ISS Security Alert Summary AS02-38

From: X-Force (xforce@iss.net)
Date: 09/23/02 

Date: Mon, 23 Sep 2002 14:18:14 -0400 (EDT)
To: alert@iss.net
From: X-Force <xforce@iss.net>

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to
majordomo@iss.net Contact alert-owner@iss.net for help with any problems!
---------------------------------------------------------------------------

-----BEGIN PGP SIGNED MESSAGE-----

Internet Security Systems Security Alert Summary AS02-38
September 23, 2002

X-Force Vulnerability and Threat Database:
http://www.iss.net/security_center

To receive these Alert Summaries, as well as other Alerts and
Advisories, subscribe to the Internet Security Systems Alert
mailing list at:
http://www.iss.net/security_center/maillists

This summary is available at the following address:
http://www.iss.net/security_center/alerts/AS02-38.php

_____
Contents:
* 41 Reported Vulnerabilities
* Risk Factor Key
_____

Date Reported: 09/11/2002
Brief Description: Sun Solaris aspppls tool temporary file symlink
                    attack
Risk Factor: Medium
Attack Type: Host Based
Platforms: Solaris 8, Solaris 8 x86
Vulnerability: solaris-aspppls-tmpfile-symlink
X-Force URL: http://www.iss.net/security_center/static/10105.php

Date Reported: 09/12/2002
Brief Description: InterScan VirusWall HTTP 1.1 chunked transfer
                    encoding protection bypass
Risk Factor: Medium
Attack Type: Network Based
Platforms: Linux Any version, Windows Any version, InterScan
                    VirusWall 3.6 for Linux, InterScan VirusWall 3.52
                    for Windows
Vulnerability: interscan-chunked-transfer-bypass
X-Force URL: http://www.iss.net/security_center/static/10106.php

Date Reported: 09/12/2002
Brief Description: InterScan VirusWall HTTP 1.0 gzip content encoding
                    protection bypass
Risk Factor: Medium
Attack Type: Network Based
Platforms: Windows Any version, InterScan VirusWall 3.52 for
                    Windows
Vulnerability: interscan-gzip-content-bypass
X-Force URL: http://www.iss.net/security_center/static/10107.php

Date Reported: 09/13/2002
Brief Description: Microsoft NetMeeting RDS local session hijacking
Risk Factor: Medium
Attack Type: Host Based
Platforms: Windows NT 4.0, Windows 2000 Any version, Windows
                    XP Professional, Microsoft NetMeeting 3.01 to
                    4.4.3396
Vulnerability: netmeeting-rds-session-hijacking
X-Force URL: http://www.iss.net/security_center/static/10119.php

Date Reported: 09/14/2002
Brief Description: PlanetWeb long URL buffer overflow
Risk Factor: High
Attack Type: Network Based
Platforms: Windows Any version, PlanetWeb 1.14 and earlier
Vulnerability: planetweb-long-url-bo
X-Force URL: http://www.iss.net/security_center/static/10124.php

Date Reported: 09/14/2002
Brief Description: atftp multiple strcpy() function buffer overflows
Risk Factor: High
Attack Type: Host Based
Platforms: Linux Any version, atftp 0.5, atftp 0.6
Vulnerability: atftp-strcpy-bo
X-Force URL: http://www.iss.net/security_center/static/10142.php

Date Reported: 09/15/2002
Brief Description: Opera and Konqueror malformed image denial of
                    service
Risk Factor: Low
Attack Type: Network Based
Platforms: Linux Any version, Windows Any version, Opera 6.01
                    b175 for Linux, K Desktop Environment (KDE) prior
                    to 3.01
Vulnerability: opera-konqueror-image-dos
X-Force URL: http://www.iss.net/security_center/static/10126.php

Date Reported: 09/16/2002
Brief Description: MIT Kerberos 5 KDC null pointer dereference denial
                    of service
Risk Factor: Low
Attack Type: Network Based
Platforms: Unix Any version, MIT Kerberos 5 prior to krb5-
                    1.2.5
Vulnerability: kerberos-kdc-null-pointer-dos
X-Force URL: http://www.iss.net/security_center/static/10099.php

