-->> Il Symantec Security Check per controllare SQLExp
Migliaia di utenti hanno utilizzato il servizio Symantec Security Check di Symantec per verificare la propria vulnerabilità a SQLExp.
URL: http://news.hwupgrade.it/9194.html

CVS DOUBLE FREE VULNERABILITY
Double-free vulnerabiity in CVS allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request.
http://www.security-research.org/modules.php?op=modload&name=News&file=article&sid=141

TOP TEN WEB APPLICATION VULNERABILITIES
The Open Web Application Security Project has released a report outlining the top ten vulnerabilities in web applications. All of the classic flaws are covered, such as buffer overflows, cross-site-scripting, command injection, unvalidated parameters, various misconfigurations, and other issues. You also might want to check out OWASP's much acclaimed Guide to Building Secure Web Applications and Web Services
http://www.security-research.org/modules.php?op=modload&name=News&file=article&sid=137

SecureCRT
Vendor: Van Dyke Technologies
A vulnerability was reported in VanDyke's SecureCRT SSH2 client software. A local user may be able to obtain the target user's password from memory. Other vendor implementations are also affected.
Impact: Disclosure of authentication information
Alert: http://securitytracker.com/alerts/2003/Jan/1006010.html

Kerberos FTP Client
Vendor: MIT
An input validation vulnerability was reported in the MIT Kerberos FTP client and possibly other FTP clients. A remote user (malicious FTP server) can cause arbitrary shell commands to be executed on the client.
Impact: Execution of arbitrary code via network
Alert: http://securitytracker.com/alerts/2003/Jan/1006006.html

Java Runtime Environment (JRE)
Vendor: Sun
An unspecified vulnerability was reported in Sun's Java Runtime Environment (JRE). Malicious Java code could bypass security sandbox protections.
Impact: Disclosure of authentication information
Alert: http://securitytracker.com/alerts/2003/Jan/1006005.html

ProxyView
Vendor: Replicon
A configuration vulnerability was reported in Replicom's ProxyView. A remote user can access the device if a common default password has not been changed.
Impact: Root access via network
Alert: http://securitytracker.com/alerts/2003/Jan/1006003.html

Kerberos
Vendor: MIT
Several vulnerabilities were reported in some older releases of MIT Kerberos. A remote user can crash the Kerberos Key Distribution Center (KDC) server. A remote user may also be able to gain access to the server.
Impact: Denial of service via network
Alert: http://securitytracker.com/alerts/2003/Jan/1006002.html

Java Runtime Environment (JRE)
Vendor: Sun
A certificate validation vulnerability was reported in Sun's Java Secure Socket Extension (JSSE). The Java Plug-In and Java Web Start are also affected. The software may incorrectly authenticate web sites or JAR files that are not valid.
Impact: Host/resource access via network
Alert: http://securitytracker.com/alerts/2003/Jan/1006001.html

in.ftpd
Vendor: Sun
A denial of service vulnerability was reported in the Sun Solaris in.ftpd(1M) FTP server. A remote user can disrupt certain FTP services.
Impact: Denial of service via local system
Alert: http://securitytracker.com/alerts/2003/Jan/1005996.html

At
Vendor: Sun
A vulnerability was reported in the Sun Solaris at command. A local user can delete arbitrary files on the system.
Impact: Denial of service via local system
Alert: http://securitytracker.com/alerts/2003/Jan/1005994.html

"Kernel Traffic #203"
Tutte le ultime novità apparse sulla mailing list degli dei creatori... ehm, degli sviluppatori del kernel
http://www.ziobudda.net/news/see_comments.php?id_notizia=10296

JAVA ENTRA ED ESCE DAL SERVICE PACK
Microsoft si prepara ad obbedire alla sentenza preliminare sul caso Java e rilasciare, da qui all'estate, due aggiornamenti al Service Pack 1 per Windows XP che riflettano le disposizioni date dal giudice. Appello permettendo
URL: http://punto-informatico.it/pi.asp?i=42959

METHODS OF RECOVERY FOR DATA STORED IN RANDOM ACCESS MEMORY With the use of increasingly sophisticated encryption systems, an attacker wishing to gain access to sensitive data is forced to look elsewhere for information. One avenue of attack is the recovery of supposedly erased data from magnetic media or random-access memory. This paper covers some of the methods available to recover erased data and presents schemes to make this recovery significantly more difficult.
http://www.totse.com/en/technology/computer_technology/161780.html

