Mailing-List: contact bugtraq-jp-help@securityfocus.com; run by ezmlm
Precedence: bulk
To: BUGTRAQ-JP@SECURITYFOCUS.COM
Subject: SecurityFocus Newsletter #160 2002-8-26->2002-8-30
From: SAKAI Yoriyuki <sakai@lac.co.jp>
References: <Pine.LNX.4.43.0209040854280.6937-100000@mail.securityfocus.com>
In-Reply-To: <Pine.LNX.4.43.0209040854280.6937-100000@mail.securityfocus.com>
Message-Id: <200209112145.JHE87776.LTBJB@lac.co.jp>
Date: Wed, 11 Sep 2002 21:45:53 +0900
Mime-Version: 1.0
Content-Type: multipart/signed;
    protocol="application/x-pkcs7-signature";
    micalg=sha1; Boundary="---------1031748351-1670762"

-----------1031748351-1670762
Content-Type: text/plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit

$B:d0f(B@$B%i%C%/$G$9!#(B

SecurityFocus Newsletter $BBh(B 160 $B9f$NOBLu$r$*FO$1$7$^$9!#(B
$BLu$N$J$$9`L\$K$D$$$F$O!VF|K\8lLu$J$7!W$H$7$F6hJL$7$F$"$j$^$9!#(B

---------------------------------------------------------------------------
SecurityFocus Newsletter $B$K4X$9$k(BFAQ:
http://www.securityfocus.com/popups/forums/securityfocusnews/intro.shtml
BugTraq-JP $B$K4X$9$k(B FAQ:
http://www.securityfocus.com/popups/forums/bugtraq-jp/faq.shtml
(SecurityFocus Newsletter $B$NOBLu$O(B BugTraq-JP $B$G0l<!G[I[$5$l$F$$$^$9(B)
---------------------------------------------------------------------------
$B0zMQ$K4X$9$kHw9M(B:
$B!&$3$NOBLu$O(B SecurityFocus $B$N5v2D$r3t<02q<R%i%C%/$,F@$?>e$G9T$o$l$F$$$^$9!#(B
$B!&(BSecurityFocus Newsletter $B$NOBLu$r(B Netnews, Mailinglist, World Wide Web,
  $B=q@R(B, $B$=$NB>$N5-O?G^BN$G0zMQ$5$l$k>l9g$K$O%a!<%k$NA4J80zMQ$r$*4j$$$7$^$9!#(B
$B!&F|K\8lHG%K%e!<%9%l%?!<(B 1 $B9f$+$i(B 3 $B9f$^$G$K$O$3$NHw9M$,IU$$$F$$$^$;$s$,!"(B
  $B=`MQ$9$k$b$N$H$7$^$9!#(B
$B!&$^$?!"(BSecurityFocus $BDs6!$N(B BugTraq-JP $B%"!<%+%$%V(B [*1] $B$X$N$$$+$J$k7A<0$N(B
  $B%O%$%Q!<%j%s%/$b>e5-$K=`$8$F$/$@$5$$!#(B
1) http://online.securityfocus.com/archive/79
---------------------------------------------------------------------------
$B$3$NOBLu$K4X$9$kHw9M(B:
$B!&$3$NOBLu$NE,MQ@.2L$K$D$$$F3t<02q<R%i%C%/$O@UG$$rIi$o$J$$$b$N$H$7$^(B
  $B$9!#(B
---------------------------------------------------------------------------
$BLu<T$+$i$N$*CN$i$;(B:
$B!&$b$7!"(Btypo $B$d8mLu$,8+$D$+$C$?>l9g!"(BBugTraq-JP $B$X(B Errata $B$H$7$F=$@5(B
  $BHG$r$4Ej9FD:$/$+!"4F=$<T(B (sakai@lac.co.jp) $B$K$*CN$i$;$/$@$5$$!#(B
  $B8e<T$N>l9g$K$O=$@5HG$r$G$-$k$@$1?WB.$KH/9T$7$^$9!#(B
---------------------------------------------------------------------------
This translation is encoded in ISO-2022-JP.

$B86HG(B:
Date: Wed, 4 Sep 2002 08:55:04 -0600 (MDT)
Message-ID: <Pine.LNX.4.43.0209040854280.6937-100000@mail.securityfocus.com>

SecurityFocus Newsletter #160
-----------------------------

This Issue Is Sponsored By: SpiDynamics

I. FRONT AND CENTER($BF|K\8lLu$J$7(B)
     1. Configuring IPSec and Ike on Solaris, Part Two
     2. Justifying the Expense of IDS, Part Two: Calculating ROI for IDS
     3. Lobbying for Insecurity
     4. When Feds are the Crackers
     5. SecurityFocus DPP Program
     6. InforwarCon 2002
II. BUGTRAQ SUMMARY
     1. Microsoft Internet Explorer Download Dialogue File Source...
     2. Microsoft Internet Explorer XML Redirect File Disclosure...
     3. PHP Mail Function ASCII Control Character Header Spoofing...
     4. Mantis Unauthorized Bug Viewing Vulnerability
     5. UTStarcom BAS-1000 Default User Accounts Vulnerability
     6. Mantis Unauthorized Project Bug List Viewing Vulnerability
     7. Blazix Special Character Handling Server Side Script...
     8. Blazix Password Protected Directory Information Disclosure...
     9. OmniHTTPD Sample Scripts Cross Site Scripting Vulnerabilities
     10. PHPReactor Style Attribute HTML Injection Vulnerability
     11. Kerio Personal Firewall Multiple SYN Packet Denial Of Service...
     12. Belkin F5D6130 Wireless Network Access Point SNMP Request...
     13. OmniHTTPD Sample Application URL Encoded Newline HTML...
     14. Gaim Manual Browser Command Arbitrary Command Execution...
     15. mIRC Scripting ASCTime Buffer Overflow Vulnerability
     17. Caldera X Server Unspecified Buffer Overflow Vulnerability
     18. GDAM123 Filename Buffer Overflow Vulnerability
     20. Ultimate PHP Board Second 'admin' Account Vulnerability
     21. Python os.py Predictable Temporary Filename Command Execution...
III. SECURITYFOCUS NEWS ARTICLES
     1. Lamo Bumped from NBC After Hacking Them
     2. Ziff pays $125K to settle security breach
     3. Spyware Trojan sends Hotmail to your boss
     4. MS in fresh digital cert flaw
IV. SECURITYFOCUS TOP 6 TOOLS
     1. checkpassword-ldap v0.1
     2. Prelude Log Monitoring Lackey v 0.8.1
     3. batemail v0.8.6
     4. GPGME 0.3.9 v0.3.9
     5. iptables-control v1.0.3
     6. l0stat v1.1

I. FRONT AND CENTER($BF|K\8lLu$J$7(B)
---------------------------------

II. BUGTRAQ SUMMARY
-------------------
1. Microsoft Internet Explorer Download Dialogue File Source Obfuscation Vulnerability
BugTraq ID: 5559
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 23 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5559
$B$^$H$a(B:

Microsoft Internet Explorer $B$K$h$k%@%&%s%m!<%I%@%$%"%m!<%0$N%f!<%6$X$N(B
$BDs<(J}K!$KLdBj$,H/8+$5$l$?!#$3$NLdBj$O(B Internet Explorer 5.0.1 $B$+$i(B 6.0
$B$^$G$K1F6A$r5Z$\$9!#(B

$BJs9p$K$h$k$H!"(BInternet Explorer $B$O!V%U%!%$%k$N%@%&%s%m!<%I!W%@%$%"%m!<(B
$B%0%\%C%/%9Fb$G%U%!%$%k$N%@%&%s%m!<%I85$r8mI=<($7$F$7$^$&2DG=@-$,$"$k!#(B
$B967b<T$O$3$NLdBj$rMxMQ$7!"$J$s$i0-0U$N$J$$%f!<%6$X?.MQ$G$-$k$H9M$($i$l(B
$B$F$$$kG[I[85$+$i%@%&%s%m!<%I$5$l$k$h$&$K8+$;$+$1!"<B:]$K$O967b<T$N4IM}(B
$B2<$K$"$k%5%$%H$+$i%U%!%$%k$r%@%&%s%m!<%I$5$;$F$7$^$&2DG=@-$,$"$k!#(B