Date Reported: 09/16/2002
Brief Description: Sygate Personal Firewall IP spoofing could be used
                    to bypass the firewall
Risk Factor: High
Attack Type: Network Based
Platforms: Windows Any version, Sygate Personal Firewall 5.0
Vulnerability: sygate-firewall-ip-spoofing
X-Force URL: http://www.iss.net/security_center/static/10108.php

Date Reported: 09/16/2002
Brief Description: FreeBSD libkvm could leak sensitive file
                    descriptors and disclose kernel memory
Risk Factor: Medium
Attack Type: Host Based
Platforms: FreeBSD 4.6.2-REL and prior
Vulnerability: bsd-libkvm-descriptor-leak
X-Force URL: http://www.iss.net/security_center/static/10109.php

Date Reported: 09/16/2002
Brief Description: CrazyWWWBoard HTTP_USER_AGENT CGI environment
                    variable buffer overflow
Risk Factor: High
Attack Type: Network Based
Platforms: Linux Any version, Windows Any version, Unix Any
                    version, CrazyWWWBoard 2000p4, CrazyWWWBoard
                    2000LEp5
Vulnerability: crazywwwboard-httpuseragent-bo
X-Force URL: http://www.iss.net/security_center/static/10110.php

Date Reported: 09/16/2002
Brief Description: Windows XP Remote Desktop malformed PDU Confirm
                    Active packet denial of service
Risk Factor: Low
Attack Type: Network Based
Platforms: Windows .NET Standard Server Beta 3, Windows XP Any
                    version
Vulnerability: winxp-remote-desktop-dos
X-Force URL: http://www.iss.net/security_center/static/10120.php

Date Reported: 09/16/2002
Brief Description: Windows Remote Desktop Protocol checksum
                    information leak
Risk Factor: Low
Attack Type: Network Based
Platforms: Windows 2000 Any version, Windows XP Any version
Vulnerability: win-rdp-checksum-leak
X-Force URL: http://www.iss.net/security_center/static/10121.php

Date Reported: 09/16/2002
Brief Description: Windows Remote Desktop Protocol could allow an
                    attacker to monitor keystrokes
Risk Factor: Low
Attack Type: Network Based
Platforms: Windows 2000 Any version, Windows .NET Standard
                    Server Beta 3, Windows XP Any version
Vulnerability: win-rdp-keystroke-monitoring
X-Force URL: http://www.iss.net/security_center/static/10122.php

Date Reported: 09/17/2002
Brief Description: NetBSD FD_SET() buffer overflow
Risk Factor: High
Attack Type: Host Based
Platforms: NetBSD 1.5.3, NetBSD 1.5.1, NetBSD 1.5.2, NetBSD
                    1.4.x, NetBSD 1.6 beta, NetBSD-current pre20020810
Vulnerability: netbsd-fdset-bo
X-Force URL: http://www.iss.net/security_center/static/10114.php

Date Reported: 09/17/2002
Brief Description: NetBSD TIOCSCTTY ioctl structure counter buffer
                    overflow
Risk Factor: Medium
Attack Type: Host Based
Platforms: NetBSD 1.5, NetBSD 1.5.1, NetBSD 1.5.2, NetBSD
                    1.4.x, NetBSD 1.6 beta, NetBSD 1.5.3, NetBSD-
                    current pre20020721
Vulnerability: netbsd-tiocsctty-ioctl-bo
X-Force URL: http://www.iss.net/security_center/static/10115.php

Date Reported: 09/17/2002
Brief Description: Heimdal Kerberos 5 implementation kf/kfd buffer
                    overflow
Risk Factor: High
Attack Type: Network Based
Platforms: NetBSD 1.5, NetBSD 1.5.1, NetBSD 1.5.2, NetBSD
                    1.4.x, NetBSD 1.5.3, Heimdal prior to 0.5, NetBSD-
                    current pre20020910, NetBSD 1.6
Vulnerability: heimdal-kf-kfd-bo
X-Force URL: http://www.iss.net/security_center/static/10116.php

