SecurityFocus.com Newsletter #149 2002-6-10->2002-6-14

To: bugtraq-jp@securityfocus.com
Subject: SecurityFocus.com Newsletter #149 2002-6-10->2002-6-14
From: SAKAI Yoriyuki <sakai@lac.co.jp>
Date: Tue, 25 Jun 2002 17:51:36 +0900
Delivered-To: mailing list bugtraq-jp@securityfocus.com
Delivered-To: moderator for bugtraq-jp@securityfocus.com
In-Reply-To: <Pine.LNX.4.43.0206180935090.7107-100000@mail.securityfocus.com>
List-Help: <mailto:bugtraq-jp-help@securityfocus.com>
List-Id: <bugtraq-jp.list-id.securityfocus.com>
List-Post: <mailto:bugtraq-jp@securityfocus.com>
List-Subscribe: <mailto:bugtraq-jp-subscribe@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-jp-unsubscribe@securityfocus.com>
Mailing-List: contact bugtraq-jp-help@securityfocus.com; run by ezmlm
References: <Pine.LNX.4.43.0206180935090.7107-100000@mail.securityfocus.com>
$B:d0f(B@$B%i%C%/$G$9!#(B

SecurityFocus.com Newsletter $BBh(B 149 $B9f$NOBLu$r$*FO$1$7$^$9!#(B
$BLu$N$J$$9`L\$K$D$$$F$O!VF|K\8lLu$J$7!W$H$7$F6hJL$7$F$"$j$^$9!#(B

---------------------------------------------------------------------------
SecurityFocus.com Newsletter $B$K4X$9$k(BFAQ:
http://www.securityfocus.com/popups/forums/securityfocusnews/intro.shtml
BugTraq-JP $B$K4X$9$k(B FAQ:
http://www.securityfocus.com/popups/forums/bugtraq-jp/faq.shtml
(SecurityFocus.com Newsletter $B$NOBLu$O(B BugTraq-JP $B$G0le$G9T$o(B
  $B$l$F$$$^$9!#(B
$B!&(BSecurityFocus.com Newsletter $B$NOBLu$r(B Netnews, Mailinglist,
  World Wide Web, $B=q@R(B, $B$=$NB>$N5-O?G^BN$G0zMQ$5$l$k>l9g$K$O%a!<%k$N(B
  $BA4J80zMQ$r$*4j$$$7$^$9!#(B
$B!&F|K\8lHG%K%e!<%9%l%?!<(B 1 $B9f$+$i(B 3 $B9f$^$G$K$O$3$NHw9M$,IU$$$F$$$^$;(B
  $B$s$,=`MQ$9$k$b$N$H$7$^$9!#(B
$B!&$^$?!"(BSecurityFocus.com $BDs6!$N(B BugTraq-JP $B%"!<%+%$%V(B [*1] $B$X$N$$$+(B
  $B$J$k7A<0$N%O%$%Q!<%j%s%/$b>e5-$K=`$8$F$/$@$5$$!#(B
1) http://online.securityfocus.com/archive/79
---------------------------------------------------------------------------
---------------------------------------------------------------------------
$B$3$NOBLu$K4X$9$kHw9M(B:
$B!&$3$NOBLu$NE,MQ@.2L$K$D$$$F3t<02ql9g!"(BBugTraq-JP $B$X(B Errata $B$H$7$F=$@5(B
  $BHG$r$4Ej9FD:$/$+!"4F=$l9g$K$O=$@5HG$r$G$-$k$@$1?WB.$KH/9T$7$^$9!#(B
---------------------------------------------------------------------------
---------------------------------------------------------------------------
$B86HG(B:
Date: Tue, 18 Jun 2002 09:36:13 -0600 (MDT)
Message-ID: <Pine.LNX.4.43.0206180935090.7107-100000@mail.securityfocus.com>

SecurityFocus Newsletter #149
-----------------------------

I. FRONT AND CENTER($BF|K\8lLu$J$7(B)
II. BUGTRAQ SUMMARY
     1. X Window System Oversized Font Denial Of Service Vulnerability
     2. Geeklog pid CGI Variable SQL Injection Vulnerability
     3. Geeklog Multiple Cross Site Scripting Vulnerabilities
     4. MyHelpDesk HTML Injection Vulnerability
     5. MyHelpDesk Cross-Site Scripting Vulnerability
     6. MyHelpDesk SQL Injection Vulnerability
     7. ZenTrack Ticket.PHP Information Disclosure Vulnerability
     8. Geeklog Calendar Event Form Script Injection Vulnerability
     9. W-Agora Remote File Include Vulnerability
     10. Datalex Bookit! Consumer Plaintext Authentication Credentials...
     11. BizDesign ImageFolio Authorized User Web Root Disclosure...
     12. Seanox DevWex File Disclosure Vulnerability
     13. Seanox DevWex Buffer Overflow Vulnerability
     14. LPRNG Remote Print Submission Vulnerability
     15. Lokwa BB Multiple SQL Injection Vulnerabilities
     16. Belkin F5D5230-4 Router Internal Web Request Vulnerability
     17. AlienForm2 Directory Traversal Vulnerability
     18. RHMask Local File Overwrite Vulnerability
     19. Caldera OpenServer XSCO Color Database File Heap Overflow...
     20. LinkSys EtherFast Router Remote Administration Enabled...
     21. Pinboard Task List HTML Injection Vulnerability
     22. MMFTPD SysLog Format String Vulnerability
     23. BBGallery Image Tag HTML Injection Vulnerability
     24. CGIScript.net csNews Double URL Encoding Unauthorized...
     25. CGIScript.net csNews Header File Type Restriction Bypass...
     26. CGIScript.net CSNews Sensitive File Disclosure Vulnerability
     27. Apache Tomcat JSP Engine Denial of Service Vulnerability
     28. Macromedia JRun JSP Engine Denial Of Service Vulnerability
     29. SGI MediaMail Memory Corruption Vulnerability
     30. CGIForum Infinite Recursion Denial of Service Vulnerability
     31. WebCalendar Include Files Information Disclosure Vulnerability
     32. Pine Unix Username Account Information Leakage Vulnerability
     33. Multiple Bugzilla Security Vulnerabilities
III. SECURITYFOCUS NEWS ARTICLES
     1. Feds, Industry, Battle the Biggest Bug
     2. MS security hole extravaganza
     3. Hill Eyes Shifting Parts of FBI, CIA
     4. Pentagon on track to add biometrics to access card
IV.SECURITYFOCUS TOP 6 TOOLS
     1. wicap v0.4
     2. JSpamFilter v1.0
     3. Vipul's Razor v2.03
     4. Echelog v0.6
     5. Web shell v1.0
     6. PassGuard Framework v0.01a

I. FRONT AND CENTER($BF|K\8lLu$J$7(B)
---------------------------------

II. BUGTRAQ SUMMARY
-------------------
1. X Window System Oversized Font Denial Of Service Vulnerability
BugTraq ID: 4966
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 10 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4966
$B$^$H$a(B:

X Window System $B$K$O%V%i%&%6$r$O%/%i%C%7%e$5$;!"$^$?!"%7%9%F%`A4BN$rMxMQ(B
$B$G$-$J$$>uBV$K4Y$i$;$k$?$a$N967b$KMxMQ$5$l$k2DG=@-$,$"$kLdBj$,H/8+$5$l(B
$B$F$$$k!#(B