$B$3$NLdBj$O(B Internet Explorer $B$,!V%U%!%$%k$N%@%&%s%m!<%I!W%@%$%"%m!<%0%\%C(B
$B%/%9$K$*$$$F>pJs$rI=<($9$k:]!"0U?^E*$KAH$_N)$F$i$l$?(B URL $B$X$N%O%$%Q!<%j(B
$B%s%/$N=hM}$K<:GT$9$k$?$a$K@8$8$F$$$k!#$3$N%@%$%"%m!<%0%\%C%/%9$,FCDj$N(B
$BFC<lJ8;z$r<u$1IU$1$?:]!"E,@Z$J%@%&%s%m!<%I>l=j$rI=<(ITG=$J$N$G$"$k!#(B

$B$3$NLdBj$rMxMQ$9$k967b$r4k$F$k967b<T$O!"967b$NBP>]$H$J$C$?%f!<%6$,%U%!(B
$B%$%k$r?.Mj$KCM$7$J$$F~<j85$+$i%@%&%s%m!<%I$7!"<!$$$G%$%s%9%H!<%k$7$F$7(B
$B$^$&7k2L$r>7$-!"%f!<%6$X56$N?.Mj$r;}$?$;$k2DG=@-$,$"$k!#(B
$B$J$*!"%f!<%6$O8mI=<($5$l$?%U%!%$%k$rBPOCE*$K%@%&%s%m!<%I$7!"<!$$$G<B9T(B
$B$9$kI,MW$,$"$k!#(B

$B$3$NLdBj$O(B BID 5557 Multiple Microsoft Internet Explorer Vulnerabilities
$B$H$7$F(B BID $B$,3d$jEv$F$i$l$F$$$?$,!"8=;~E@$G$O8DJL$N(B BID $B$,3d$jEv$F$i$l(B
$B$F$$$k!#(B

2. Microsoft Internet Explorer XML Redirect File Disclosure Vulnerability
BugTraq ID: 5560
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 23 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5560
$B$^$H$a(B:

Microsoft Internet Explorer $B$O967b<T$KBP$7$F(B XML $B%U%!%$%k$NFbMF$,40A4$K(B
$B3+<($5$l!"B>$N%U%!%$%k$K$D$$$F$O0lIt$,3+<($5$lF@$kLdBj$rJz$($F$$$k!#(B
$B$3$NLdBj$O(B Internet Explorer 5.0.1 $B$+$i(B 6.0 $B$^$G$K1F6A$r5Z$\$9!#(B

$B$3$NLdBj$K$h$j!"967b<T$O967bBP>]$N%7%9%F%`Fb$N4{CN$N>l=j$K3JG<$5$l$F$$(B
$B$k(B XML $B%U%!%$%k$NFbMFA4BN$rFI$_=P$;!"B>$N%U%!%$%k$K$D$$$F$O0lIt$rFI$_=P(B
$B$72DG=$G$"$k!#(B

$B$3$NLdBj$O(B Internet Explorer $B$,(B XML $B%G!<%?$rI=<($9$k:]$N(B HTML $B%G%#%l%/(B
$B%F%#%V$NITE,@Z$J<h$j07$$$KM3Mh$7$F$$$k!#$3$N%G%#%l%/%F%#%V$O;2>H$5$l$?(B
XML $B%G!<%?%=!<%9$,0[$J$k%I%a%$%sFb$N%G!<%?%=!<%9$X%j%@%$%l%/%H$5$l$F$$(B
$B$J$$$3$H$NN"$E$1$H$J$k3NG':n6H$r@5$7$/9T$C$F$$$J$$!#(B
$B$3$N$?$a!"%m!<%+%k$"$k$$$O%j%b!<%H$X$N(B HTTP $B%j%/%(%9%H$X%j%@%$%l%/%H$5(B
$B$;$k$?$a$K(B <script> $B%?%0$H(B src $BB0@-$K(B URL $B$r3d$jEv$F$k$3$H$G!"(BXML $B%(%s(B
$B%8%s$O;XDj$5$l$?;q8;$NFbMF$r=hM}$7!"FbMF$rI=<($7$F$7$^$&$N$G$"$k!#(B

$B$3$NLdBj$O0-0U$"$k(B Web $B%Z!<%8!"$"$k$$$O0-0U$"$k(B HTML $B7A<0$NEE;R%a!<%k$r(B
$B2p$7$F967b$KMxMQ2DG=$G$"$k!#(BInternet Explorer $B%(%s%8%s$rMxMQ$7$F$$$kB>(B
$B$N%"%W%j%1!<%7%g%s(B (Outlook$B!"(BMSN Explorer $B$J$I(B) $B$X$b1F6A$O5Z$V!#(B

$B$3$NLdBj$O(B BID 5557 Multiple Microsoft Internet Explorer Vulnerabilities
$B$H$7$F(B BID $B$,3d$jEv$F$i$l$F$$$?$,!"8=;~E@$G$O8DJL$N(B BID $B$,3d$jEv$F$i$l(B
$B$F$$$k!#(B

3. PHP Mail Function ASCII Control Character Header Spoofing Vulnerability
BugTraq ID: 5562
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 23 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5562
$B$^$H$a(B:

PHP $B$O(B Personal HomePage development toolkit $B$H8F$P$l!"(BPHP.net $B$h$jG[I[(B
$B$5$l$F$$$k!#$3$N%=%U%H%&%'%"$O%Q%V%j%C%/%I%a%$%s>uBV$G(B PHP Development
$B%A!<%`$K$h$C$FJ]<i$5$l$F$$$k!#(B

PHP $B$,Jz$($kLdBj$K$h$j!"%f!<%6$O2~$6$s$5$l$?%X%C%@$rMxMQ$7$F%a!<%k$rAw(B
$B?.2DG=$G$"$k!#(B

PHP $B$N4X?t(B mail() $B$O%f!<%6$+$iM?$($i$l$?CM$r==J,$K%U%#%k%?%j%s%0$7$F$$(B
$B$J$$!#$3$N$?$a!"(B ASCII $B%3!<%IFb$N@)8fJ8;z$r%f!<%6$O(B mail() $B$K0z$-EO$7!"(B
$BEE;R%a!<%k$N%X%C%@$r2~JQ2DG=$G$"$k!#$3$NLdBj$N$?$a2~$6$s$5$l$?EE;R%a!<(B
$B%k$N%X%C%@$r:n@.2DG=$G$"$j!"(BPHP $B%9%/%j%W%H$,(B mail() $B$r2p$7$F%f!<%6$+$i(B
$BM?$($i$l$?CM$r<u$1<h$k:]$KLdBj$H$J$k!#(B

$B$3$NLdBj$O%9%Q%^!<$,:9=P85$rITL@3N$K$7$?>uBV$GEE;R%a!<%k$rAw?.$9$k$?$a(B
$B$KMxMQ2DG=$G$"$k!#(B

4. Mantis Unauthorized Bug Viewing Vulnerability
BugTraq ID: 5563
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 23 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5563
$B$^$H$a(B:

Mantis $B$O(B Web $B%$%s%?%U%'!<%9$rHw$($k%P%0DI@W%7%9%F%`$G$"$k!#(B
$B$3$N%=%U%H%&%'%"$O(B PHP $B$rMxMQ$7$F3+H/$5$l!"%P%C%/%(%s%I%G!<%?%Y!<%9$H(B
$B$7$F(B MySQL $B$rMxMQ$7$F$$$k!#(B

Mantis $B$O0-0U$"$k%f!<%6$,0U?^$9$k%P%0$r;2>H2DG=$K$J$k$H9M$($i$l$k%;%-%e(B
$B%j%F%#>e$NLdBj$rJz$($F$$$k!#DL>o!"%f!<%6$OE,@Z$J%"%/%;%9%3%s%H%m!<%k$,(B
$B9T$o$l$F$$$k%P%0$N$_$r1\Mw2DG=$J>uBV$G$"$k!#(B

$B%P%0$r;2>H$9$k$?$a$KMxMQ$5$l$F$$$kMM!9$J%9%/%j%W%H$O%f!<%6MQ$N%Q!<%_%C(B
$B%7%g%s$r3NG'$7$F$$$J$$!#$3$N$?$a!"$3$l$i%9%/%j%W%H$rD>@\%f!<%6$O8F$S=P(B
$B$7!"0U?^$9$k(B Bug ID $B$r(B CGI $BMQ$N%Q%i%a!<%?$H$7$F;XDj$9$k2DG=@-$,$"$k!#(B