Date Reported: 09/17/2002
Brief Description: Trillian ident daemon buffer overflow
Risk Factor: Low
Attack Type: Network Based
Platforms: Windows Any version, Trillian 0.73, Trillian 0.74,
                    Trillian Pro 1.0
Vulnerability: trillian-identd-bo
X-Force URL: http://www.iss.net/security_center/static/10118.php

Date Reported: 09/17/2002
Brief Description: DB4Web db4web_c directory traversal
Risk Factor: Medium
Attack Type: Network Based
Platforms: HP-UX Any version, DB4Web 3.6, Windows 2000 Any
                    version, DB4Web 3.4, Linux Any version, Solaris Any
                    version, Unix Any version, Windows NT Any version
Vulnerability: db4web-db4webc-directory-traversal
X-Force URL: http://www.iss.net/security_center/static/10123.php

Date Reported: 09/17/2002
Brief Description: Joe text editor suid backup files
Risk Factor: Medium
Attack Type: Host Based
Platforms: Linux Any version, Unix Any version, joe Any
                    version
Vulnerability: joe-backup-suid-files
X-Force URL: http://www.iss.net/security_center/static/10125.php

Date Reported: 09/17/2002
Brief Description: Unreal Tournament Server console denial of service
Risk Factor: Low
Attack Type: Network Based
Platforms: Linux Any version, Windows Any version, Unreal
                    Tournament Server 2003 demo
Vulnerability: ut-console-dos
X-Force URL: http://www.iss.net/security_center/static/10128.php

Date Reported: 09/17/2002
Brief Description: DB4Web can be used to make TCP connections to other
                    systems
Risk Factor: Low
Attack Type: Network Based
Platforms: HP-UX Any version, Linux Any version, Solaris Any
                    version, Windows NT Any version, Windows 2000 Any
                    version, DB4Web 3.4, DB4Web 3.6
Vulnerability: db4web-tcp-portscan
X-Force URL: http://www.iss.net/security_center/static/10136.php

Date Reported: 09/18/2002
Brief Description: Cisco VPN 5000 Client software "Default Connection"
                    plaintext password
Risk Factor: Medium
Attack Type: Host Based / Network Based
Platforms: Macintosh Any version, Cisco VPN 5000 Client prior
                    to 5.2.2
Vulnerability: cisco-vpn5000-defaultconnection-password
X-Force URL: http://www.iss.net/security_center/static/10129.php

Date Reported: 09/18/2002
Brief Description: ISS Internet Scanner HTTP response buffer overflow
Risk Factor: High
Attack Type: Network Based
Platforms: Windows NT Any version, Windows 2000 Any version,
                    Internet Scanner 6.2.1
Vulnerability: is-http-response-bo
X-Force URL: http://www.iss.net/security_center/static/10130.php

Date Reported: 09/18/2002
Brief Description: Cisco VPN 5000 Client software close_tunnel and
                    open_tunnel binary buffer overflow
Risk Factor: High
Attack Type: Host Based
Platforms: Linux Any version, Solaris Any version, Cisco VPN
                    5000 Client prior to 5.2.7, Cisco VPN 5000 Client
                    prior to 5.2.8
Vulnerability: cisco-vpn5000-binary-bo
X-Force URL: http://www.iss.net/security_center/static/10131.php

Date Reported: 09/18/2002
Brief Description: Windows fails to properly check execute permissions
                    for 16-bit executable files
Risk Factor: Medium
Attack Type: Host Based
Platforms: Windows NT Any version, Windows 2000 Any version,
                    Windows XP Any version
Vulnerability: win-execute-permissions-16bit
X-Force URL: http://www.iss.net/security_center/static/10132.php

Date Reported: 09/18/2002
Brief Description: Microsoft Virtual Machine (VM) JDBC classes can
                    execute local DLLs
Risk Factor: High
Attack Type: Network Based
Platforms: Windows 95, Windows NT 4.0, Windows 98, Windows 98
                    Second Edition, Windows ME, Windows 2000 Advanced
                    Server, Windows XP Any version, Microsoft Virtual
                    Machine 5.0.3805 and earlier
Vulnerability: msvm-jdbc-dll-execution
X-Force URL: http://www.iss.net/security_center/static/10133.php