X Window System $B$OHs>o$KBg$-$J%U%)%s%H%5%$%:(B ($B%U%)%s%H%5%$%:(B: 1666666px)
$B$No$KBg$-$J%U%)%s%H%5%$%:$roF0:n$X$NI|5l$r9T$&$?$a$N:F5/F0$rI,MW$H$9$k!"M=B,ITG=$J5sF0$r(B
$B<($92DG=@-$,$"$k!#$^$?!"B>$NJs9p$G$O!"$3$NLdBj$K$h$k(B X $BA4BN$r%/%i%C%7%e(B
$B$5$;$F$7$^$&2DG=@-$,<($5$l$F$$$k!#$3$NLdBj$rMxMQ$9$k967b$N7k2L$O!"4D6-(B
$B$K0MB8$7!"MM!9$G$"$k$H?d;!$5$l$k!#(B

$B$3$NLdBj$O(B xfs (X Font Server) $B$*$h$S(B libXfont $B$NLdBj$G$"$k$HJs9p$5$l$F(B
$B$$$k!#(B

$B$3$NLdBj$rMxMQ$9$k%j%b!<%H$+$i$N967b$O!"%U%)%s%H%5%$%:$r(B X Window System
$B$X0z$-EO$9A0$K!"%U%)%s%H%5%$%:$,BEEv$G$"$k$+$r3NG'$7$F$$$J$$(B Web $B%/%i%$(B
$B%"%s%H!"$"$k$$$O!"B>$N%"%W%j%1!<%7%g%s$K$h$C$Fhttp://www.securityfocus.com/bid/4968
$B$^$H$a(B:

Geeklog $B$O%U%j!<$GMxMQ2DG=$G$"$j!"%*!<%W%s%=!<%9$H$7$F8x3+$5$l$F$$$k(B Web
$B%5!<%P$N%m%0<}=8MQ%=%U%H%&%'%"$G$"$k!#$3$N%=%U%H%&%'%"$O(B PHP $B8@8l$G3+H/(B
$B$5$l!"B?$/$N(B UNIX $B$dMM!9$J(B Linux $B$GF0:n$7!"$^$?!"(BMicrosoft Windows NT/2000
$B$K$*$$$F$bF0:n$9$k!#$3$N%=%U%H%&%'%"$O%P%C%/%(%s%I%G!<%?%Y!<%9$H$7$F!"(B
MySQL $B$rMxMQ$7$F$$$k!#(B
$B%P!<%8%g%s(B 1.3.5 $B0JA0$N(B Geeklog $B$O!"(BSQL $BJ8$r30It$+$iCmF~$r9T$&967b(B (SQL
injection attacks) $B$N1F6A$rl9g!"30It$+$iF~NO$5$l$?CM$K(B
$B4X$7$F==J,$JBEEv@-$N3NG'$r9T$C$F$$$J$$!#$3$N$?$a!"967bl9g!"967bpJs$NC%pJs$N3+<(!"%G!<%?%Y!<%9%5!<(B
$B%PFb$X$N?/F~$H$$$&7k2L$r>7$/2DG=@-$,$"$k!#(B

3. Geeklog Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 4969
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 10 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4969
$B$^$H$a(B:

Geeklog $B$O%U%j!<$GMxMQ2DG=$G$"$j!"%*!<%W%s%=!<%9$H$7$F8x3+$5$l$F$$$k(B Web
$B%5!<%P$N%m%0<}=8MQ%=%U%H%&%'%"$G$"$k!#$3$N%=%U%H%&%'%"$O(B PHP $B8@8l$G3+H/(B
$B$5$l!"B?$/$N(B UNIX $B$dMM!9$J(B Linux $B$GF0:n$7!"$^$?!"(BMicrosoft Windows NT/2000
$B$K$*$$$F$bF0:n$9$k!#$3$N%=%U%H%&%'%"$O%P%C%/%(%s%I%G!<%?%Y!<%9$H$7$F!"(B
MySQL $B$rMxMQ$7$F$$$k!#(B

Geeklog $B$O(B URL $BFb$N%Q%i%a!<%?$+$i%9%/%j%W%H$r%U%#%k%?%j%s%0$7$F$$$J$$$?(B
$B$a!"%/%m%9%5%$%H%9%/%j%W%F%#%s%0$NLdBj$rMxMQ$9$k967b$rZMQ>pJs$rC%http://www.securityfocus.com/bid/4967
$B$^$H$a(B:

MyHelpDesk $B$O(B PHP $B8@8l$G3+H/$5$l$?!"(BWeb $B$r2p$9$k%X%k%W%G%9%/%7%9%F%`$G(B
$B$"$k!#$3$N%=%U%H%&%'%"$O%U%j!<$G8x3+$5$l!"B?$/$N(B UNIX $B$d(B $BMM!9$J(B Linux$B!"(B
$B$^$?!"F1MM$K(B Microsoft Windows $B$K$*$$$F$bF0:n$9$k!#(B

MyHelpDesk (20020509 $BHG$*$h$S$=$l0JA0(B) $B$K$O967bh$CZMQ>pJs$NEp$_=P$7$r9T$&$?$a$N967b$KMxMQ$5$lF@$k$H(B
$B9M$($i$l$k!#(B

5. MyHelpDesk Cross-Site Scripting Vulnerability
BugTraq ID: 4970
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 10 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4970
$B$^$H$a(B:

MyHelpDesk $B$O(B PHP $B8@8l$G3+H/$5$l$?!"(BWeb $B$r2p$9$k%X%k%W%G%9%/%7%9%F%`$G(B
$B$"$k!#$3$N%=%U%H%&%'%"$O%U%j!<$G8x3+$5$l!"B?$/$N(B UNIX $B$d(B $BMM!9$J(B Linux$B!"(B
$B$^$?!"F1MM$K(B Microsoft Windows $B$K$*$$$F$bF0:n$9$k!#(B

MyHelpDesk (20020509 $BHG$*$h$S$=$l0JA0(B) $B$K$O967bZMQ>pJs$NEp$_=P$7$r9T$&(B
$B$?$a$N967b$KMxMQ$5$lF@$k$H9M$($i$l$k!#(B

6. MyHelpDesk SQL Injection Vulnerability
BugTraq ID: 4971
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 10 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4971
$B$^$H$a(B:

MyHelpDesk $B$O(B PHP $B8@8l$G3+H/$5$l$?!"(BWeb $B$r2p$9$k%X%k%W%G%9%/%7%9%F%`$G(B
$B$"$k!#$3$N%=%U%H%&%'%"$O%U%j!<$G8x3+$5$l!"B?$/$N(B UNIX $B$d(B $BMM!9$J(B Linux$B!"(B
$B$^$?!"F1MM$K(B Microsoft Windows $B$K$*$$$F$bF0:n$9$k!#(B
$B$3$N%=%U%H%&%'%"$O%P%C%/%(%s%I%G!<%?%Y!<%9$H$7$F(B MySQL $B$rMxMQ$7$F$$$k!#(B

MyHelpDesk (20020509 $BHG$*$h$S$=$l0JA0(B) $B$K$O967b@\MxMQ$5$l$F$$$k!#$3$N:]!"F~NOCM$KBP$9$k%U%#%k%?%j%s%0$,==J,$K9T$o(B
$B$l$F$$$J$$$?$a!"(BSQL $B%/%(%j$NO@M}9=B$$r2~JQ2DG=$G$"$k!#(B

$BCm0U$rJ'$C$FpJs$N;2>H$d2~JQ$r2DG=$K$9$k$H9M$($i$l$k!#IU$12C$($k$J(B
$B$i$P!"967bhttp://www.securityfocus.com/bid/4973
$B$^$H$a(B:

ZenTrack $B$O%W%m%8%'%/%H4IM}!"%P%0$NDI@W!"%A%1%C%H4IM}$rE}3gE*$K9T$&$h$&(B
$B$K@_7W$5$l$?%=%U%H%&%'%"$G$"$k!#$3$N%=%U%H%&%'%"$O(B PHP $B8@8l$K$h$C$FpJs$r3+<($9$kLdBj$,H/(B
$B8+$5$l$F$$$k!#(B