$BLdBj$rJz$($F$$$k$H$NJs9p$,4s$;$i$l$F$$$k%9%/%j%W%H$O0J9_$,3:Ev$9$k!#(B
view_bug_page.php
view_bug_advanced_page.php
bug_update_page.php
bug_update_advanced_page.php

$B$3$NLdBj$rMxMQ$9$k967b$K$h$j=EMW$J>pJs$N3+<($,0z$-5/$3$5$l$k2DG=@-$,$"(B
$B$k!#(B

5. UTStarcom BAS-1000 Default User Accounts Vulnerability
BugTraq ID: 5564
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 23 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5564
$B$^$H$a(B:

BAS-1000 $B$O(B UTStarcom $B$K$h$C$F@_7W!"HNGd$5$l$F$$$kB?L\E*$N9XFI<T4IM}$r(B
$B9T$&5!4o$G$"$k!#(B

$B$3$N5!4o$N%U%!!<%`%&%'%"$NLdBj$K$h$j!"G'>Z$r9T$&$3$H$J$/5!4o$N;q8;$K%"(B
$B%/%;%9$,2DG=$G$"$k$H9M$($i$l$k!#(B

BAS-1000 $BMQ$N%U%!!<%`%&%'%"$O%G%U%)%k%H%Q%9%o!<%I$rH<$&(B 4 $B$D$N%"%+%&%s(B
$B%H$rHw$($F$$$k$3$H$,H/8+$5$l$F$$$k!#$3$l$i$N$&$A(B 2 $B$D!"(Bguru $B$H(Bfield $B$O(B
$B%7%9%F%`4IM}<T$NJ];}$9$k8"8B$h$j$bF1$8$+$=$l0J>e$N8"8B$rDs6!$7$F$$$k!#(B

$B0J2<$K<($9%"%+%&%s%HL>$H%Q%9%o!<%I$NAH$_$,MxMQ$5$l$F$$$k!#(B

User	Password
field    *field
guru    *3noguru
snmp     snmp
dbase     dbase

$B$3$l$i%"%+%&%s%H$rMxMQ$7!"%j%b!<%H%f!<%6$OLdBj$rJz$($k5!4o$X4IM}<T8"8B(B
$B$G$N%"%/%;%9$,2DG=$K$J$k$H?d;!$5$l$k!#(B

6. Mantis Unauthorized Project Bug List Viewing Vulnerability
BugTraq ID: 5565
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 23 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5565
$B$^$H$a(B:

Mantis $B$O(B Web $B%$%s%?%U%'!<%9$rHw$($k%P%0DI@W%7%9%F%`$G$"$k!#(B
$B$3$N%=%U%H%&%'%"$O(B PHP $B$rMxMQ$7$F3+H/$5$l!"%P%C%/%(%s%I%G!<%?%Y!<%9$H$7(B
$B$F(B MySQL $B$rMxMQ$7$F$$$k!#(B

Mantis $B$O0-0U$"$k%P%0DI@W%7%9%F%`$N%f!<%6$,%"%/%;%9@)8B$,3]$1$i$l$F$$$k(B
$B%W%m%8%'%/%H$KBP$7$F!"G'>Z$r9T$&$3$H$J$/%"%/%;%92DG=$K$J$k$H?d;!$5$l$k(B
$BLdBj$rJz$($k5?$$$,$"$k!#$3$NLdBj$OFCDj$N%f!<%6$X%P%0$N@5Ev@-$r@)8BIU$-(B
$B$G1\Mw$5$;$k$?$a!"$3$N%=%U%H%&%'%"$rMxMQ$7$F$$$kAH?%$KBP$7$F$O%;%-%e%j(B
$B%F%#$K4X$o$kN10U;v9`$G$"$k$H9M$($i$l$k!#(B

$B$I$N%W%m%8%'%/%H$K4X$7$F$b1\Mw8"$r;}$?$J$$%f!<%6$,!"A4$F$N8x3+:Q$_$HHs(B
$B8x3+$N%W%m%8%'%/%H$K4X$9$k%P%0(B View Bugs $B%Z!<%8$+$i1\Mw2DG=$G$"$k!#(B

$B%"%/%;%9$9$k$?$a$N%Q!<%_%C%7%g%s$r;}$?$J$$$O$:$N0-0U$"$k%f!<%6$,!"$3$N(B
$BLdBj$r%7%9%F%`Fb$N0U?^$9$k%P%0$K4X$9$k%5%^%j>pJs$r1\Mw$9$k$?$a$KMxMQ2D(B
$BG=$G$"$k!#$7$+$7!"$3$NLdBj$rMxMQ$9$k967b$rMxMQ$7$F%P%0$N>\:Y>pJs$NA4BN(B
$B$r1\Mw$9$k$3$H$OIT2DG=$G$"$k!#(B

7. Blazix Special Character Handling Server Side Script Information Disclosure Vulnerability
BugTraq ID: 5566
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 24 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5566
$B$^$H$a(B:

Blazix $B$O%U%j!<$GMxMQ2DG=$J!"(BJava $B$G3+H/$5$l$?%*!<%W%s%=!<%9$N(B Web $B%5!<(B
$B%P$G$"$k!#$3$N%=%U%H%&%'%"$O(B Linux $B$*$h$S(B Microsoft Windows $B$GMxMQ2DG=(B
$B$G$"$k!#(B

$B$3$N%=%U%H%&%'%"$,Jz$($kLdBj$K$h$j!"%j%b!<%H%f!<%6$O=EMW$J>pJs$X$N%"%/(B
$B%;%98"$r<hF@2DG=$G$"$k!#(B

Blazix $B$OFCDj$NFC<lJ8;z$,%j%/%(%9%H$KIU$12C$($i$l$k:]!"E,@Z$K$=$l$i$r<h(B
$B$j07$($J$$$N$G$"$k!#FC<lJ8;z$r(B Web $B%5!<%P$KBP$9$k(B HTTP $B%j%/%(%9%H$KIU$1(B
$B2C$($k$3$H$K$h$j!"%f!<%6$O%5!<%P%5%$%I%9%/%j%W%H$N%=!<%9%3!<%I$K%"%/%;(B
$B%92DG=$G$"$k!#$3$l$O!">pJs$N3+<($r>7$/$H6&$K!"%7%9%F%`$KBP$7$F$5$i$J$k(B
$B967b$r4k$F$k:]$N>pJs$rF~<j$9$k$?$a$K@x:_E*$KMxMQ2DG=$G$"$k!#(B

$B%f!<%6$,(B HTTP $B%j%/%(%9%H$r$3$N(B Web $B%5!<%P$XAw?.$9$k:]!"$=$N8e$m$K(B + $B5-(B
$B9f$^$?$O%P%C%/%9%i%C%7%e$,IU$1$i$l$F$$$k>l9g$K$O!"%5!<%P$OM=B,ITG=$J5s(B
$BF0$r<($92DG=@-$,$"$k!#Js9p$K$h$k$H!"$3$N<o$N5-9f$,(B .jsp $B7A<0$r<($9%U%!(B
$B%$%kL>$N8e$m$KIU$12C$($i$l$F$$$k>l9g!"%U%!%$%k$NFbMF$O3+<($5$l$k$H$N$3(B
$B$H$G$"$k!#(B

8. Blazix Password Protected Directory Information Disclosure
Vulnerability
BugTraq ID: 5567
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 25 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5567
$B$^$H$a(B:

Blazix $B$O%U%j!<$GMxMQ2DG=$J!"(BJava $B$G3+H/$5$l$?%*!<%W%s%=!<%9$N(B Web $B%5!<(B
$B%P$G$"$k!#$3$N%=%U%H%&%'%"$O(B Linux $B$*$h$S(B Microsoft Windows $B$GMxMQ2DG=(B
$B$G$"$k!#(B

$B$3$N%=%U%H%&%'%"$,Jz$($kLdBj$K$h$j!"%j%b!<%H%f!<%6$O=EMW$J>pJs$X$N%"%/(B
$B%;%98"$r<hF@2DG=$G$"$k!#(B

