SecurityFocus Microsoft Newsletter #252
----------------------------------------

New Partnership Announcement: SecurityFocus and ITinfosecure
 
SecurityFocus and ITinfosecure have teamed up to provide its customers with the most comprehensive vendor-neutral IT security resource on the web! Users will now be able to visit SecurityFocus.com to access information on the latest IT security products through their partnership with ITinfosecure.com with their Product Search feature. Combining this tool with SecurityFocus.s comprehensive information of the latest IT security news and vulnerability information ensures SecurityFocus remains the most comprehensive and trusted source of security information on the Internet.  
 
Visit SecurityFocus today at http://www.securityfocus.com

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Jose Nazario discusses worms
       2. Packet forensics using TCP
II.  MICROSOFT VULNERABILITY SUMMARY
       1. Wine WineLauncher.IN Local Insecure File Creation Vulnerability
       2. Microsoft Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability
       3. Microsoft Internet Explorer Web Folder Behaviors Cross-Domain Scripting Vulnerability
       4. Microsoft Windows Plug and Play Buffer Overflow Vulnerability
       5. Microsoft Windows Print Spooler Buffer Overflow Vulnerability
       6. Microsoft Internet Explorer Unspecified SharePoint Portal Services Log Sink ActiveX Vulnerability
       7. Microsoft Windows Telephony Service Buffer Overflow Vulnerability
       8. Microsoft Windows Kerberos Denial Of Service Vulnerability
       9. Microsoft Windows Kerberos PKINIT Man In The Middle Vulnerability
       10. AWStats Referrer Arbitrary Command Execution Vulnerability
       11. MidiCart ASP Item_Show.ASP Code_No Parameter SQL Injection Vulnerability
       12. Gallery PostNuke Integration Access Validation Vulnerability
       13. Novell eDirectory Server iMonitor Buffer Overflow Vulnerability
       14. McAfee ePolicy Orchestrator Local Information Disclosure Vulnerability
       15. Veritas Backup Exec For Windows And NetWare Arbitrary File Download Vulnerability
       16. PHPBB BBCode IMG Tag Script Injection Vulnerability
       17. FUDForum Tree View Access Validation Vulnerability
III. MICROSOFT FOCUS LIST SUMMARY
       1. SecurityFocus Microsoft Newsletter #251
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Jose Nazario discusses worms
By Federico Biancuzzi
Federico Biancuzzi interviews Jose Nazario to discuss modern computer worms and the design goals behind them.
http://www.securityfocus.com/columnists/347

2. Packet forensics using TCP
By Don Parker and Mike Sues
This article looks at TCP packet forensics and examines why sequence and acknowledgement numbers can be useful during an investigation.
http://www.securityfocus.com/infocus/1845

II.  MICROSOFT VULNERABILITY SUMMARY
------------------------------------
1. Wine WineLauncher.IN Local Insecure File Creation Vulnerability
BugTraq ID: 14496
Remote: No
Date Published: 2005-08-08
Relevant URL: http://www.securityfocus.com/bid/14496
Summary:
A local insecure file creation vulnerability affects Wine. This issue is likely due to a design error that causes the application to fail to verify the existence of a file before writing to it.

The details available regarding this issue are not sufficient to provide an in depth technical description. This BID will be updated when more information becomes available.

An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application.

This issue is reported in version 20050725; other version may also be affected.

2. Microsoft Internet Explorer COM Object Instantiation Buffer Overflow Vulnerability
BugTraq ID: 14511
Remote: Yes
Date Published: 2005-08-09
Relevant URL: http://www.securityfocus.com/bid/14511
Summary:
Microsoft Internet Explorer is prone to a buffer overflow vulnerability. 

This issue is exposed when certain COM objects are instantiated as ActiveX controls.  A malicious Web page could pass content to these objects that will trigger memory corruption.

Successful exploitation could let remote attackers execute arbitrary code in the context of the currently logged in user.

3. Microsoft Internet Explorer Web Folder Behaviors Cross-Domain Scripting Vulnerability
BugTraq ID: 14512
Remote: Yes
Date Published: 2005-08-09
Relevant URL: http://www.securityfocus.com/bid/14512
Summary:
Microsoft Internet Explorer is prone to a security vulnerability that may let a Web page execute malicious script code in the context of an arbitrary domain or browser security zone.  This issue is the result of a security flaw in the browser security model when handling URIs when a Web folder view is rendered.