Date Reported: 09/18/2002
Brief Description: Microsoft Virtual Machine (VM) JDBC handle
                    validation could crash Internet Explorer
Risk Factor: Low
Attack Type: Network Based
Platforms: Windows 95, Windows NT 4.0, Windows 98, Windows 98
                    Second Edition, Windows 2000 Any version, Windows
                    ME, Windows XP Any version, Microsoft Virtual
                    Machine 5.0.3805 and earlier
Vulnerability: msvm-jdbc-ie-dos
X-Force URL: http://www.iss.net/security_center/static/10134.php

Date Reported: 09/18/2002
Brief Description: Microsoft Virtual Machine (VM) XML methods can be
                    accessed
Risk Factor: High
Attack Type: Network Based
Platforms: Windows 95, Microsoft Virtual Machine 5.0.3805 and
                    earlier, Windows ME, Windows XP Any version,
                    Windows NT 4.0, Windows 98, Windows 98 Second
                    Edition, Windows 2000 Any version
Vulnerability: msvm-xml-methods-access
X-Force URL: http://www.iss.net/security_center/static/10135.php

Date Reported: 09/18/2002
Brief Description: XFree86 X11 library (libX11.so) LD_PRELOAD setuid
                    program execution
Risk Factor: Medium
Attack Type: Host Based
Platforms: Linux Any version, Unix Any version, SuSE Linux
                    8.0, XFree86 4.2.0 and earlier
Vulnerability: xfree86-x11-program-execution
X-Force URL: http://www.iss.net/security_center/static/10137.php

Date Reported: 09/18/2002
Brief Description: SGI IRIX root creates core dumps with insecure
                    permissions
Risk Factor: Medium
Attack Type: Host Based
Platforms: IRIX 6.5.x
Vulnerability: irix-root-coredumps
X-Force URL: http://www.iss.net/security_center/static/10138.php

Date Reported: 09/18/2002
Brief Description: Check Point FireWall-1 HTTP proxy could allow HTTPS
                    and FTP traffic to bypass the firewall
Risk Factor: Low
Attack Type: Network Based
Platforms: Check Point FireWall-1 4.1, Check Point FireWall-1
                    NG
Vulnerability: fw1-http-proxy-bypass
X-Force URL: http://www.iss.net/security_center/static/10139.php

Date Reported: 09/18/2002
Brief Description: OSF/1 (Tru64) UUCP -s command line buffer overflow
Risk Factor: High
Attack Type: Host Based
Platforms: OSF/1 3.x
Vulnerability: osf1-uucp-source-bo
X-Force URL: http://www.iss.net/security_center/static/10146.php

Date Reported: 09/18/2002
Brief Description: OSF/1 (Tru64) inc MH environment variable buffer
                    overflow
Risk Factor: High
Attack Type: Host Based
Platforms: OSF/1 3.x
Vulnerability: osf1-inc-mh-bo
X-Force URL: http://www.iss.net/security_center/static/10147.php

Date Reported: 09/18/2002
Brief Description: OSF/1 (Tru64) dxterm -xrm command line buffer
                    overflow
Risk Factor: High
Attack Type: Host Based
Platforms: OSF/1 3.x
Vulnerability: osf1-dxterm-xrm-bo
X-Force URL: http://www.iss.net/security_center/static/10148.php

Date Reported: 09/19/2002
Brief Description: IBM WebSphere HTTP Host: header buffer overflow
Risk Factor: Low
Attack Type: Network Based
Platforms: AIX All versions, HP-UX Any version, Linux Any
                    version, IBM WebSphere 4.0.3, Solaris Any version,
                    Windows 2000 Server
Vulnerability: websphere-host-header-bo
X-Force URL: http://www.iss.net/security_center/static/10140.php