ANTICIPATING THE UNKNOWN
It's been one of the dirty little secrets of the security industry for
years: Software patches don't work.
It's not that they don't fix the problems that they're designed to solve; they do. Despite technical problems with some patches, most notably regression errors and incompatibility issues in patches from Microsoft Corp.
and others, hot fixes hit their targets.
http://www.security-research.org/modules.php?op=modload&name=News&file=article&sid=138

Cybercrime-Hacking
Title: Internet attacks are slowing but gaining sophistication
Source: Government Computer News
Date Written: February 3, 2003
Date Collected: February 3, 2003
Security firm Symantec's latest 'Internet Security Threat Report' finds that while the number of reported software vulnerabilities continues to rise sharply, "overall attack activity on the Internet decreased during the last six months of 2002." The report, which is compiled from masses of data from customers' intrusion detection and antivirus software, shows an increase of 81% for 2002 in the number of reported software flaws, with vulnerabilities rated moderately to highly severe growing by nearly 85%. Most of the attacks listed in the report can be ascribed to blended threat worms, which target multiple vulnerabilities and may utilize several propagation methods.
http://www.gcn.com/vol1_no1/daily-updates/21031-1.html
Also - http://online.securityfocus.com/news/2231
Also - http://nationaljournal.com/pubs/techdaily/specials/am1.htm
Also - http://www.idg.net/ic_1113803_9677_1-5046.html
Also - http://www.eweek.com/article2/0,3959,857015,00.asp

Malware
Title: Slammer Was Fastest Spreading Worm Yet
Source: PC World
Date Written: February 3, 2003
Date Collected: February 3, 2003
A study into the Slammer worm found that it was "by far the fastest spreading worm yet seen," spreading "more than 250 times faster than Code Red." The study, conducted by cybersecurity experts from the Cooperative Association for Internet Data Analysis, the International Computer Science Institute, Silicon Defense, University of California at Berkeley's Electrical Engineering and Computer Sciences department, and the University of California at San Diego Computer Science and Engineering department, also revealed that most of the estimated 75,000 machines that were infected by Slammer were hit within ten minutes of the start of the attack. Slammer's rapid spread has been attributed to its small size and its technique of sending itself to randomly-generated IP addresses. Security experts believe Slammer could be a warning of worse things to come. New worms could also target critical infrastructures, propagate at a similar speed, but may have a devastating payload.
http://www.pcworld.com/news/article/0,aid,109163,00.asp
Also - http://www.eweek.com/article2/0,3959,854634,00.asp
Also - http://www.nwfusion.com/news/2003/0203slammer.html
Also - http://www.businessweek.com/technology/content/jan2003/tc20030131_4727.htm
Also - http://news.zdnet.co.uk/story/0,,t269-s2129785,00.html

Malware
Title: Microsoft warns of Slammer morphs
Source: ZDNet News
Date Written: January 31, 2003
Date Collected: February 3, 2003
In the wake of last week's Slammer outbreak Stuart Okin, Microsoft UK's chief security officer, warned on January 31, 2003 that users with unpatched versions of the company's SQL Server software could be vulnerable to "morphs" of the annoying worm. Microsoft's internal network was affected by Slammer because the company has "a loose desktop security policy." Users who have updated to SQL Server Service Pack 3 should be immune to Slammer or any of its morphs that target the same vulnerability.
http://news.zdnet.co.uk/story/0,,t281-s2129704,00.html

Vulnerabilities
Title: Trojan writers exploit Outlook Express to get around content filtering
Source: The Register
Date Written: January 31, 2003
Date Collected: February 3, 2003
E-mail security firm MessageLabs reports of an exploit for Outlook Express some trojan writers have begun using to deliver malicious code past e-mail content filters. The exploit relies on an e-mail header that gives a file attachment three file extensions. The first extension, .jpg for example, is visible to the recipient, and persuades her that it is safe. The third attachment, perhaps .jpg again, tells Outlook Express what icon the file should use. The middle extension, perhaps .exe or .com, determines how Outlook Express will run the file. Thus, if it is a .exe, it will run a program rather than show a picture as a user would expect from .jpg.
MessageLabs advises administrators to check content filtering tools to see if a rule filtering triple extensions can be added. Users should be careful about opening attachments, particularly if three dots appear in the file name.
http://212.100.234.54/content/56/29137.html
Also - http://www.messagelabs.com/viruseye/report.asp?id=130