Blazix $B$OFCDj$NJ8;zNs$,(B HTTP $B%j%/%(%9%H$KIU$12C$($i$l$F$$$k:]!"$=$l$i(B
$B$r4^$`%j%/%(%9%H$rE,@Z$K<h$j07$($J$$LdBj$rJz$($F$$$k!#FC<lJ8;z$r$3$N(B Web
$B%5!<%P$KBP$9$k(B HTTP $B%j%/%(%9%H$XIU$12C$($k$3$H$G!"%f!<%6$O%Q%9%o!<%I$G(B
$BJ]8n$5$l$?%G%#%l%/%H%j$NFbMF$rF~<j2DG=$G$"$k!#$3$l$O!">pJs$N3+<($r>7$/(B
$B$H6&$K!"%7%9%F%`$KBP$7$F$5$i$J$k967b$r4k$F$k:]$N>pJs$rF~<j$9$k$?$a$K@x(B
$B:_E*$KMxMQ2DG=$G$"$k!#(B

$B%f!<%6$,(B HTTP $B%j%/%(%9%H$r$3$N(B Web $B%5!<%P$XAw?.$9$k:]!"$=$N8e$m$K(B + $B5-(B
$B9f$^$?$O%P%C%/%9%i%C%7%e$,IU$1$i$l$F$$$k>l9g$K$O!"%5!<%P$OM=B,ITG=$J5s(B
$BF0$r<($92DG=@-$,$"$k!#Js9p$K$h$k$H!"$3$N<o$N5-9f$,%Q%9%o!<%I$GJ]8n$5$l(B
$B$?%G%#%l%/%H%jL>$N8e$m$KIU$12C$($i$l$F$$$k>l9g!"%G%#%l%/%H%j$NFbMF$O3+(B
$B<($5$l$k$H$N$3$H$G$"$k!#(B

9. OmniHTTPD Sample Scripts Cross Site Scripting Vulnerabilities
BugTraq ID: 5568
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 26 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5568
$B$^$H$a(B:

OmniHTTPD $B$O(B Microsoft Windows $B4D6-$GF0:n$9$k(B Web $B%5!<%P$G$"$k!#(B
OmniHTTPD $B$O(B Server Side Includes (SSI) $B$*$h$S(B PHP $B8@8l$G:n@.$5$l$?(B CGI
$B%9%/%j%W%H$r4^$`F0E*$J(B Web $B%3%s%F%s%D@8@.$rL\E*$H$9$kMM!9$J3HD%5!G=$r(B
$BHw$($F$$$k!#(B

OmniHTTPD $B$KF1:-$5$l$F$$$kJ#?t$N%5%s%W%k%9%/%j%W%H$K$O%/%m%9%5%$%H%9%/(B
$B%j%W%F%#%s%0$NLdBj$,H/8+$5$l$F$$$k!#LdBj$rJz$($k%9%/%j%W%H$O(B test.shtml$B!"(B
test.php $B$,5s$2$i$l$k!#(B

$B967bBP>]$N%f!<%6$rLdBj$rJz$($k%9%/%j%W%H$N$$$:$l$+(B 1 $B$D$X0-0U$"$k%O%$%Q!<(B
$B%j%s%/$rMxMQ$7$FC)$i$;$k$3$H$G!"$3$NLdBj$rMxMQ$9$k967b$r4k$F$k2DG=@-$,(B
$B$"$k!#0-0U$"$k%O%$%Q!<%j%s%/$,C)$i$l$k:]!"967b<T$,;XDj$7$?%3!<%I$OLdBj(B
$B$rJz$($k%=%U%H%&%'%"$r2TF0$5$;$F$$$k%5%$%H$HF13J$N%;%-%e%j%F%#%3%s%F%-(B
$B%9%H$G<B9T$5$l$k$H?d;!$5$l$k!#(B

$B$3$N<o$NLdBj$O!"%/%C%-!<>pJs$NC%<h!"$b$7$/$OB>$N(B Web $B$r2p$7$?967b$r4k$F(B
$B$k$?$a$KMxMQ$5$l$k2DG=@-$,$"$k!#(B

10. PHPReactor Style Attribute HTML Injection Vulnerability
BugTraq ID: 5569
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 24 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5569
$B$^$H$a(B:

php(Reactor) $B$O!"(BWeb $B%5%$%H$NJ]<i:n6HMQ$K@_7W$5$l$?(B Web $B%"%W%j%1!<%7%g(B
$B%s$NE}9g%7%9%F%`$G$"$k!#(BMicrosoft Windows $B$K2C$(!"KX$I$N(B Linux $B$*$h$S(B
$BB?$/$N(B UNIX $B$K$*$$$FF0:n$9$k!#(B

$B$3$N%=%U%H%&%'%"$OMM!9$JF~NO%U%#!<%k%I(B ($B%a%C%;!<%8$NK\J8$d%W%m%U%!%$%k(B
$BF~NOMQ%U%#!<%k%I(B) $B$XF~NO$5$l$?(B HTML $B$r==J,$K%U%#%k%?%j%s%0$7$F$$$J$$!#(B
$B$3$N$?$a!"0U?^E*$K(B HTML $B$d%9%/%j%W%H$r%U%#!<%k%I$XCmF~2DG=$G$"$k!#(B
$BFC$K!"(BSTYLE $BB0@-$G$O$$$+$J$k(B HTML $B%?%0$K$D$$$F$bA4$/%U%#%k%?%j%s%0$5$l(B
$B$J$$$N$G$"$k!#$3$NJ}K!$G0U?^E*$KCmF~$5$l$?(B HTML $B$d%9%/%j%W%H$OLdBj$rJz(B
$B$($k%=%U%H%&%'%"$r2TF0$5$;$F$$$k(B Web $B%5%$%H$K%"%/%;%9$7$?%f!<%6$N%V%i%&(B
$B%6$GI=<($5$l$k!#(B

$B967b<T$O0U?^$9$k(B HTML $B$d%9%/%j%W%H$rLdBj$rJz$($k%=%U%H%&%'%"$r2TF0$5$;(B
$B$F$$$k(B Web $B%5%$%H$K%"%/%;%9$9$k%f!<%6$N(B Web $B%V%i%&%6>e$G<B9T$5$;$k$?$a(B
$B$K!"@x:_E*$K$3$N>u67$rMxMQ$9$k967b$r4k$F$k62$l$,$"$k!#967b<T$K$h$jM?$((B
$B$i$l$?%3!<%I$O!"LdBj$rJz$($k(B Web $B%5%$%H$HF13J$N%3%s%F%-%9%H$G<B9T$5$l$k!#(B

11. Kerio Personal Firewall Multiple SYN Packet Denial Of Service Vulnerability
BugTraq ID: 5570
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 26 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5570
$B$^$H$a(B:

Kerio Personal Firewall (KPF) $B$O(B Microsoft Windows $B>e$GF0:n$9$k%Q!<%=(B
$B%J%k%U%!%$%"%&%)!<%k@=IJ$G$"$k!#(B

KPF $B$NFCDj$N%P!<%8%g%s$K$*$$$F!"(BDoS $B>uBV$r>7$/LdBj$,Js9p$5$l$F$$$k!#(B
$BBgNL$N(B SYN $B%Q%1%C%H$rC10l$NAw?.85$+$i<u$1<h$k$H!"%U%!%$%"%&%)!<%k$N%W%m(B
$B%;%9$OMxMQ2DG=$JA4$F$N(B CPU $B;q8;$r>CHq$7?T$/$7!"LdBj$rJz$($k%7%9%F%`$O40(B
$BA4$K5!G=$rDd;_$9$k!#DL>oF0:n$X$NI|5l$N$?$a$K$O!":F5/F0$,I,MW$G$"$k$H?d;!(B
$B$5$l$k!#(B

$BJs9p$K$h$k$H!"$3$N967b<T$O%U%!%$%"%&%)!<%k$NF0:n@_Dj$K4X78$J$/!"$3$N96(B
$B7b$,<B9T2DG=$G$"$k!#(B $B8!>Z4D6-$G$O!"(B300 $B8D$+$i(B 500 $B8D$N(B SYN $B%Q%1%C%H$rAw(B
$B?.$9$l$P!"$3$N>uBV$r0z$-5/$3$9$K$O==J,$G$"$k$3$H$,Js9p$5$l$F$$$k!#(B