Date Reported: 09/19/2002
Brief Description: Trillian IRC PRIVMSG buffer overflow
Risk Factor: High
Attack Type: Network Based
Platforms: Windows Any version, Trillian 0.73, Trillian 0.74
Vulnerability: trillian-irc-privmsg-bo
X-Force URL: http://www.iss.net/security_center/static/10143.php

Date Reported: 09/19/2002
Brief Description: SquirrelMail multiple PHP script cross-site
                    scripting
Risk Factor: Medium
Attack Type: Network Based
Platforms: Linux Any version, Windows Any version, Unix Any
                    version, SquirrelMail 1.2.7
Vulnerability: squirrelmail-php-xss
X-Force URL: http://www.iss.net/security_center/static/10145.php

Date Reported: 09/20/2002
Brief Description: Trillian IRC JOIN buffer overflow
Risk Factor: High
Attack Type: Network Based
Platforms: Windows Any version, Trillian 0.73, Trillian 0.74
Vulnerability: trillian-irc-join-bo
X-Force URL: http://www.iss.net/security_center/static/10150.php

Date Reported: 09/21/2002
Brief Description: Trillian raw 221 user mode buffer overflow
Risk Factor: High
Attack Type: Network Based
Platforms: Windows Any version, Trillian 0.73, Trillian 0.74
Vulnerability: trillian-raw221-bo
X-Force URL: http://www.iss.net/security_center/static/10151.php

Date Reported: 09/23/2002
Brief Description: JAWmail malicious email message cross-site
                    scripting
Risk Factor: Medium
Attack Type: Network Based
Platforms: Linux Any version, Unix Any version, JAWmail 1.0-
                    rc1
Vulnerability: jawmail-mail-message-xss
X-Force URL: http://www.iss.net/security_center/static/10152.php

_____

Risk Factor Key:

     High Any vulnerability that provides an attacker with immediate
              access into a machine, gains superuser access, or bypasses
              a firewall. Example: A vulnerable Sendmail 8.6.5 version
              that allows an intruder to execute commands on mail server.
     Medium Any vulnerability that provides information that has a high
              potential of giving system access to an intruder. Example:
              A misconfigured TFTP or vulnerable NIS server that allows
              an intruder to get the password file that could contain an
              account with a guessable password.
     Low Any vulnerability that provides information that could
              potentially lead to a compromise. Example: A finger that
              allows an intruder to find out who is online and potential
              accounts to attempt to crack passwords via brute force
              methods.

______

About Internet Security Systems (ISS)
Founded in 1994, Internet Security Systems (ISS) (Nasdaq: ISSX) is a
pioneer and world leader in software and services that protect critical
online resources from an ever-changing spectrum of threats and misuse.
Internet Security Systems is headquartered in Atlanta, GA, with
additional operations throughout the Americas, Asia, Australia, Europe
and the Middle East.

Copyright (c) 2002 Internet Security Systems, Inc. All rights reserved
worldwide.

Permission is hereby granted for the electronic redistribution of this
document. It is not to be edited or altered in any way without the
express written consent of the Internet Security Systems X-Force. If you
wish to reprint the whole or any part of this document in any other
medium excluding electronic media, please email xforce@iss.net for
permission.

Disclaimer: The information within this paper may change without notice. Internet
Security Systems provides this information on an AS IS basis with NO warranties,
implied or otherwise. Any use of this information is at the user’s risk. In no event
shall Internet Security Systems be held liable for any damages whatsoever arising
out of or in connection with the use or dissemination of this information.

X-Force PGP Key available on MIT's PGP key server and PGP.com's key server,
as well as at http://www.iss.net/security_center/sensitive.php

Please send suggestions, updates, and comments to: X-Force

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBPY9auDRfJiV99eG9AQEBCgQAjDhOmRBXBXxn8GWt0VRQeJLkx22op+9X
pUbG2MT8lGdkm+P62pTxYEPs2YouhgeErmBuWWWT96TTpRZOyacfm2PRbuTV/q1T
oqz70MZWnHaIXzMciZOMSnF2otZk+DkKSpMwPDprqvYeMZCS1CgJr7AoPBozhpEA
vPKpWICjaLQ=
=AxhS
-----END PGP SIGNATURE-----