Vulnerabilities
Title: Defense Dept. clears up Wi-Fi interference
Source: ZDNet News
Date Written: February 3, 2003
Date Collected: February 3, 2003
Tech companies and the Department of Defense have reached an agreement concerning spectrum use of wireless products. The Defense Department was concerned that widespread Wi-Fi would interfere with radar, since the two spectrum bands overlap somewhat. The resolution would also apply to the additional spectrum requested by Sens. Barbara Boxer (D-CA), and George Allen, (R-VA), under the proposed Jumpstart Broadband Act. The bill seeks to open broadband wireless to rural areas and small cities. Many companies hope wireless can provide an economic stimulus to the technology industry in the coming years.
http://zdnet.com.com/2100-1105-982962.html

AN OVERVIEW OF THE SUN MICROSYSTEM FIREWALL This article is the first of a two-part series that will offer a brief overview of the implementation and administration of SunScreen.
>> http://www.net-security.org/news.php?id=1887

SPAM FILTERING WITH GZIP
While many people see gzip as a compression tool, it also makes a credible spam filter. Here's how.
>> http://www.net-security.org/news.php?id=1891

LOCKING LINUX
Learn how to secure local file systems, restrict insecure root access, and how to configure user authentication.
>> http://www.net-security.org/news.php?id=1910

MICROSOFT PREPS FIREWALL UPGRADE
Microsoft is preparing a second version of its enterprise firewall Internet Security and Acceleration (ISA) Server, focusing on application-level security and XML web services.
>> http://www.net-security.org/news.php?id=1915

MALLOC() WEBMINER 1.01
Malloc() Webminer is a tool used to find common webserver exposures (currently about 400) and also has the ability to mine webservers for hidden files/directories using a new bruteforce method and can easily be expanded apon.
>> http://www.net-security.org/software.php?id=440

OPERA 7 TAPPA I BUCHI, ACQUISTA LA VOCE
In giornata Opera Software rilascera' una versione aggiornata del proprio browser che corregge alcune voragini di sicurezza. Ieri ha invece debuttato un add-on per Opera per il supporto delle applicazioni vocali
URL: http://punto-informatico.it/pi.asp?i=42980
Also - http://www.theregister.co.uk/content/55/29177.html

"Un white paper"
SPI Dynamics pubblica un white paper in cui spiega il rischio di iniezione di codice maligno via SQL tramite la porta 80 e 443.
http://www.ziobudda.net/news/see_comments.php?id_notizia=10321

"Virus su sistemi Unix/Linux quale diffusione?"
Il primo virus registrato per i sistemi Unix è stato il worm Ramen, la lista poi si è andata allungando con Adore, Lion, Cheese, RST.B e molti altri, infrangendo il mito di sistema virus-free.
http://www.ziobudda.net/news/see_comments.php?id_notizia=10360

Navigare in Rete con Linux
di Andrea Negro
Una volta installato il sistema operativo Linux e compresa la filosofia open source su cui si basa, Tux inizia un viaggio tra gli applicativi più importanti. Prima di tutto, il nostro amico pinguino, vuole collegarsi in Rete
http://www.apogeonline.com/webzine/2003/02/05/05/200302050501

LINUX CONFERENCES
It's the beginning of what looks like an exciting year for Linux conferences and events. I've been to a lot of them over the past five years or so, so here are some of the cool ones for 2003.
http://www.ca-osi.com/modules.php?name=News&file=article&sid=475

DALNET - CHAT NETWORK NIXES FILE SHARING One of the earliest hosts of online file trading has decided to abandon the controversial practice and return to its roots as a real-time chat network.
DALnet, one of the largest Internet relay chat networks and a forefather of Napster and Kazaa, announced it would ban channels whose primary purpose is to distribute files beginning March 1.
http://www.wired.com/news/infostructure/0%2C1377%2C57542%2C00.html