12. Belkin F5D6130 Wireless Network Access Point SNMP Request Denial Of Service Vulnerability
BugTraq ID: 5571
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 26 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5571
$B$^$H$a(B:

Belkin F5D6130 $BL5@~%M%C%H%o!<%/%"%/%;%9%]%$%s%H$K$O!"(BDoS $B$r0z$-5/$3$9Ld(B
$BBj$,Js9p$5$l$F$$$k!#(B

$BJs9p$K$h$k$H!"O"B3$7$?(B SNMP $B%j%/%(%9%H$rAH$_N)$F$k$3$H$K$h$j!"$3$NLdBj(B
$B$rMxMQ$9$k967b$r9T$&$3$H$,2DG=$G$"$k!#$J$*!"$3$N:]$K@5Ev$J%3%_%e%K%F%#(B
$BL>$OMW5a$5$l$J$$!#>/$J$/$H$b(B 1 $B$D$N(B SNMP $B%H%i%C%W$r%V%m!<%I%-%c%9%H$9$k(B
$B$3$H$K$h$j!"$3$N5!4o$O$=$l$>$l$N%j%/%(%9%H$KBP$7$F1~Ez$9$k!#(B

SNMP $B%j%/%(%9%H$,Aw?.$5$l$?:]!"$3$N5!4o$O$5$i$J$k%j%/%(%9%H$KBP$7$F1~Ez(B
$BITG=$J>uBV$K4Y$k!#$^$?!"A4$F$NL5@~$r2p$9$k%3%M%/%7%g%s$b@ZCG$5$l!"?75,(B
$B$N%3%M%/%7%g%s$N3NN)$bITG=$K$J$j!"7k2L$H$7$FL5@~(B LAN $B5!4o$N@5Ev$J%f!<%6(B
$B$X$N%5!<%S%9$rAK32$9$k$3$H$K$J$k!#(B

$BFCDj$N>u672<$K$*$$$F!"5!4o$O%$!<%5%M%C%H$H$N%$%s%?%U%'!<%9$X$N1~Ez$b9T(B
$B$($J$/$J$k$H?d;!$5$l!"$$$+$J$k5!4o$N4IM}<jCJ$r$b<:$&$3$H$K$J$k!#(B
$B$3$N>l9g!"DL>oF0:n$X$NI|5l$K$"$?$C$F$O!"<jF0$K$h$k5!4o$N:F5/F0$,I,MW$G(B
$B$"$k!#(B

13. OmniHTTPD Sample Application URL Encoded Newline HTML Injection Vulnerability
BugTraq ID: 5572
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 26 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5572
$B$^$H$a(B:

OmniHTTPD $B$O(B Microsoft Windows $B4D6-$GF0:n$9$k(B Web $B%5!<%P$G$"$k!#(B
OmniHTTPD $B$O(B Server Side Includes (SSI) $B$*$h$S(B PHP $B8@8l$G:n@.$5$l$?(B
CGI $B%9%/%j%W%H$r4^$`F0E*$J(B Web $B%3%s%F%s%D@8@.$rL\E*$H$9$kMM!9$J3HD%5!G=(B
$B$rHw$($F$$$k!#(B

OmniHTTPD $B$KF1:-$5$l$F$$$k%5%s%W%k%9%/%j%W%H(B /cgi-bin/redir.exe $B$K$O%/(B
$B%m%9%5%$%H%9%/%j%W%F%#%s%0$NLdBj$,H/8+$5$l$F$$$k!#Js9p$K$h$k$H!"967b<T(B
$B$O2~9T(B (%0D) $B$r(BURL $B%(%s%3!<%I$7!"0-0U$"$k(B HTML $B$rCmF~2DG=$G$"$k!#LdBj$r(B
$BJz$($k%=%U%H%&%'%"$,0-0U$"$k(B HTTP $B%j%/%(%9%H$r<u$1<h$C$?>l9g!"967b<T$K(B
$B$h$C$FM?$($i$l$?0-0U$"$k%3!<%I$,4^$^$l$k>uBV$G(B HTTP $B$N(B 302 $B%9%F!<%?%9%3!<(B
$B%I1~Ez$,JV$5$l$F$7$^$&$N$G$"$k!#(B

$B967bBP>]$N%f!<%6$rLdBj$rJz$($k(B CGI $B$X$N0-0U$"$k%O%$%Q!<%j%s%/$rMxMQ$7$F(B
$BC)$i$;$k$3$H$G!"$3$NLdBj$rMxMQ$9$k967b$r4k$F$k2DG=@-$,$"$k!#0-0U$"$k%O(B
$B%$%Q!<%j%s%/$,C)$i$l$k:]!"967b<T$,;XDj$7$?%3!<%I$OLdBj$rJz$($k%=%U%H%&%'(B
$B%"$r2TF0$5$;$F$$$k%5%$%H$HF13J$N%;%-%e%j%F%#%3%s%F%-%9%H$G<B9T$5$l$k$H(B
$B?d;!$5$l$k!#(B

$B$3$N<o$NLdBj$O!"%/%C%-!<>pJs$NC%<h!"$b$7$/$OB>$N(B Web $B$r2p$7$?967b$r4k$F(B
$B$k$?$a$KMxMQ$5$l$k2DG=@-$,$"$k!#(B

14. Gaim Manual Browser Command Arbitrary Command Execution Vulnerability
BugTraq ID: 5574
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 27 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5574
$B$^$H$a(B:

Gaim $B$O!"B?$/$N%W%m%H%3%k$r%5%]!<%H$7$?%$%s%9%?%s%H%a%C%;%s%8%c!<%/%i%$(B
$B%"%s%H$G$"$k!#$3$N%"%W%j%1!<%7%g%s$O!"(BUNIX $B$d(B Linux $B$GF0:n2DG=$G$"$k!#(B

Gaim $B$N%f!<%6$O(B Manual $B%V%i%&%6%*%W%7%g%s$r@_Dj2DG=$G$"$k!#(BURL $B$X$N%O%$(B
$B%Q!<%j%s%/$r%$%s%9%?%s%H%a%C%;!<%8$r2p$7$F<u?.$7$?:]!"%f!<%6$OFCDj$N%"(B
$B%W%j%1!<%7%g%s$X(B URL $B$r0z$-EO$9$?$a$K$3$N%j%s%/$r%/%j%C%/2DG=$G$"$k!#(B

$B$7$+$7!"$3$N:]$K0z$-EO$5$l$k(B URL $B$X$N==J,$J%U%#%k%?%j%s%0$O9T$o$l$F$$$J(B
$B$$!#$3$N$?$a!"0-0U$"$k%$%s%9%?%s%H%a%C%;!<%8$K$O(B ; $B$d(B | $B$J$I$N%7%'%kMQ(B
$B$N%a%?%-%c%i%/%?$,4^$^$l$F$$$k2DG=@-$,$"$j!"%V%i%&%6$r8F$S=P$9$?$a$N%7%'(B
$B%k%3%^%s%I$,0z$-EO$5$l$k:]!"$3$N<o$NJ8;zNs$K$h$j!"(BURL $B$XIU$12C$($i$l$?(B
$B%3%^%s%I72$N<B9T$,2DG=$K$J$k!#(B

$B0z$-EO$5$l$?%3%^%s%I$O(B Gaim $B$r<B9T$7$F$$$k%f!<%6$N8"8B$G<B9T$5$l$k!#(B
$B$3$NLdBj$rMxMQ$9$k967b$K$h$j!"967b<T$OLdBj$rJz$($k%7%9%F%`$N%m!<%+%k$N(B
$B;q8;$X$N%"%/%;%9$,2DG=$K$J$k$H9M$($i$l$k!#(B