$BB8:_$7$J$$%A%1%C%H$X(B HTTP $B%j%/%(%9%H$r9T$&$3$H$K$h$j!"967b$N=EMW$J>pJs$r3+<($9$k2DG=@-$,$"$k!#(B

$B$3$N967b$K$h$jF~pJs$O!"967bhttp://www.securityfocus.com/bid/4974
$B$^$H$a(B:

MyHelpDesk $B$O(B PHP $B8@8l$G3+H/$5$l$?!"(BWeb $B$r2p$9$k%X%k%W%G%9%/%7%9%F%`$G(B
$B$"$k!#$3$N%=%U%H%&%'%"$O%U%j!<$G8x3+$5$l!"B?$/$N(B UNIX $B$d(B $BMM!9$J(B Linux$B!"(B
$B$^$?!"F1MM$K(B Microsoft Windows $B$K$*$$$F$bF0:n$9$k!#(B
$B$3$N%=%U%H%&%'%"$O%P%C%/%(%s%I%G!<%?%Y!<%9$H$7$F(B MySQL $B$rMxMQ$7$F$$$k!#(B

$B$3$N%=%U%H%&%'%"$O%U%)!<%`%U%#!<%k%IFb$+$i(B HTML $B%?%0$r==J,$K=|5n$7$F$$(B
$B$J$$$?$a!"%9%/%j%W%H$rCmF~$9$k967b$N1F6A$rH$9$k%f!<%6$N(B Web$B%V%i%&%6Fb$G!"$3$N%=%U%H%&%'%"$r2TF0$9$k%5%$%H(B
$B$N%;%-%e%j%F%#%3%s%F%-%9%H$HF13J$N8"8B$G5G'$N$?$a$KE>Aw$5$l$kE@$ON10U$5$l$k$Y$-$G$"$k!#(B

$B$3$NLdBj$O!"@x:_E*$K(B Web $B%3%s%F%s%D$N>h$CZMQ>pJs$NEp$_=P$7$r9T$&$?$a$N967b$KMxMQ$5$lF@$k$H(B
$B9M$($i$l$k!#(B

9. W-Agora Remote File Include Vulnerability
BugTraq ID: 4977
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 10 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4977
$B$^$H$a(B:

W-Agora $B$O(B Web $B$r2p$9$k=PHG!"EE;R7G<(HD5!G=$rDs6!$9$k%=%U%H%&%'%"$G$"$k!#(B
$B$3$N%=%U%H%&%'%"$O(B PHP $B8@8l$rMxMQ$7$Fe$NG$0U$N%U%!%$%k$r%$%s%/%k!<%I2DG=(B
$B$H$J$kLdBj$rJz$($k5?$$$,$"$k!#$3$N%=%U%H%&%'%"$G$O!"@_Dj%U%!%$%kMQ$N%Q(B
$B%9$r;2>H$9$k$?$a$K!"(BW-Agora $B$,MxMQ$9$k%9%/%j%W%HCf$GFC$K(B inc_dir $B$H$$$&(B
$BJQ?t$,MxMQ$5$l$F$*$j!"(B $BFCDj$N@_Dj>uBV$G$O!"967b]$N%U%!%$%k$,(B PHP $B%9%/%j%W%H$G$"$k>l9g!"$3$NLdBj$K$h$j!"(B
$B967be$G$N!"(BPHP $B$N@_Dj>uBV$K1~$8$F:81&$5$l$k!#(Ball_url_fopen
$B$,(B off $B$K@_Dj$5$l$F$$$k>l9g!"$3$NLdBj$rMxMQ$9$k967b$N1F6AHO0O$O69$a$i(B
$B$l$k!#(B

10. Datalex Bookit! Consumer Plaintext Authentication Credentials
Vulnerability
BugTraq ID: 4972
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 10 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4972
$B$^$H$a(B:

Datalex Bookit! Consumer $B$O!"(BWeb $B$rMxMQ$7$FN99TM=Ls%5!<%S%9$rDs6!$9$k(B
$B%=%U%H%&%'%"$G$"$k!#$3$N%=%U%H%&%'%"$O(B Microsoft Windows $B$K2C$(!"B?$/(B
$B$N(B UNIX $B$d(B $BMM!9$J(B Linux $B$K$*$$$FF0:n$9$k!#(B

Datalex Bookit! Consumer $B$OG'>ZMQ>ZL@=q$r5-21$9$k$h$&$K@_Dj$5$l$k2DG=(B
$B@-$,$"$k!#G'>ZMQ>ZL@=q$rJ];}$9$k$?$a$K(B 'remembered' $B$rA*Br$9$k$H!"$=$N(B
$B>ZL@=q$O%/%C%-!Z(B
$BL@=q$O!"J?J8$H$7$FJ]B8$5$l$k!#$3$NG'>ZMQ>ZL@=q$,$5$i$K967bH$G(B
$B$-$k$h$&$K$J$k>l9g$K!"$3$N$3$H$,LdBj$H$J$k$N$G$"$k!#(B

$BFCDj$N>u672<$K$*$$$F!"%G!<%?$,(B GET $BpJs(B ($BJ?J8$NG'>ZMQ>ZL@=q$r4^$`(B) $B$O!"(B
CGI $B$X$N%Q%i%a%?$N7ABV$GAw$i$l$k$N$G$"$k!#(B

$B967bZL@=q$X$N%"%/%;%9$ru67$,(B
$BA[Dj$5$l$k!#Nc$($P!"G'>ZMQ>ZL@=q$O!"%W%m%-%7%5!<%P>e$K$*$$$F%-%c%C%7%e(B
$B$5$l$k!#$^$?!"$3$N$3$H$O!"FCDj$N0LCV$KB8:_$9$k967bZMQ>ZL@=q$O!"%/%m%9%5%$%H%9%/%j%W%H$rMxMQ$9$k967b!"$b$7$/$O(B 
HTML $B$,30It$+$iCmF~$r9T$&967b(B (HTML injection attacks) $B$K$h$j@x:_E*$K(B
$B8x3+$5$l$F$7$^$&2DG=@-$,$"$k!#(B

11. BizDesign ImageFolio Authorized User Web Root Disclosure Vulnerability
BugTraq ID: 4976
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 10 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4976
$B$^$H$a(B:

ImageFolio Pro $B$O(B Web $B%$%s%?%U%'!<%9$r2p$7$?4IM}5!G=$N%5%]!<%H$,4^$^$l$k!"(B
Web $B$rMxMQ$9$k2hA|%"!<%+%$%V%Q%C%1!<%8$G$"$k!#LdBj$O(B ImageFolio Pro $B%P!<(B
$B%8%g%s(B 2.27 $B0JA0$K$*$$$FB8:_$9$k!#(B

Web $B$r2p$9$k4IM}MQ%Z!<%8$XFC$K6lO+$;$:$K%"%/%;%9$G$-F@$k%j%b!<%H%f!<%6$O!"(B
$B?7$?$J2hA|%+%F%4%j$r:n@.$9$k2DG=@-$,$"$k!#0-0U$"$k%f!<%6$KM?$($i$l$?%U%!(B
$B%$%kL>$K(B  "../" ( 2$B$D$N%T%j%*%I$H(B 1 $B$D$N%9%i%C%7%e$+$i@.$kJ8;zNs(B) $B$NA^F~(B
$B$9$k$3$H$G!"$3$N%=%U%H%&%'%"$N=hM}$N7g4Y$rA_$$@x$k967b$r;E8~$1$k$3$H$r2D(B
$BG=$K$9$k!#$3$N967b$,<:GT$K=*$o$k>l9g!"I=<($5$l$k%(%i!<%a%C%;!<%8$K$O!":n(B
$B@.$r4k$F$i$l$?%U%!%$%k$N@dBP%Q%9$,4^$^$l$k!#(B