If exploited to access a foreign domain, this could allow script code embedded in a malicious Web page to access the properties of another site that the victim of the attack may trust.  This would likely be exploited to steal credentials or sensitive information from the victim.  The issue could also be exploited to execute arbitrary code by running malicious script code in a browser security zone with lowered security settings, such as the Local Machine, Trusted Sites or Intranet zone.  Code execution would occur in the context of the currently logged in user.

4. Microsoft Windows Plug and Play Buffer Overflow Vulnerability
BugTraq ID: 14513
Remote: Yes
Date Published: 2005-08-09
Relevant URL: http://www.securityfocus.com/bid/14513
Summary:
Microsoft Windows Plug and Play is prone to a buffer overflow vulnerability.

This issue takes place when the PnP service handles malformed messages containing excessive data. 

This vulnerability facilitates local privilege escalation and unauthorized remote access depending on the underlying operating system.  A successful attack may result in arbitrary code execution resulting in an attacker gaining SYSTEM privileges.

5. Microsoft Windows Print Spooler Buffer Overflow Vulnerability
BugTraq ID: 14514
Remote: Yes
Date Published: 2005-08-09
Relevant URL: http://www.securityfocus.com/bid/14514
Summary:
Microsoft Windows Print Spooler service is prone to a buffer overflow vulnerability.

Specifically, this issue takes place when the Print Spooler service handles malformed messages containing excessive data.

This vulnerability facilitates local privilege escalation and unauthorized remote access depending on the underlying operating system.   A successful attack may result in arbitrary code execution, which can allow an attacker to gain SYSTEM privileges.

6. Microsoft Internet Explorer Unspecified SharePoint Portal Services Log Sink ActiveX Vulnerability
BugTraq ID: 14515
Remote: Yes
Date Published: 2005-08-09
Relevant URL: http://www.securityfocus.com/bid/14515
Summary:
Microsoft Internet Explorer is prone to an unspecified vulnerability in the SharePoint Portal Service Log Sink ActiveX control.

The vendor has not released any further information about this vulnerability other than to state the "kill bit" has been set on unsupported versions of the control.

This issue may be related to BID 12646.

7. Microsoft Windows Telephony Service Buffer Overflow Vulnerability
BugTraq ID: 14518
Remote: Yes
Date Published: 2005-08-09
Relevant URL: http://www.securityfocus.com/bid/14518
Summary:
Microsoft Windows Telephony Service is prone to a buffer overflow vulnerability.  This issue is due to a failure in the application to perform proper bounds checking on user-supplied data.

A successful attack can result in overflowing a finite sized buffer and ultimately leading to arbitrary code execution in the context of the affected service.  This may allow the attacker to execute arbitrary code remotely or locally to gain elevated privileges.

Remote code execution is only possible on Windows 2000 Server and Windows Server 2003; other vulnerable platforms the attacker must have local interactive access.

8. Microsoft Windows Kerberos Denial Of Service Vulnerability
BugTraq ID: 14519
Remote: Yes
Date Published: 2005-08-09
Relevant URL: http://www.securityfocus.com/bid/14519
Summary:
Microsoft Windows is susceptible to a remote Kerberos denial of service vulnerability. By sending unspecified packets to the Kerberos service on TCP or UDP port 88, attackers may cause the affected service to crash.

This vulnerability allows remote attackers to crash the affected authentication service, denying further domain authentication to legitimate users. It should be noted that exploitation requires that attackers have valid logon credentials.

9. Microsoft Windows Kerberos PKINIT Man In The Middle Vulnerability
BugTraq ID: 14520
Remote: Yes
Date Published: 2005-08-09
Relevant URL: http://www.securityfocus.com/bid/14520
Summary:
The PKINIT implementation in Microsoft Windows is susceptible to a man in the middle vulnerability. This issue is due to a failure of the software to properly validate network data. This issue is only exploitable by attackers that have access to valid logon credentials.

Attackers exploit this issue to spoof the domain controller/KDC during the initial authentication process. By spoofing the domain controller/KDC, attackers may gain access to the cleartext contents of encrypted network traffic in arbitrary Kerberos-enabled services. Other attacks may also be possible.

Microsoft implements draft 9 of the IETF PKINIT specification, and states that the vulnerability is in the protocol specification itself. Other implementations of PKINIT may therefore also be vulnerable to this issue.

10. AWStats Referrer Arbitrary Command Execution Vulnerability
BugTraq ID: 14525
Remote: Yes
Date Published: 2005-08-09
Relevant URL: http://www.securityfocus.com/bid/14525
Summary:
AWStats is affected by an arbitrary command execution vulnerability.  This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of this vulnerability will permit an attacker to execute arbitrary Perl code on the system hosting the affected application in the security context of the Web server process.  This may aid in further attacks against the underlying system; other attacks are also possible.