15. mIRC Scripting ASCTime Buffer Overflow Vulnerability
BugTraq ID: 5576
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B:Aug 27 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5576
$B$^$H$a(B:

mIRC $B$O(B Microsoft Windows $B8~$1$K:n$i$l$?(B IRC $B%W%m%H%3%k$rMxMQ$9$k%A%c%C(B
$B%H%/%i%$%"%s%H$G$"$k!#(BmIRC $B$G$O%9%/%j%W%H8@8l$,Ds6!$5$l$F$$$k!#(B

mIRC $B%9%/%j%W%H8@8l$NCf$N4X?t!"<1JL;R(B $asctim $B$G%P%C%U%!%*!<%P!<%U%m!<(B
$B$,@8$8$k$3$H$,Js9p$5$l$F$$$k!#$3$N4X?t$KBg$-$$%5%$%:$N=q<0;XDj;R$r0z$-(B
$BEO$7$?>l9g!"%W%m%;%9$K3d$jEv$F$i$l$?%a%b%jFbMF$OGK2u$5$l$k!#Js9p$K$h$k(B
$B$H!"$3$NLdBj$O(B mIRC $B$r2TF0$5$;$F$$$k%f!<%6$N8"8B$GG$0U$N%3!<%I$r<B9T$9(B
$B$k$?$a$K0-MQ$5$l$k2DG=@-$,$"$k!#(B

$B$3$NLdBj$rMxMQ$9$k967b$OLdBj$rJz$($k4X?t$X?.Mj$G$-$J$$CM$r=PNO$9$k%9%/(B
$B%j%W%H$K0MB8$7$F$$$k$H9M$($i$l$k!#Js9p$K$h$k$H!"(BmIRC $B$KF1:-$5$l$F$$$k%G(B
$B%U%)%k%H$GDs6!$5$l$k%9%/%j%W%H72$O967b$r2DG=$K$9$kJ}K!$G$O(B $asctime $B4X(B
$B?t$rMxMQ$7$F$$$J$$!#$7$+$7!"Bh;0<T$K$h$k%9%/%j%W%H$,967b<T$,967b$7F@$k(B
$B<jN)$F$H$J$k2DG=@-$,$"$k!#(B

16. Caldera X Server External Program Privileged Invocation Weakness
BugTraq ID: 5575
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B:Aug 27 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5575
$B$^$H$a(B:

Caldera $B$N(B X $B%5!<%P$N<BAu$O8"8B%l%Y%k$r9_3J$5$;$:$K30It%3%^%s%I$r8F$S(B
$B=P$7$F$$$k!#%m!<%+%k$N967b<T$O$3$NLdBj$r0-MQ$7!"(BXServer $B$r8"8B>:3J$rH<(B
$B$&%W%m%0%i%`$r8F$S=P$9$N$KMxMQ$9$k2DG=@-$,$"$k!#(B

$B$3$NLdBj$O(B XKEYBOARD $B3HD%$rM-8z2=$7$?!"(BX11R6.3 $B$KM3Mh$9$k(B X $B%5!<%P$KB8(B
$B:_$7$F$$$k$3$H$,Js9p$5$l$F$$$k!#(BXKEYBOARD (XKB) $B3HD%$OB>$N<oN`$N%-!<%\!<(B
$B%IG[CV$H(B X $B%5!<%P$rAH$_9g$o$;$k$?$a$KMxMQ$5$l$k!#(B

$B$3$NLdBj$O(B xkbcomp $B$d$=$l$K4XO"$9$k%f!<%F%#%j%F%#$r8F$S=P$9:]$K!"8"8B$r(B
$B9_3J$5$;$J$$(B X $B%5!<%P$K$h$C$F0z$-5/$3$5$l$k!#(B-xkbdir $B%*%W%7%g%s$rH<$C$F(B
X $B%5!<%P$r8F$S=P$9$3$H$,2DG=$G$"$j!"$3$N:](B XKB $B%-!<%\!<%I@_Dj$r%3%s%Q%$(B
$B%k$9$k$?$a$KMxMQ$5$l$k(Bxkbcomp $B%f!<%F%#%j%F%#$,5/F0$5$l$k!#(B

X $B%5!<%P$O(B xkbcomp $B$r(B popen() $B$"$k$$$O(B system() $B$rMQ$$!"%;%-%e%"$G$O$J(B
$B$$J}K!$G8F$S=P$7$F$$$k!#(B-xkbdir $B%*%W%7%g%s$K%7%'%k$G2r<a$5$l$k%a%?%-%c(B
$B%i%/%?$,4^$^$l$F$$$k>l9g!"$=$l$i$O(B xkbcomp $B%f!<%F%#%j%F%#$N8"8B$G2r<a$5(B
$B$l!"<B9T$5$l$F$7$^$&$N$G$"$k!#(B
$B$3$l$,0l35$KLdBj$H$O8@$($J$$>l9g$G$"$C$?$H$7$F$b!"(Bxkbcomp $B$O(B X $B%5!<%P$N(B
$B%W%m%;%9$,8"8B$r9_3J$5$;$kA0$K<B9T$5$l$k$?$a!"A[Dj$7F@$k7k2L$H$7$F(B xkbcomp
$B$r8F$S=P$7$?%f!<%68"8B$G%3!<%I$N<B9T$,0z$-5/$3$5$l$k$H?d;!$5$l$k!#(B

$B$3$NLdBj$O%m!<%+%k$N967b<T$K$h$j8"8B$N>:3J$rH<$&G$0U$N%3%^%s%I$r<B9T$9(B
$B$k$?$a$K0-MQ$5$l$k2DG=@-$,$"$k!#F1MM$NLdBj$,%"%W%j%1!<%7%g%sCf$KB8:_$9(B
$B$k>l9g!"$3$NLdBj$O(B X $B%5!<%P$K$h$j<B9T$5$l$?B>$N%f!<%F%#%j%F%#$r2p$7$?%3!<(B
$B%I$N<B9T$r2DG=$K$9$k$H9M$($i$l$kE@$K$D$$$F$ON10U$9$Y$-$G$"$k!#(B

17. Caldera X Server Unspecified Buffer Overflow Vulnerability
BugTraq ID: 5577
$B%j%b!<%H$+$i$N:F8=@-(B: $BL$>\(B
$B8xI=F|(B:Aug 27 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5577
$B$^$H$a(B:

Caldera $B$N(B X $B%5!<%P$N<BAu$K$O%P%C%U%!%*!<%P!<%U%m!<$NLdBj$,Js9p$5$l$F$$(B
$B$k!#(B

$B$3$NLdBj$NK\<A$O8=:_L@3N$G$O$J$/!"8=:_$N$H$3$m$5$i$J$k>pJs$O8x3+$5$l$F(B
$B$$$J$$!#(B

$BJs9p$K$h$k$H$3$NLdBj$,%P%C%U%!%*!<%P!<%U%m!<$KM3Mh$7$F$$$k8B$j!"967b<T(B
$B$O(B X $B%5!<%P$K3d$jEv$F$i$l$?%a%b%j$rGK2u$7!"967b<T$K$h$C$FM?$($i$l$?0-0U(B
$B$"$k%3!<%I$r<B9T$9$k9b$$2DG=@-$,$"$k!#(B
$B$I$N<B9T$5$l$k%3!<%I$b(B X $B%5!<%P%W%m%;%9$N8"8B$G<B9T$5$l$k2DG=@-$,$"$k!#(B

18. GDAM123 Filename Buffer Overflow Vulnerability
BugTraq ID: 5578
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B:Aug 24 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5578
$B$^$H$a(B:

GDAM123 $B$O(B GDAM real-time digital DJ mixing software $B%Q%C%1!<%8$KF1:-$5(B
$B$l$F$$$k%3%^%s%I%i%$%s$+$i<B9T$5$l$k(B MP3 $B%W%l%$%d!<$G$"$k!#(B
GDAM $B$O(B UNIX $B$*$h$SMM!9$J(B Linux $B$GF0:n$9$k!#(B

$BD9$$%U%!%$%kL>$r07$C$?:]!"(BGDAM123 $B%W%l!<%d!<$O%P%C%U%!%*!<%P!<%U%m!<$r(B
$B@8$8$k5?$$$,$"$k!#%U%!%$%kL>$O%3%^%s%I%i%$%s$r2p$7$F%=%U%H%&%'%"$K0z$-(B
$BEO$5$l!"%=%U%H%&%'%"FbIt$G$O(B strcpy() $BMQ$$$k=hM}$GMxMQ$5$l$F$$$k!#(B1024
$B%P%$%H$rD6$($kD9$5$N%U%!%$%kL>$rM?$($i$l$k$3$H$K$h$j!"7k2L$H$7$F%9%?%C(B
$B%/Fb$NCM$NGK2u$r>7$/%P%C%U%!%*!<%P!<%U%m!<$r@8$8$k2DG=@-$,$"$k!#(B
$B%9%?%C%/Fb$NCM!J%j%?!<%s%"%I%l%9$J$I!K$O967b<T$,M?$($kCM$K$h$C$FGK2u2D(B
$BG=$G$"$k>l9g!"0U?^$9$k%3!<%I$,<B9T2DG=$G$"$k!#(B