$BE57?E*$J@_Dj>uBV$G$O!"$3$N%Q%9$K$O(B Web $BMQ$N%I%-%e%a%s%H%k!<%H>e$N>pJs$,(B
$B4^$^$l$k!#967bpJs$r(B
$BMxMQ$9$k2DG=@-$,$"$k!#(B

$B%j%b!<%H%f!<%6$O4IM}%Z!<%8$X$NM-8z$J%"%/%;%9$,9T$($kI,MW$,$"$j!"?7$?$J%+%F(B
$B%4%j$r:n@.$9$k$?$a$K!"2C$($FM-8z$J8"8B$,M?$($i$l$F$$$kI,MW$,$"$k!#(B

12. Seanox DevWex File Disclosure Vulnerability
BugTraq ID: 4978
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 08 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4978
$B$^$H$a(B:

Seanox DevWex $B$O(B Web $B%5!<%P$G$"$k!#C1BN$N(B Microsoft Windows $B%P%$%J%j$b$7(B
$B$/$O(B Java $B%"%W%j%1!<%7%g%s$H$7$FF~]$H$J$k%U%!%$%k$O!"$3$Nhttp://www.securityfocus.com/bid/4979
$B$^$H$a(B:

Seanox DevWex $B$O(B Web $B%5!<%P$G$"$k!#C1BN$N(B Microsoft Windows $B%P%$%J%j$b$7(B
$B$/$O(B Java $B%"%W%j%1!<%7%g%s$H$7$FF~uBV$O(B HTTP $B$N(B GET $B%a%=%C%I$N%j%/%(%9%HD9$K(B
$B4X$9$k6-3&%A%'%C%/$rBU$C$F$$$k$?$a$K@8$8$k!#Hs>o$KD9$$%j%/%(%9%H(B (258383
$B8D0J>e$ND9$5$NJ8;zNs(B) $B$K$h$j!"$3$N>uBV$,0z$-5/$3$5$l$k$N$G$"$k!#(B

$B$3$l$O(B Web $B%5!<%P$N%W%m%;%98"8B(B ($BDL>o$G$"$l$P(B SYSTEM $B8"8B(B) $B$G!"967bhttp://www.securityfocus.com/bid/4980
$B$^$H$a(B:

LPRng $B%=%U%H%&%'%"$O!"(BBerkley $BM3Mh$N(B LPR $B%W%j%s%H%9%W!<%k5!G=$r$h$j6/2=(B
$B$7!"3HD%@-!"0\?"@-$r;}$?$;$?%=%U%H%&%'%"$G$"$k!#(B

LPRng $B$N%G%U%)%k%H@_Dj$O!"%W%j%s%H%-%e!<$X$N%W%j%s%HBT$A$r$$$+$J$k%j%b!<(B
$B%H$+$i$bCHq$7?T$/$5$;$k$3$H$,2DG=$K$J$j!"(BDoS $B>uBV$r(B
$B0z$-5/$3$92DG=@-$,$"$k!#(B

15. Lokwa BB Multiple SQL Injection Vulnerabilities
BugTraq ID: 4981
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 10 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4981
$B$^$H$a(B:

Lokwa BB $B$O(B $B%U%j!<$GMxMQ2DG=$J%a%C%;!<%87G<(HD%U%)!<%i%`$G$"$k!#(B
Lokwa $B$N$$$/$D$+$N%P!<%8%g%s$O(B SQL $BJ8$r30It$+$iCmF~$r9T$&967b(B (SQL injection
attacks) $B$rpJs$N3+<($,2DG=$G$"$k$H?d;!$5$l$k!#(B

$BJs9p$K$h$k$H!"FCDj$N>u672<$K$*$$$FG$0U$NHkF?$5$l$?%a%C%;!<%8$X%"%/%;%9(B
$B$7!"$=$l$KBP$9$k1~Ez$rJV$;$k$h$&$K$J$k2DG=@-$,$"$k$3$H$,<($5$l$F$$$k!#(B

$B$3$NLdBj$O!"(B'member.php'$B!"(B'misc.php' $B$d(B 'pm.php' $B%9%/%j%W%HFb$K$"$k$HJs(B
$B9p$5$l$F$$$k!#(B'pm.php' $B%9%/%j%W%H$OG$0U$N%W%i%$%Y!<%H%a%C%;!<%8$N3+<($H(B
$BJV$9$3$H$KMxMQ$5$l$k!#(B'misc.php' $B$H(B 'member.php' $B$O!"%f!<%6$,4IM}pJs$r<}=8$9$kJd=uhttp://www.securityfocus.com/bid/4982
$B$^$H$a(B:

The Belkin F5D5230-4 4-Port Cable/DSL Gateway Router $B$O!"2HDm$*$h$S>.5,(B
$BLO%*%U%#%98~$1$N%O!<%I%&%'%"7?$N%k!<%?$G$"$k!#(B

$B5!4o$N5!G=$H$7$F!"M?$($i$l$?%]!<%H$KBP$7$F30It$+$iF~$C$F$/$k%H%i%U%#%C(B
$B%/$re$N%5!<%P$rFCDj$9$k$3$H$,2DG=$G$"$k!#Nc$((B
$B$P!"FbIt(B Web $B%5!<%P$O!"(B80 $BHV%]!<%H$KBP$9$kA4%H%i%U%#%C%/$rhttp://www.securityfocus.com/bid/4983
$B$^$H$a(B:

AlienForm2 $B$O(B Perl $B8@8l$rMxMQ$7$F3+H/$5$l$?EE;R%a!<%k%2!<%H%&%'%$MQ$N(B
$B%$%s%?%U%'!<%9$G$"$j!"(BJon Hedley $B$K$h$C$FJ]H$,9T$($kLdBj$,Js9p$5$l$F$$$k$?(B
$B$a!"%f!<%6$O%[%9%H>e$KB8:_$9$k$$$+$J$k%U%!%$%k$X%"%/%;%9$7!"%U%!%$%kFb(B
$BMF$r@x:_E*$K2~JQ$9$k$3$H$,2DG=$H$J$k!#(B

$BJs9p$K$h$k$H!"%f!<%6$+$iM?$($i$l$?F~NOCM$K$D$$$F$N%U%#%k%?%j%s%0$r;n$_(B
$B$k:]!"F~NO$5$l$?(B HTTP $B%j%/%(%9%H$+$iFCDj$N5?$o$7$$J8;z$O=|5n$5$l$k!#(B
$B7k2L$H$7$F!"(B'.|.' ( 2 $B$D$N%T%j%*%I$N4V$K%Q%$%W$+$i@.$kJ8;zNs(B) $B$NJ8;zNs(B
$B$O!"(B'..' ( 2 $B$D$N%T%j%*%I$+$i@.$kJ8;zNs(B) $B$H$7$F2rH$K4X$9$k967b$r2p$7!"%5!<%P>e$NG$0U$N%U%!%$%k$r%"%/%;(B
$B%9$9$k$3$H$G$3$NLdBj$rMxMQ$9$k$3$H$,2DG=$G$"$k$HJs9p$5$l$F$$$k!#$3$l$O!"(B
$B7+$jJV$7$F(B '.|.%2F' $B$N$h$&$JJ8;zNs$r4^$`(B GET $B%j%/%(%9%H$K$h$j@.$7?k$2$i(B
$B$l$k$H9M$($i$l$k!#(B