Vulnerabilities
Title: Smallpot: Tracking the Slapper and Scalper Unix Worms
Source: Security Focus
Date Written: February 4, 2003
Date Collected: February 5, 2003
As Unix-based systems like Linux and FreeBSD grow in popularity, the number of viruses targeting these systems is also growing. Though Win32 (Windows) viruses are well-documented and tracked, no reliable and constantly updated source of information exists for Linux/FreeBSD malware. Antivirus software for Win32 systems report attacks to antivirus companies,. Unlike Win32 viruses, Unix viruses do not usually spread through e-mail, and thus do not dominantly target a single point of entry. Data from Smallpot (Small Honeypot), a project originally designed to track the Code Red worm on Win32 systems, can give a picture of the spread of Unix-based viruses, particularly the Slapper and Scalper viruses. The author analyses the data to show that these Linux/FreeBSD viruses spread at a slower rate than Win32 viruses, but are growing in number.
http://online.securityfocus.com/infocus/1662

Vulnerabilities
Title: Opera fixes browser flaws
Source: The Register
Date Written: February 5, 2003
Date Collected: February 5, 2003
Opera has released version 7.1 of its web browser, fixing five security holes discovered by Israeli security firm GreyMagic. The browser is available from Opera's website. The security holes allowed an adversary to read the contents of a file system and access e-mail.
http://www.theregister.co.uk/content/55/29191.html

Vulnerabilities
Title: Microsoft pulls NT patch
Source: InfoWorld
Date Written: February 4, 2003
Date Collected: February 5, 2003
Microsoft has removed a security patch for Windows NT4, 2000, and XP from its website, after two months of reports that the patch caused random crashes on NT4. The patch was intended to fix a security hole that allowed an adversary administrative privileges by taking advantage of interprocess communication. Administrators faced a choice of a secure system that randomly crashes, or a vulnerable but reliable system. The problems created by the patch can be resolved by removing the patch. There have been no problems reported for 2000 or XP. Microsoft plans to release an updated patch.
http://www.infoworld.com/article/03/02/04/HNntpatchtwo_1.html?security

Vulnerabilities
Title: Networks suffer from wireless insecurity
Source: ZDNet News
Date Written: February 5, 2003
Date Collected: February 5, 2003
"Wardriving," the practice of searching for open wireless computer networks, is just one of several issues facing wireless acceptance. The 802.11b standard has proven to be difficult to make secure. According to numbers posted by the Worldwide Wireless Wardrive in November, more than 72 percent of the nearly 25,000 access points found by wardrivers around the planet didn't even have the flawed wireless security standard known as Wired Equivalent Privacy, or WEP, turned on. WEP itself has turned out to be relatively straightforward to decrypt using over-the-counter technology.
However, an industry-standards group known as the Wi-Fi Alliance seeks to make the open season on wireless networks a thing of the past. The Alliance has created an interim privacy solution, Temporal Key Integrity Protocol, to bolster the weak WEP standard. There is also a simpler version for home use called Pre-Shared Key.
http://zdnet.com.com/2100-1105-983438.html

MICROSOFT CURA IE E WINXP
Il colosso di Redmond ha rilasciato una megapatch per IE che corregge due nuove vulnerabilita' di sicurezza classificate con il massimo livello di gravita'. Corretta anche una meno grave falla di Windows XP
URL: http://punto-informatico.it/pi.asp?i=43009
Also - http://www.theregister.co.uk/content/55/29208.html
Also - http://news.com.com/2100-1001-983541.html?tag=fd_top
Also - http://www.vnunet.com/News/1138544
Also - http://www.infoworld.com/article/03/02/06/HNmswarning_1.html

SECURE YOUR DNS - REPLACE BIND
BIND has become the most popular DNS server on the Internet. It is also a favorite hacker target. For organisations that require a more secure DNS infrastructure, the djbdns package may be the answer http://techupdate.zdnet.co.uk/story/0,,t481-s2129897,00.html

The Great IDS Debate : SIGNATURE ANALYSIS versus PROTOCOL ANALYSIS
Intrusion detection systems (IDS) have rapidly become a crucial component of
any network defense strategy. Over the past few years, their popularity has
soared as vendors have refined their results and increased performance
capabilities. At the heart of intrusion detection systems lies the analysis
engine. It reviews each packet, determines if it is malicious, and logs an
alert if necessary - the core tasks of an IDS
http://online.securityfocus.com/infocus/1663