$BFCDj$N>u672<$G!"0lIt$N%G%P%$%9$X$N%"%/%;%9$,I,MW$G$"$k>l9g!"$3$N%=%U%H(B
$B%&%'%"$O$h$jDc$$8"8B$N%f!<%6$G$"$C$F$b<B9T2DG=$K$9$k$?$a$K!"(Bsetuid root
$B$H$7$F%$%s%9%H!<%k$5$l$k2DG=@-$,$"$k!#$3$N$h$&$J>u67$G$O!"%P%C%U%!%*!<(B
$B%P!<%U%m!<$OG$0U$N%3!<%I$N<B9T$rMxMQ$7!"$h$j9b0L$N8"8B$NC%<h$r4k$F$k$?(B
$B$a$KMxMQ$5$l$k2DG=@-$,$"$k!#(B

19. Yahoo Instant Messenger Signed Content Weakness
BugTraq ID: 5579
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 27 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5579
$B$^$H$a(B:

Yahoo Instant Messenger $B$O(B Yahoo $B$+$iG[I[$5$l$F$$$k(B Windows $B$GMxMQ2DG=(B
$B$J%$%s%9%?%s%H%a%C%;%s%8%c!<%/%i%$%"%s%H$G$"$k!#(B

Yahoo Instant Messenger $B$N%$%s%9%H!<%i$K$O!"967b<T$,$3$N%$%s%9%H!<%i$r(B
$B0-0U$"$k%=%U%H%&%'%"$rLdBj$rJz$($k%7%9%F%`$K%$%s%9%H!<%k$9$k$?$a$KMxMQ(B
$B$9$k$H?d;!$5$l$kLdBj$,B8:_$9$k$3$H$,H/8+$5$l$F$$$k!#$3$N%$%s%9%H!<%i$O(B
HTTP $B$rMxMQ$7$F$*$j!"%$%s%9%H!<%iMQ$K=pL>:Q$_$NFbMF$rMxMQ$9$k$h$&$K$O(B
$B$J$C$F$$$k$b$N$N!"(BYahoo $B$+$i%@%&%s%m!<%I$5$l$?%Q%C%1!<%8$N=pL>$r8!>Z$7(B
$B$F$$$J$$$N$G$"$k!#(B

$B$3$NLdBj$rMxMQ$9$k967b$r9T$&$?$a$K$O!"967b<T$O967bBP>]$N%3%s%T%e!<%?$+(B
$B$i;2>H2DG=$JHO0O$K0LCV$9$k(B a19.g.a.yimg.com $B$H$$$&%[%9%HL>$N%3%s%T%e!<(B
$B%?$r;YG[2<$KCV$+$M$P$J$i$J$$!#$3$N>u67$O(B DNS $B%-%c%C%7%e>pJs1x@w$d(B DNS
$B>pJs$N>h$C<h$j$r4^$`$$$/$D$+$N4{CN$N5;K!$rMQ$$$F:n$j=P$9$3$H$,2DG=$G$"(B
$B$k$H?d;!$5$l$k!#(B

20. Ultimate PHP Board Second 'admin' Account Vulnerability
BugTraq ID: 5580
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: Aug 27 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5580
$B$^$H$a(B:

Ultimate PHP Board $B$O%U%j!<$GMxMQ2DG=$J!"(BPHP $B$G:n@.$5$l$?%*!<%W%s%=!<%9(B
$B$NEE;R7G<(HD$G$"$k!#$3$N%=%U%H%&%'%"$O(B UNIX$B!"(BLinux$B!"$=$7$F(B Microsoft Windows
$B$GF0:n2DG=$G$"$k!#(B

Ultimate PHP Board $B$O%f!<%6$r:.F1$5$;$k2DG=@-$,$"$kL>A0$NEPO?$rKI;_$7$J(B
$B$$!#(B

$BFCDj$N>u672<$K$*$$$F!"EE;R7G<(HD$X(B 'Admin' $B%f!<%6$H:.F1$5$l$k2DG=@-$N$"(B
$B$k%"%+%&%s%H$rEPO?2DG=$G$"$k$H?d;!$5$l$k!#(BUltimate PHP Board $B$O(B 'admin'
$B%"%+%&%s%H$NEPO?$rKI;_$7$J$$!#(B'admin' $B%"%+%&%s%H$O7G<(HD$NDL>o$N%a%s%P!<(B
$B%"%+%&%s%H$G$"$k>e$K!"(B'Admin' $B%"%+%&%s%H$OEE;R7G<(HD$N4IM}<T$N%"%+%&%s(B
$B%H$G$"$k!#$3$l$O%f!<%6$,4IM}%f!<%6$N$U$j$r$9$k$?$a$K!"%=!<%7%c%k%(%s%8(B
$B%K%"%j%s%0$rMxMQ$9$k967b$r9T$&Cf$G!"(B'admin' $B%"%+%&%s%H$r;HMQ$9$k2DG=@-(B
$B$,$"$k!#(B

21. Python os.py Predictable Temporary Filename Command Execution Vulnerability
BugTraq ID: 5581
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: Aug 28 2002 12:00AM
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/5581
$B$^$H$a(B:

python $B$O%*!<%W%s%=!<%9$N%*%V%8%'%/%H;X8~$N%W%m%0%i%_%s%08@8l$G$"$k!#(B

$BJs9p$K$h$k$H!"(Bpython $B$N$$$/$D$+$N%P!<%8%g%s$O%;%-%e%"$G$O$J$$J}K!$G0l;~(B
$BE*$KMxMQ$5$l$k%U%!%$%k$r@8@.$7$F$$$k!#LdBj$O(B os.py $B%i%$%V%i%j$K4^$^$l$F(B
$B$$$k(B os._execvpe $B4X?t$NCf$G@8$8$k!#(B

$BJs9p$K$h$k$H!"$3$NLdBj$rMxMQ$9$k967b$,@.8y$7$?>l9g!"G$0U$N%3!<%I$r<B9T(B
$B$9$k7k2L$r>7$/2DG=@-$,$"$k!#(B

$B$3$NLdBj$N:,Dl$r$J$9;vJA$O8=:_$N$H$3$mL@$i$+$G$O$J$/!"$5$i$J$k>\:Y$K$D(B
$B$$$F$b8=;~E@$G$O8x3+$5$l$F$$$J$$!#(B

$BJs9p$K$h$k$H!"(BPython 2.3 $B$O$3$NLdBj$N1F6A$r<u$1$J$$!#(B

III. SECURITYFOCUS NEWS AND COMMENTARY
--------------------------------------
1. Lamo Bumped from NBC After Hacking Them
$BCx<T(B:  Kevin Poulsen, SecurityFocus