$B%f!<%6$+$iF~NO$5$l$?%G!<%?$r%U%!%$%k$XE>Aw$9$k5!G=$HAH$_9g$o$;$k$3$H$G!"(B
$B$3$NLdBj$rMxMQ$9$k967b$,4k$F$i$l$k2DG=@-$,$"$k!#$3$N>l9g!"%j%b!<%H%f!<(B
$B%6$K$h$j!"%9%/%j%W%H%f!<%6$N8"8B$G$$$+$J$k%7%9%F%`%U%!%$%k$XG$0U$N%G!<(B
$B%?$r2C$($k$3$H$,2DG=$G$"$k$H?d;!$5$l$k!#(B

$B$3$NLdBj$rMxMQ$9$k967b$,@.8y$7$?>l9g!"BP>]%[%9%H$X$N99$J$k967b$NJd=uhttp://www.securityfocus.com/bid/4984
$B$^$H$a(B:

rhmask $B$OB>$N%U%!%$%k$H$N%^%9%/(B ($BLuCm(B: $B:9J,(B) $BItJ,$H$J$k%U%!%$%k$rG[I[$9(B
$B$k$?$a$N(B Red Hat Linux $B$KF1:-$5$l$k%f!<%F%#%j%F%#$G$"$k!#(B

rhmask $B$O%^%9%/%U%!%$%kCf$K=PNO$5$l$?%U%!%$%kL>$NBEEv@-$N3NG'$rE,@Z$K9T$C(B
$B$F$$$J$$$N$G$"$k!#$3$N$?$a!"967be=q$-$9$k$h$&$J%^%9%/%U%!%$%k$r:n(B
$B@.$9$k$?$a$K!"@x:_E*$K$3$NLdBj$rMxMQ$9$k2DG=@-$,$"$k!#DL>o$N>uBV$G$O!"(B
$B%f!<%6$X$O%^%9%/$rE,MQ$9$kBP>]$N%U%!%$%k$,DL9p$5$l$k$,!"(Brhmask $B$OBP>]%U%!(B
$B%$%k$,%7%s%\%j%C%/%j%s%/$G$"$k>l9g$K$OE,@Z$JDL9p$r9T$o$J$$!#(B

rhmask $B$O:G6a$N(B Red Hat Linux $B$K$O%G%U%)%k%H$G%$%s%9%H!<%k$5$l$F$$$J$$!#(B

19. Caldera OpenServer XSCO Color Database File Heap Overflow Vulnerability
BugTraq ID: 4985
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: Jun 11 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4985
$B$^$H$a(B:

OpenServer $B$O>&MQ$N(B UNIX $B%*%Z%l!<%F%#%s%0%7%9%F%`$G$"$j!"(BSCO $B$K$h$C$F(B
$B3+H/$5$l!"(BCaldera $B$K$h$C$FHNGd$5$l$F$$$k!#(B

OpenServer $B$KF1:-$5$l$F$$$k%&%$%s%I%&%7%9%F%`%=%U%H%&%(%"%Q%C%1!<%8$O!"(B
$B%m!<%+%k%f!<%6$N8"8B$r>:3J$5$;F@$kLdBj$rJz$($F$$$k!#$3$NLdBj$O(B Xsco
$B%W%m%0%i%`$K$*$1$kFCDj$N%3%^%s%I%i%$%s$N%*%W%7%g%s$N07$$$KM3Mh$7$F$$$k!#(B

Xsco $B$O(B OpenServer $B$H6&$KDs6!$5$l$F$$$k(B X Window System $B%5!<%P$G$"$k!#(B
OpenServer $B$H6&$KDs6!$5$l$F$$$k%G%9%/%H%C%W4D6-$,!"(BXsco $B>e$GF0:n$7$F$$(B
$B$k!#(BXsco $B$O%G%U%)%k%H$G(B setuid root $B$5$l$F$$$k!#(B

Xsco $B$N(B -co $B$H$$$&%3%^%s%I%i%$%s%*%W%7%g%s$O!"?'$K4X$9$k%G!<%?%Y!<%9%U%!(B
$B%$%k$rFI$_9~$`$?$a$KMxMQ$5$l$F$$$k!#(B

Xsco $B$,Jz$($kLdBj$K$h$j!"%m!<%+%k%f!<%6$,8"8B$r>:3J$5$;F@$k2DG=@-$,$"$k!#(B
Xsco $B$,F0:n$7$F$$$k:]$K!"6KC<$KD9$$0z?t$r(B -co $B%U%i%0$H6&$KEO$9$3$H$G!"(B
$B%R!<%W%*!<%P!<%U%m!<$,H/@8$9$k$N$G$"$k!#%m!<%+%k%f!<%6$O(B -co $B%*%W%7%g%s(B
$B$H6&$K!"0U?^E*$JFCDj$NJ8;zNs$rEO$9$3$H$G!"7k2LE*$KG$0U$N%3!<%I$r:3J$,2DG=$H$J$k!#(B

$B$3$N%*!<%P!<%U%m!<$O(B 9000 $BJ8;z0J>e$N0z?t$,(B -co $B%*%W%7%g%s$KEO$5$l$?:]$K(B
$B:F8=$5$l$F$$$k!#$3$NLdBj$K$h$C$F!"%m!<%+%k%f!<%6$O(B root $B%0%k!<%W$N8"8B(B
$B$GG$0U$N%3!<%I$rhttp://www.securityfocus.com/bid/4987
$B$^$H$a(B:

Linksys EtherFast $B%k!<%?$O!"(B DSL $B$d(B Cabel $B@\B3$NMxMQ$KE,$9$k$h$&$K@_7W(B
$B$5$l$?!"(B4 $B%]!<%H$N>.5,LO%k!<%?$G$"$k!#(BEtherFast $B%k!<%?$O!"(BNetwork Address
Translation $B$d(B DHCP $B$H$$$C$?5!G=$rDs6!$9$k!#(B

$B$3$NLdBj$O(B 2002 $BG/(B 5 $B7n(B 1 $BF|$K%j%j!<%9$5$l$?%U%!!<%`%&%(%"$N!"8=9THG(B
(1.42.7) $B$KBP$7$FJs9p$5$l$?!#Js9p$K$h$k$H!"$3$N%U%!!<%`%&%(%"$O%k!<%?$N(B
$B%j%b!<%H$+$i$N4IM}5!G=$NMxMQ$rM^@)$9$k$?$a$N%k!<%k$NB8:_$r9MN8$7$F$$$J(B
$B$$$N$H$N$3$H$G$"$k!#3:Ev$9$k%U%!!<%`%&%(%"$N%P!<%8%g%s$O!"%j%b!<%H$+$i(B
$B$N4IM}5!G=$rDs6!$9$k$?$a$K(B TCP/5678 $B$G%3%M%/%7%g%s$rBT$Ahttp://www.securityfocus.com/bid/4988
$B$^$H$a(B:

Pinboard $B$O(B PHP $B8@8l$rMxMQ$7$F3+H/$5$l$?!"(BWeb $B2p$7$FMxMQ2DG=$J%?%9%/%j(B
$B%9%H4IM}%D!<%k$G$"$k!#(B

Pinboard $B$O%U%)!<%`%U%#!<%k%I$+$i(B HTML $B%?%0$N=|5n$rE,@Z$K9T$J$C$F$$$J$$!#(B
$B$3$N$?$a!"(BPinboard $B$N%f!<%6$OG$0U$N(B HTML $B$d%9%/%j%W%H%3!<%I$r%?%9%/%j%9(B
$B%H$KCmF~$9$k$3$H$,2DG=$G$"$k$H?d;!$5$l$k!#$3$N$h$&$KKd$a9~$^$l$?(B HTML $B$d(B
$B%9%/%j%W%H%3!<%I$O!"%?%9%/%j%9%H$r1\Mw$7$?(B Web $B%f!<%6$N%V%i%&%6Fb$G!"%?(B
$B%9%/%j%9%H$r2TF0$5$;$F$$$k%5%$%H$N%3%s%F%-%9%H$Gh$CZ>pJs$N=jF@$r9T$&$3$H$,2DG=$G$"$k$H?d;!$5$l$k!#(B