SESSION AUTHENTICATION VULNERABILITY IN COMPAQ INSIGHT MANAGER HTTP SERVER 5.1.0
An authentication vulnerability in Compaq Insight Manager HTTP Server 5.1.0
can permit a non-privileged user access to the system. If a legitimate user
logs on to the Web Agent Service through HTTPS on port 2301 and doesn't use
the Logout function, the session remains valid for 15 minutes, even after
the browser is closed. This timeframe can let a non-privileged user on the
same system log on with privileged access.
http://www.ntsecurity.net/Articles/Index.cfm?ArticleID=37863

Malware
Title: Lessons From the Slammer
Source: Security Focus
Date Written: February 5, 2003
Date Collected: February 6, 2003
The rapid spread of the Slammer worm illustrates several problems with
current Internet security. The author presents three main lessons that we
should learn from Slammer:
- Critical infrastructures should not be connected to the public Internet,
no matter the cost
- We don't try hard enough (or spend enough) to secure our computer
networks, in spite of continued attacks
- Centralized server authentication, such as Microsoft's Product Activation
Servers, create single points of failure
The author notes that as more corporations trend toward centralized serving,
activation and authentication, those servers become more of a 'critical
infrastructure,' which increases the instability and vulnerability of the
Internet.
http://online.securityfocus.com/columnists/140

MAJORDOMO FOUND TO LEAK INFORMATION
A security vulnerability Majordomo, a PERL script for managing mailing
lists, allows remote attackers and Spammers to query a mailing list for its
complete address list. Vulnerable systems:
* Majordomo version 1.94.5 and prior
* Majordomo version 2
All email addresses can be extracted from mailing lists for which
'which_access' is set to "open" in the
configuration file, which_access is set to "open" by default
http://neworder.box.sk/showme.php3?id=7632

BINARY CONVERSION
This article will show/teach you a purely mathematical way of how to convert
decimal to binary and back, using a really simple method that does not
require powers (which in the case of an algorithm takes too much time).
http://www.ca-osi.com/modules.php?name=News&file=article&sid=47

Malware
Title: Microsoft releases anti-Slammer tools
Source: ZDNet News
Date Written: February 6, 2003
Date Collected: February 7, 2003
Microsoft posted three new anti-slammer software tools on it's Web site
today. The tools give system administrators the ability to check their
company SQL Server 2000 databases for the Slammer and to address other
vulnerabilities. The Slammer worm, which struck Jan. 25, exploited a flaw
in SQL Server 2000 and caused an estimated $1 billion in damages. The three
tools are: SQL Scan Tool - which finds instances of SQL Server on a
computer network, SQL Check - which identifies if a SQL Server is vulnerable
to Slammer, and SQL Critical Update - which updates vulnerable version of
SQL Server.
http://zdnet.com.com/2100-1105-983603.html

Vulnerabilities
Title: Bugwatch: GSM security flaws exposed
Source: vnunet.com
Date Written: February 6, 2003
Date Collected: February 7, 2003
Steve Lord of X-Force Security Assessment Services for Internet Security
Systems argues that the GSM mobile phone standard is flawed in three
critical, yet unpublicized ways. First, the encryption methods used by GSM
(both COMP128 and A5) have been broken with relative ease, meaning that
communication from a GSM mobile phone should never be considered
confidential. Second, GSM location tracking capability means that users can
be tracked to within meters when the phone is on, creating a personal
security risk for the user. Third, SMS, or Short Message Service, originator
identification is easily spoofed, therefore, users should confirm the author
of important SMS communications.
http://www.vnunet.com/News/1138556

*******COMUNICAZIONE*******
Bismark.it & Gnomixland.com aprono una nuova concessionaria di servizi evoluti di dialer normali e dialer ActiveX.
In accordo con uno delle piu' importanti societa' italiane siamo in grado di offrirvi una quantità di dialer e pagamenti mai visti prima d'ora. http://www.dialerpoint.tk
*******/COMUNICAZIONE*******

g00d reading! 'n' bye
Security News MainTainer:
The Jackal a.k.a. jAcKallO < -jackal-@libero.it >
(AreaSessantuno Member) / (SpiPPolatori Collaborator)
(HackerAlliance Member) / (Daily DisInfo CreaTor & MainTainer)