It should be noted this vulnerability is only possible if the affected application has at least one URLPlugin enabled.

11. MidiCart ASP Item_Show.ASP Code_No Parameter SQL Injection Vulnerability
BugTraq ID: 14544
Remote: Yes
Date Published: 2005-08-11
Relevant URL: http://www.securityfocus.com/bid/14544
Summary:
MidiCart ASP is prone to an SQL injection vulnerability.  This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

12. Gallery PostNuke Integration Access Validation Vulnerability
BugTraq ID: 14547
Remote: Yes
Date Published: 2005-08-11
Relevant URL: http://www.securityfocus.com/bid/14547
Summary:
Gallery is prone to an access validation issue when integrated with PostNuke.  This issue could allow any user with any level of admin privileges in PostNuke to also have admin privileges over the entire Gallery.

This issue has been addressed in Gallery 1.5.1-RC2.

13. Novell eDirectory Server iMonitor Buffer Overflow Vulnerability
BugTraq ID: 14548
Remote: Yes
Date Published: 2005-08-11
Relevant URL: http://www.securityfocus.com/bid/14548
Summary:
The Novell eDirectory Server iMonitor is prone to a buffer overflow.  Successful exploitation could allow arbitrary code execution with Local System privileges.

eDirectory 8.7.3 iMonitor is vulnerable to this issue.  Earlier versions may also be affected.

14. McAfee ePolicy Orchestrator Local Information Disclosure Vulnerability
BugTraq ID: 14549
Remote: No
Date Published: 2005-08-11
Relevant URL: http://www.securityfocus.com/bid/14549
Summary:
Network Associates McAfee ePolicy Orchestrator is susceptible to a local information disclosure vulnerability. This issue is due to incorrectly configured directory permissions in the default installation process of the application.

This vulnerability allows local attackers to access arbitrary files located in the same partition as the affected directory with SYSTEM privileges. This will aid them in further attacks.

15. Veritas Backup Exec For Windows And NetWare Arbitrary File Download Vulnerability
BugTraq ID: 14551
Remote: Yes
Date Published: 2005-08-12
Relevant URL: http://www.securityfocus.com/bid/14551
Summary:
Veritas Backup Exec for Windows Servers, Veritas Backup Exec for NetWare Servers, NetBackup for NetWare Media Server Option, and Remote Agents for Windows, Unix/Linux, and NetWare servers are prone to a vulnerability regarding the unauthorized downloading of arbitrary files. 

A remote attacker can exploit this vulnerability to download arbitrary files, aiding them in further attack.

A Metasploit Framework exploit is available and there are reports of this vulnerability currently being exploited in the wild.

16. PHPBB BBCode IMG Tag Script Injection Vulnerability
BugTraq ID: 14555
Remote: Yes
Date Published: 2005-08-12
Relevant URL: http://www.securityfocus.com/bid/14555
Summary:
phpBB is prone to a script injection vulnerability.  This issue is due to a failure of the application to properly sanitize user-supplied input in bbcode '[IMG]' tags included in a user signature.

Successful exploitation of this vulnerability could permit the injection of arbitrary HTML or script code into the browser of an unsuspecting user in the context of the affected site.

This issue is reported to affect phpBB version 2.0.17; earlier versions may also be vulnerable.

17. FUDForum Tree View Access Validation Vulnerability
BugTraq ID: 14556
Remote: Yes
Date Published: 2005-08-12
Relevant URL: http://www.securityfocus.com/bid/14556
Summary:
FUDforum is prone to an access validation vulnerability.  This issue is due to a failure in the application to perform proper access validation before granting access to private forums.

An attacker can exploit this vulnerability to obtain posts from private forums.  This may result in a loss of confidentiality.  Information obtained may also be used in further attacks.

This issue is reported to affect FUDforum version 2.6.15; earlier versions may also be vulnerable.

It should be noted this issue is only possible if the 'Tree View' feature is enabled.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. SecurityFocus Microsoft Newsletter #251
http://www.securityfocus.com/archive/88/407760

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
New Partnership Announcement: SecurityFocus and ITinfosecure
 
SecurityFocus and ITinfosecure have teamed up to provide its customers with the most comprehensive vendor-neutral IT security resource on the web! Users will now be able to visit SecurityFocus.com to access information on the latest IT security products through their partnership with ITinfosecure.com with their Product Search feature. Combining this tool with SecurityFocus.s comprehensive information of the latest IT security news and vulnerability information ensures SecurityFocus remains the most comprehensive and trusted source of security information on the Internet.  
 
Visit SecurityFocus today at http://www.securityfocus.com