22. MMFTPD SysLog Format String Vulnerability
BugTraq ID: 4990
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 11 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4990
$B$^$H$a(B:

mmftpd $B$O%U%j!<$GMxMQ2DG=$J%*!<%W%s%=!<%9$N(B Linux $B8~$1$N(B FTP $B%5!<%P$G$"(B
$B$k!#(B

$B$3$N%G!<%b%s$O!"%j%b!<%H$N967bpJs$r%m%0$H$7$FJ]B8$9(B
$B$k%W%m%0%i%`Fb$K$*$1$k(B syslog $B$N8F$S=P$7$,!"@x:_E*$K4X?t$N%j%?!<%s%"%I(B
$B%l%9$r>e=q$-$7!"G$0U$N%3!<%I$re=q$-$9$k$3$H$r2DG=$H$9$k$N$G$"$k!#(B

$B$3$NLdBj$K$h$j!"967bhttp://www.securityfocus.com/bid/4992
$B$^$H$a(B:

BBGallery $B$O!"(B jpeg $B2hA|$+$i(B HTML $B$r@8@.$9$k(B Perl $B%9%/%j%W%H$G$"$j!"%5(B
$B%`%M%$%k2hA|$rMM!9$Jh$CZ>pJs$NC%http://www.securityfocus.com/bid/4993
$B$^$H$a(B:

csNews $B$O(B Web $B%5%$%H>e$G%K%e!<%9$r4IM}$9$k%9%/%j%W%H$G$"$k!#$3$N%=%U%H(B
$B%&%'%"$OB?$/$N(B UNIX $B$dMM!9$J(B Linux $B$GF0:n$7!"$^$?!"(BMicrosoft Windows$B$K(B
$B$*$$$F$bF0:n$9$k!#(B

csNews $B$O(B Web $B%$%s%?!<%U%'!<%9$r2p$7$F@_Dj2DG=$G$"$k!#$^$?!"0[$J$k%f!<(B
$B%6$KBP$7$F!"0[$J$C$?%"%/%;%9%l%Y%k$,Dj5A$5$l$k2DG=@-$,$"$k!#(B
"public" $B%"%/%;%98"$r=jM-$7$?%f!<%6$,!"4IM}o4IM}$K$*$$$F!"(B
$B%a%?J8;z$r(B 2 $B2s(B URL $B%(%s%3!<%G%#%s%0$7$F$7$^$&$3$H$K$h$C$F?k9T$5$l$k2D(B
$BG=@-$,$"$k!#(B

$B%f!<%6$O(B 'Advanced Settings' $B%Z!<%8>e$G!"%*%W%7%g%s$N1\Mw!"JT=8$,2DG=$G(B
$B$"$j!"$^$?(B 'Admin Options' $B$bF1MM$K1\Mw$9$k$3$H$,2DG=$G$"$k!#(B

$BNc$($P!"(Bdefault%2edb $B$N$h$&$J%G!<%?%Y!<%9L>$r4^$`(B URL $B$rAw?.$9$k$3$H$G(B
$B$3$NLdBj$rMxMQ$9$k967b$r9T$&$3$H$,?d;!$5$l$k!#(B

25. CGIScript.net csNews Header File Type Restriction Bypass Vulnerability
BugTraq ID: 4994
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 11 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4994
$B$^$H$a(B:

csNews $B$O(B Web $B%5%$%H>e$G%K%e!<%9$r4IM}$9$k%9%/%j%W%H$G$"$k!#$3$N%=%U%H(B
$B%&%'%"$OB?$/$N(B UNIX $B$dMM!9$J(B Linux $B$GF0:n$7!"$^$?!"(BMicrosoft Windows$B$K(B
$B$*$$$F$bF0:n$9$k!#(B

$B$3$N%=%U%H%&%(%"$O!"(B csNews $B$K$h$C$FI=<($5$l$k%X%C%@$H%U%C%?$r4IM}o$O$3$N%X%C%@!"%U%C%?$H$7$FDj5A$G$-$k%U%!(B
$B%$%k$O!"(B.txt $B!"(B.html$B!"(B.htm $B$N3HD%;R$r;}$D%U%!%$%k$N$_$K@)8B$5$l$F$$$k!#(B
$B$7$+$7!"0-0U$r;}$C$?4IM}pJs$H6&$K@5>o$K9=C[$5$l$?(B HTTP $B%j%/%(%9%H$rAw(B
$B?.$9$k$3$H$K$h$C$F!"$3$N8=>]$rMF0W$K:F8=$G$-$F$7$^$&$H$N$3$H$G$"$k!#(B

$B$3$NLdBj$rMxMQ$7$?967b$,@.8y$7$?>l9g!"967bZ>pJs(B
$B$r4^$s$@(B CGI $B%9%/%j%W%H%U%!%$%k$r;XDj$9$k2DG=@-$,$"$k!#(B

BID 4993 $B$NLdBj$HAH$_9g$o$5$l$F$3$NLdBj$rMxMQ$9$k967b$,9T$o$l$?>l9g!"(B
csNews $B$KBP$7$F$N(B "public" $B%"%/%;%98"$N$_$K$h$C$F$3$NLdBj$rMxMQ$9$k967b(B
$B$,http://www.securityfocus.com/bid/4991
$B$^$H$a(B:

csNews $B$O(B Web $B%5%$%H>e$G%K%e!<%9$r4IM}$9$k%9%/%j%W%H$G$"$k!#$3$N%=%U%H(B
$B%&%'%"$OB?$/$N(B UNIX $B$dMM!9$J(B Linux $B$GF0:n$7!"$^$?!"(BMicrosoft Windows$B$K(B
$B$*$$$F$bF0:n$9$k!#(B

$BB?$/$N(B csNews $B$K4X$9$k=EMW$J>pJs$,5-O?$5$l$F$$$k%U%!%$%k$,!"G'>Z$r9T$C(B
$B$F$$$J$$%f!<%6$K$h$C$F%"%/%;%9$5$l$k2DG=@-$,$"$k!#$3$NJ}K!$rMQ$$$F!"(B
$B%G!<%?%Y!<%9MQ$N%U%!%$%k$,%"%/%;%9$5$l!"@x:_E*$K%G!<%?%Y!<%9MQ$NG'>ZMQ(B
$B>pJs$dB>$N=EMW$J>pJs$,C%http://www.securityfocus.com/bid/4995
$B$^$H$a(B:

Apache Tomcat $B$O%U%j!<$G8x3+$5$l!"%*!<%W%s%=!<%9$G$"$k!"(BJava Servlet $B$*(B
$B$h$S(B JavaServer Pages (JSP) $B5;=Q$rMxMQ$9$k%Z!<%8I=<(!"2ruBV$r0z$-$*$3$9$H$$$&LdBj$,Js9p$5$l(B
$B$F$$$k!#(BTomcat $B$,0-0U$K$h$C$FAH$_N)$F$i$l$?(B JSP $B$rMxMQ$9$k(B Web $B%Z!<%8$r(B
$Be$G0-0U$N$"$k%Z!<%8$r:n@.$7!"%5!<%P$+$i$=$N(B
$B%Z!<%8$r8F$S=P$9$3$H$K$h$j$3$NLdBj$r0-MQ$9$k2DG=@-$,$"$k!#$3$l$O(B Tomcat
JSP $B<+BN$K%Z!<%8$rFI$_9~$^$;$h$&$H$7!"uBV$KF3$-%/%i%C%7%e$9(B
$B$k7k2L$r>7$/$H9M$($i$l$k!#!#(B

28. Macromedia JRun JSP Engine Denial Of Service Vulnerability
BugTraq ID: 4997
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 12 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4997
$B$^$H$a(B:

