out-of-process
ISAPIs can gain system privileges; a WebDAV request memory exhaustion
DoS; '.com' file upload bypasses script checking; and cross-site
scripting in the administrative pages.

FAQ and patch:
http://www.microsoft.com/technet/security/bulletin/MS02-062.asp

Source: Microsoft
http://archives.neohapsis.com/archives/microsoft/2002-q4/0010.html

*** {02.44.018} Win - MS02-063: PPTP buffer overflow

Microsoft released MS02-063 ("PPTP buffer overflow"). This patch
fixes the vulnerability previously discussed in {02.39.012} ("PPTP
preauthorization buffer overflow").

FAQ and patch:
http://www.microsoft.com/technet/security/bulletin/MS02-063.asp

Source: Microsoft
http://archives.neohapsis.com/archives/microsoft/2002-q4/0009.html

*** {02.44.019} Win - MS02-064: Win2K root folder improper permissions

Microsoft released MS02-064 ("Win2K root folder improper
permissions"). The root drive folder (C:\) in all versions of Windows
2000 gives 'everyone' full control. Since the root directory is
automatically in the path under certain situations, this could let
an attacker place a trojan on the system for execution.

FAQ and patch:
http://www.microsoft.com/technet/security/bulletin/MS02-064.asp

Source: Microsoft
http://archives.neohapsis.com/archives/microsoft/2002-q4/0008.html

*** {02.44.029} Win - Pablo FTP server multiple format string
vulnerabilities

Pablo FTP Server versions 1.5 and prior contain format string
vulnerabilities in the handling of various FTP commands, including the
login prompt. This could allow a remote attacker to execute arbitrary
code on the system.

This vulnerability is confirmed and fixed in version 1.5.1.

Source: VulnWatch
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0057.html

*** {02.44.031} Win - Xeneo HTTP server percent DoS

The Xeneo HTTP server version 2.1.0.0 crashes when an attacker submits
a URL request ending in a single percent sign ('%'). This leads to
a denial of service attack.

This vulnerability is confirmed and fixed in versions 2.1.5 and later.

Source: VulnWatch
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0058.html

- --- Linux News ---------------------------------------------------------

*** {02.44.009} Linux - Update {01.45.013}: teTeX insecure temp file
and dvips invocation

Conectiva released updated teTeX packages, which fix the vulnerability
discussed in {01.45.013} ("teTeX insecure temp file and dvips
invocation").