Macromedia JRun $B$O(B  Microsoft Windows $B>e$N(B IIS (Internet Information
Server) 4/5 $B$GMxMQ$5$l$k(B J2EE (Java 2 Platform Enterprise Edition) $B%"%W(B
$B%j%1!<%7%g%s%5!<%P$G$"$k!#(B

Windows $BHG$N(B Macromedia JRun $B$K$O(B Dos $B>uBV$r>7$/LdBj$,B8:_$9$k$3$H$,Js(B
$B9p$5$l$F$$$k!#$3$NLdBj$O(B JRun $B$,0-0U$N$"$k(B JSP $B$N%Z!<%8$re$G0-0U$N$"$k%Z!<%8$r:n@.$7!"%5!<%P$+$i$=$N(B
$B%Z!<%8$r8F$S=P$9$3$H$K$h$j$3$NLdBj$r0-MQ$9$k2DG=@-$,$"$k!#$3$l$O(B JRun 
JSP $B<+BN$K%Z!<%8$rFI$_9~$^$;$h$&$H$7!"uBV$KF3$-%/%i%C%7%e$9(B
$B$k7k2L$r>7$/$H9M$($i$l$k!#(B

29. SGI MediaMail Memory Corruption Vulnerability
BugTraq ID: 4959
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: Jun 07 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4959
$B$^$H$a(B:

MediaMail $B$O(B SGI IRIX $B$H6&$KG[I[$7$F$$$k%a!<%k%"%W%j%1!<%7%g%s$G$"$k!#(B

MediaMail $B$KB8:_$9$kLdBj$K$h$j!"%m!<%+%k%f!<%6$,$h$j9T0Y$N8"8B$rC%7$/$3$H$,2DG=$K$J$k$HJs9p$5$l$F$$$k!#(B

MediaMail $B$KFCDj$N%3%^%s%I%i%$%s0z?t$r0z$-EO$9$3$H$K$h$j%3%"%@%s%W$r>7(B
$B$/2DG=@-$,$"$k$3$H$,(B SGI $B$K$h$C$FJs9p$5$l$F$$$k!#$3$l$i$N%3%"%@%s%W$O(B
$B%a%b%j$NGK2u$,860x$G$"$j!"967b$KMxMQ2DG=$G$"$k!#(B MediaMail $B$*$h$S(B 
MediaMail Pro $B%"%W%j%1!<%7%g%s$ODL>o!"(B setgid mail $B>uBV$G%$%s%9%H!<%k$5(B
$B$l$k!#967bl9g!"967b\:Y$,F~l9g!"967bo$KD9$$J8;zNs$*$h$S(B
$B967bl9g!"967b$N%f!<%6$N%a!<%k$NFI$_=P$7$,2D(B
$BG=$G$"$k!#(B

30. CGIForum Infinite Recursion Denial of Service Vulnerability
BugTraq ID: 4960
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 07 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4960
$B$^$H$a(B:

CGIForum $B$O(B Markus Triska $B$,Ds6!$7$F$$$k%U%j!<$GF~u672<$K$*$$$F!"%7%9%F%`Fb$N;q8;$rMxMQ$7?T(B
$B$/$5$;$i$l$k!"L58B:F5"8F$S=P$7>uBV$K4Y$C$F$7$^$&$N$G$"$k!#$3$N:]!"%5!<(B
$B%P$O?7$7$/M?$($i$l$k%j%/%(%9%H$KBP$9$k1~Ez$rDd;_$7!"7k2L$H$7$F(B DoS $B$K(B
$B4Y$k2DG=@-$,$"$k!#(B

CGIForum $B$N%P!<%8%g%s(B 1.06 $B0JA0$,$3$NLdBj$N1F6A$ro5!G=$NI|5l$K$O%5!<%S%9$N:F5/F0$,I,MW$G$"$k$H?d;!$5$l$k!#(B

31. WebCalendar Include Files Information Disclosure Vulnerability
BugTraq ID: 4961
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 07 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4961
$B$^$H$a(B:

WebCalendar $B$O0l?M$"$k$$$OJ#?t$N%f!<%6$N%9%1%8%e!<%k$r4IM}$9$k$?$a$K;H(B
$BMQ$5$l$k(B Web $B%"%W%j%1!<%7%g%s$G$"$k!#(BWebCalender $B$O(B PHP $B8@8l$rMxMQ$7$F(B
$Be$G$"$l(B
$B$P$I$N(B OS $B>e$G$"$C$F$bF0:n$9$k$H9M$($i$l$F$$$k%7%9%F%`$G$"$k!#(B

WebCalender $B$O967bpJs$N;2>H$,2DG=$K$J$k$H?d;!$5$l$k(B
$BLdBj$,H/8+$5$l$F$$$k!#(B

$BLdBj$O%$%s%/%k!<%I%U%!%$%k$NL?L>5,B'$KM3Mh$7$F$$$k!#$3$N%=%U%H%&%'%"$G(B
$B$OE57?E*$K%$%s%/%k!<%I%U%!%$%k$O(B '.inc' $B$N3HD%;R$G=*$o$k$h$&$KL?L>$5$l(B
$B$F$$$k!#$3$N$?$a!"%$%s%/%k!<%I%U%!%$%k$OB>$N%U%!%$%k$+$iMF0W$K<1JL2DG=(B
$B$G$"$k!#$7$+$7!"$3$l$i$N%U%!%$%k$O(B PHP $B%$%s%?%W%j%?$K$h$C$F(B PHP $B%3!<%I(B
$B$H$7$F2r@O$5$l$J$$$?$a!"967bZMQ>pJs(B) $B$,$3$l$i$N(B PHP $B%U%!(B
$B%$%kCf$K5-O?$5$l$F$$$k>l9g!"$3$l$O6K$a$FLdBj$G$"$k!#(B

$B$3$N>pJs$OLdBj$rJz$($k%7%9%F%`$KBP$9$k$5$i$J$k967b$r4k$F$k$?$a$KMxMQ$5(B
$B$l$k2DG=@-$,$"$k!#(B

32. Pine Unix Username Account Information Leakage Vulnerability
BugTraq ID: 4963
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 08 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4963
$B$^$H$a(B:

Pine $B$O%U%j!<$GF~]$N%7%9%F%`Fb$N%"%+%&(B
$B%s%H$K4X$9$k>pJs$rC%u672<$K$*$$$F!"8D!9$N%f!<%6(B
$B%"%+%&%s%H$r30It$K1#JC$9$k$?$a$KMxMQ2DG=$G$"$k!#$^$?!"$3$N5!G=$O%m!<%+(B
$B%k$N%7%9%F%`%"%+%&%s%H$K4X$9$k>pJs$r!"Bh;0$r3+<($7$F$7$^$&!#EE;R%a!<%k(B
$B$,Aw?.$5$l$k:]!"(BPine $B$OEE;R%a!<%k$K(B Sender: $B$"$k$$$O(B X-X-Sender: $B9T$N(B
$B$$$:$l$+$r$N;2>H$,2DG=$K$J$j!">pJs<}(B
$B=8$rL\E*$H$9$k967b$KMxMQ2DG=$G$"$k!#(B

33. Multiple Bugzilla Security Vulnerabilities
BugTraq ID: 4964
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Jun 08 2002 12:00A
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/4964
$B$^$H$a(B:

Bugzilla $B$O%U%j!<$GF~pJsO31L$K$h$C$F>pJs$rpJs72$X$N%"%/%;%98"$rC%h$CZ$KMxMQ$5$l$k%/%C%-!<>pJs(B
$B$rEp$_=P$9$3$H$,2DG=$G$"$k$H?d;!$5$l$k!#(B

$B%G%#%l%/%H%j$,B8:_$7$J$$>l9g$O!"(BMozilla $B$O%G%#%l%/%H%j$N:n@.$r;n$_$k!#(B
$B$7$+$7!"%G%U%)%k%H$G%G%#%l%/%H%j$ODL>o=q$-9~$_2DG=$J%Q!<%_%C%7%g%s$G:n(B
$B@.$5$l$k!#(B

$BG'>Z:Q$_$N%f!<%6$G$"$l$P$I$N%f!<%6$G$"$C$F$b!"(Bedituser.cgi $B%9%/%j%W%H(B
$B$r2p$7$F%\!<%I>e$NB>$N%f!<%6$r:o=|$9$k$?$a$K!"B>$N%f!<%6$N>\:Y$rJQ99$9(B
$B$k$3$H$,2DG=$G$"$k!#(B

Real Names $B%U%#!<%k%I$O(B HTML $B$N%U%#%k%?%j%s%0$r9T$C$F$$$J$$!#$3$N$?$a!"(B
$B967bpJs$d5!L)>pJs$r8x3+$5$l$F$$$kI=<(>uBV$K@_Dj$7$F$7$^$&Ey(B
$B$N0U?^$7$J$$7k2L$r>7$/2DG=@-$,$"$k!#(B

$B$^$?!"%P%C%/%(%s%I%G!<%?%Y!<%9$H$NF14|$,%;%-%e%"$G$O$J$$J}K!$G9T$o$l$F(B
$B$*$j!"FCDj$N>u672<$K$*$$$F!"(B Bugzilla $B$N%f!<%6$K=EMW$J%G!<%?$,L5:n0Y$K(B
$B=PNO$5$l$k2DG=@-$,$"$k!#(B

III. SECURITYFOCUS NEWS AND COMMENTARY
------------------------------------------
1. Feds, Industry, Battle the Biggest Bug
$BCxhttp://online.securityfocus.com/news/474

2. MS security hole extravaganza
$BCxe$+$iMa$S$;$i$l$k$h$&$K7hDj$5$l$?!"MM!9$J(B
$B!!%;%-%e%j%F%#%[!<%k$rJz$($F$$$kLOMM$G$"$k(B
$B$=$3$GLd$$3]$1$?$$!#%Q%C%A$r:#F|E,MQ$7$?$$$H9M$($k$@$m$&$+(B?

http://online.securityfocus.com/news/479

3.  Hill Eyes Shifting Parts of FBI, CIA
$BCxJ$K(B CIA $B$*$h$S(B FBI $B$NLr3d$rD6$((B
$B$k8"8B$rM?$($k$3$H$r@Q6KE*$K8!F$$7!"%V%C%7%eBgE}NN$,H?BP$9$k9q2H$N>pJs(B
$B5!4X$K4X$9$k5DO@$Nhttp://online.securityfocus.com/news/478

4. Pentagon on track to add biometrics to access card
$BCxJ$O(B Common Access smart card $B$G%P%$%*%a%H%j%/%9G'>Z$r9T$&7W2h$r(B
$B@Q6KE*$K8!F$$7$F$$$k!#(B

http://online.securityfocus.com/news/477

IV.SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. wicap v0.4
$B:nhttp://www.snort.org/~bmc/software/wicap/
$BF0:n4D6-(B: FreeBSD, OpenBSD, POSIX, Solaris, SunOS
$B$^$H$a(B:

wicap $B$O%;%C%H%"%C%W$,4JC1$J(B captive portal $B$G(B OpenBSD $B$KBP1~$7$F$$$^(B
$B$9!#(B

2. JSpamFilter v1.0
$B:nhttp://www.darylb.net/JSpamFilter/
$BF0:n4D6-(B: Os Independent
$B$^$H$a(B:

JSpamfilter $B$O%a!<%k%5!<%P$K@\B3$7$h$&$H$9$kA0$K!"%j%b!<%H$N%$%s%?!<%M%C(B
$B%H$N%a!<%k%5!<%P$+$i$N@\B3$re$G0];}(B
$B$5$l$F$$$k(B DNS-based SPAM Blackhole (DNSBL) $B%j%9%H$N0l$D$H>H9g$5$l$^$9!#(B
$B>H9g$,@.8y$7$?>l9g!"G[Aw85$O%a!<%k%5!<%P$X$N%3%M%/%7%g%s$N3NN)$,2DG=$K(B
$B$J$j$^$9!#>H9g$,<:GT$7$?>l9g!"G[Aw85$X$O%a!<%k%5!<%P$,MxMQIT2DG=$G$"$k(B
$B$HEA$($i$l!"$=$N8e!"$=$NEE;R%a!<%k$OGK4~$5$l$^$9!#(B

3. Vipul's Razor v2.03
$B:nhttp://razor.sourceforge.net
$BF0:n4D6-(B: Os Independent
$B$^$H$a(B:

Vipul's Razor $B$O!"J,;67?$G6(D4E*$J%9%Q%`8!CN$+$D%U%#%k%?%j%s%0%M%C%H%o!<(B
$B%/$G$"$j!"%9%Q%`G[?.$N%V%m!<%I%-%c%9%H$NFC@-$rMxMQ$7$F$=$NL"1d$r@)8B$7(B
$B$^$9!#%7%9%F%`$Nhttp://echelog.sourceforge.net/
$BF0:n4D6-(B: FreeBSD, Linux, OpenBSD, POSIX, Solaris, SunOS
$B$^$H$a(B:

Echelog $B$O0lBf!"$^$?$OJ#?t$N%(!<%8%'%s%H$H0l$D!"$^$?$OJ#?t$N%5!<%P$+$i(B
$B9=@.$5$l$kJ,;67?$N%7%9%F%`$G$9!#%M%C%H%o!<%/>e$N%3%s%T%e!<%?!<$KJ,;6G[(B
$BCV$5$l$?%(!<%8%'%s%H$O!"%M%C%H%o!<%/$*$h$S%3%s%T%e!<%?$N>uBV$r4F;k$7$F(B
$B$$$^$9!#pJs$O!"(BSSL $B%W%m%H%3%k$r;HMQ$7$F!"%G!<%?$,%"!<%+%$%V$K(B
$BJ]4I$5$l$k0BA4$J%5!<%P!<$XAw?.$5$l$^$9!#(B

5. Web shell v1.0
$B:nhttp://dyatlov.ru
$BF0:n4D6-(B: UNIX
$B$^$H$a(B:

Webshell $B$O(B HTTP $B$r2p$7$FF0:n$9$k%j%b!<%H$N(B UNIX $B%7%'%k$G$9!#$3$N%/%i(B
$B%$%"%s%H%9%/%j%W%H$O%7%'%k$N$h$&$J%W%m%s%W%H$rDs6!$7!"(BHTTP $B$N(B POST $B%j(B
$B%/%(%9%H$NCf$K%+%W%;%k2=$7$?%f!<%6%3%^%s%I$rF~$l$F%5!<%P%9%/%j%W%H$KAw(B
$B?.$7$^$9!#%5!<%P%9%/%j%W%H$O%3%^%s%I$rE83+$7$Fhttp://passguard.sourceforge.net
$BF0:n4D6-(B: Linux, POSIX, UNIX
$B$^$H$a(B:

PassGuard Framework $B$O0E9f2=$5$l$?%U%!%$%k$NB??t$N%Q%9%o!<%I$r4IM}$9$k(B
$B$?$a$K;HMQ$5$l$k(B PassGuard $B$G;HMQ$9$k%W%m%0%i%`72$N$?$a$N%i%$%V%i%j$G(B
$B$9!#0E9f2=$O$I$s$J.3^8691M:(B(OGASAWARA Tsuneo)$B!"(B
$BF#K\6)http://www.lac.co.jp/security/
smime.p7s