NBC $B7ONs$GKhHUJ|Aw$5$l$F$$$k%K%e!<%9HVAH(B NBC Nightly News $B$GM-MQ$J5;G=(B
$B$r;}$A9g$o$;$F$$$k%O%C%+!<$,5;G=$r%+%a%i$K8~$+$C$FHdO*$7$?$,!"K!L3C4Ev(B
$B<T$OH`$,(B NBC $B7ONs$,J]M-$9$k%7%9%F%`$r%/%i%C%/$9$k:]$KJ|1G$rCf;_$5$;$?$N(B
$B$G$"$k!#(B

http://online.securityfocus.com/news/595

2. Ziff pays $125K to settle security breach
$BCx<T(B: John Leyden, The Register

Web $B%5%$%HFb$K3JG<$5$l$F$$$k8\5R$N%/%l%8%C%H%+!<%I>pJs$N>\:Y$rO31L$7$?(B
$B=PHG6H<T$G$"$k(B Ziff-Davis $B$O!"5!L)J]8n0cH?$K$h$jE,MQ$5$l$?K!E*A<CV$K=*(B
$B;_Id$rBG$D$?$a$K!"(B125,000 $BJF%I%k$NGe=~6b$r;YJ'$&$3$H$G9g0U$7$?!#(B

http://online.securityfocus.com/news/601

3. Spyware Trojan sends Hotmail to your boss
$BCx<T(B: Thomas C. Greene, The Register

$B$3$3$KB?$/$NF;FA$K=>$&?M!9$,EG$-5$$r46$8$k%=%U%H%&%'%"$N0lJR$,$"$k!#(B
$B%9%Q%$%&%'%"$N:n$j<j$G$"$k(B SpectorSoft $B$+$i8X$i$7$2$K;T>l$K=P$5$l$F$$$k(B
$B$3$N%=%U%H%&%'%"$O(B eBlaster $B$H>N$9$kH\Nt$J%H%m%$$NLZGO$G$"$k!#(B
Windows $B$rL5KIHw$KMxMQ$7$F$$$k@$3&Cf$N?M!9$NC/$KBP$7$F$b$3$N%=%U%H%&%'(B
$B%"$r4^$`EE;R%a!<%k$r:9=P2DG=$G$"$j!"$3$N%=%U%H%&%'%"$rMxMQ$9$k$3$H$GH`(B
$BEy$NBG80FbMF$r%m%0$K:N<h2DG=$G$"$k!#$^$?!"$=$N$h$&$J?M!9$N(B POP $B$r2p$9$k(B
$BEE;R%a!<%k$N$d$j<h$j!"(BHotmail$B!"(BYahoo Web $B%a!<%k%"%+%&%s%H$NFbMF$r<B:]2?(B
$B$,@8$8$F$$$k$N$+$r$=$N$^$^J#@=$7!"<j85$KCV$$$F$*$1$k$N$G$"$k!#(B

http://online.securityfocus.com/news/600

4. MS in fresh digital cert flaw
$BCx<T(B: John Leyden, The Register

Windows $B$NEE;R=pL>$N<h$j07$$J}K!$KH/8+$5$l$?7g4Y$K$h$j!"5;G=$KIY$`%/%i%C(B
$B%+!<$OJ]8n$5$l$F$$$J$$%3%s%T%e!<%?Fb$G5/$3$jF@$k!"A4$F$N<oN`$N0-1F6A$r(B
$B4k$`$3$H$,2DG=$K$J$C$F$7$^$C$?$N$G$"$k!#(B

http://online.securityfocus.com/news/599

IV. SECURITYFOCUS TOP 6 TOOLS
-----------------------------
1. checkpassword-ldap v0.1
$B:n<T(B: Dan Melomedman dan1spammy1@foobarco.net
$B4XO"$9$k(BURL:
http://foobarco.net/checkpwd.html
$BF0:n4D6-(B: FreeBSD, Linux, NetBSD, OpenBSD, UNIX
$B$^$H$a(B:

checkpassword-ldap $B$O@\F,<-!"%f!<%6L>!"@\Hx<-$rMxMQ$7$F:n@.$5$l$?(B LDAP
$BMQ%U%#%k%?$rMxMQ$7$F;XDj$5$l$?(B LDAP $B%G%#%l%/%H%jFb$r8!:w$7!"$^$?!"%(%s(B
$B%H%j$r<h$j=P$9%=%U%H%&%'%"$G$9!#$=$N8e!"F~NO$5$l$?%Q%9%o!<%I$HJ]B8$5$l(B
$B$F$$$k%Q%9%o!<%I$rHf3S$7!"N>J}$N%Q%9%o!<%I$,0lCW$9$k:]$K;XDj$5$l$?FbMF(B
$B$K=>$C$F$3$N%W%m%0%i%`$O<B9T$5$l$^$9!#(B

2. Prelude Log Monitoring Lackey v 0.8.1
$B:n<T(B: yoann
$B4XO"$9$k(BURL:
http://www.prelude-ids.org/
$BF0:n4D6-(B: POSIX
$B$^$H$a(B:

Prelude Log Monitoring Lackey (LML) $B$O!"(BPrelude Hybrid IDS $B%Q%C%1!<%8$K(B
$BF1:-$5$l$?%[%9%H%Y!<%9$N4F;k%W%m%0%i%`$G$9!#$3$N%"%W%j%1!<%7%g%s$O!"%m!<(B
$B%+%k$d%j%b!<%H$N%7%9%F%`$K$*$$$F!"%m%0$NA`:n$r=8Cf4IM}$9$k!"$b$7$/$O!"(B
$BC1$J$k%m%0%"%J%i%$%6(B (swatch $B$N$h$&$K(B) $B$H$7$F3hMQ$9$k$3$H$,2DG=$G$9!#(B
$B$3$N%=%U%H%&%'%"$O%M%C%H%o!<%/>e$N%5!<%P$H$7$F(B syslog $B%G!<%b%sMQ$N%]!<(B
$B%H$G%3%M%/%7%g%s$rBT$A<u$1!"$^$?!"%m%0%U%!%$%k$NJ,@O$,2DG=$G$9!#(B
$B$3$N%=%U%H%&%'%"$,%5%]!<%H$9$k%m%0%U%!%$%k$O(B BSD syslog $B%U%)!<%^%C%H$G!"(B
PCRE $B%i%$%V%i%j$rMxMQ$9$k%m%0%U%!%$%k$G$"$l$P$I$N$h$&$J$b$N$G$"$C$F$bJ,(B
$B@O2DG=$G$9!#$^$?!"%m%0%U%!%$%k$N7A<00MB8$NJ,@O$b(B PAX $B$N$h$&$J%W%i%0%$%s(B
$B$rMxMQ$7$F2DG=$G$9!#$5$i$K$O5?$o$7$$%m%0%(%s%H%j$,H/8+$5$l$?:]!"(BPrelude
Manager $B$X7Y9p%a%C%;!<%8$NAw?.$,2DG=$G$9!#(B

3. batemail v0.8.6
$B:n<T(B: Ryan VanMiddlesworth
$B4XO"$9$k(BURL:
http://batemail.sourceforge.net/
$BF0:n4D6-(B: POSIX
$B$^$H$a(B:

batemail $B$O!"(BMTA ($BNc(B sendmail) $B$H%m!<%+%k%a!<%i(B ($BNc$($P(B procmail) $B$N4V(B
$B$GF0:n$7!"@x:_E*$K4m81$JEE;R%a!<%k$NE:IU%U%!%$%k$r=|5n$9$k$?$a$N(B Perl
$B%9%/%j%W%H$G$9!#$3$N%=%U%H%&%'%"$OI8=`F~NO$+$iF~NO$r<u$1IU$1!"<B9T2DG=(B
$B$J(B MIME $B7A<0$NE:IU%U%!%$%k$r=|5n$7$?>e$G%m!<%+%k%a%$%i!<$X7k2L$rG[Aw$7(B
$B$^$9!#DL2a$,M^@)$5$l$kE:IU%U%!%$%k$NH=CG4p=`$O%U%!%$%kL>$N8e$m$K!V%V%i%C(B
$B%/%j%9%H!W$K:\$;$i$l$?$$$/$D$+$N3HD%;R$,4^$^$l$F$$$k$+$I$&$+$G$9(B(EXE$B!"(B
VBS $B$J$I(B)$B!#(B

4. GPGME 0.3.9 v0.3.9
$B:n<T(B: wali
$B4XO"$9$k(BURL:
http://www.gnupg.org/gpgme.html
$BF0:n4D6-(B: UNIX
$B$^$H$a(B:

GnuPG Made Easy (GPGME) $B$O%"%W%j%1!<%7%g%s$,MF0W$K(B GnuPG $B$N5!G=$rMxMQ$G(B
$B$-$k$h$&$K@_7W$5$l$?%i%$%V%i%j$G$9!#$3$N%i%$%V%i%j$O0E9f2=!"J#9g2=!"=p(B
$BL>!"=pL>>H9g!"$=$7$F0E9f80$N4IM}$N$?$a$N9b?e=`$N0E9f2=(B API $B$rDs6!$7$^$9!#(B
$B8=:_$O%P%C%/%(%s%I$K(B GnuPG $B$r;HMQ$7$^$9$,!"(BAPI $B$O$3$N%(%s%8%s$K8BDj$5$l(B
$B$^$;$s!#<B:]$K!"B>$N%P%C%/%(%s%I$X$NBP1~$,M=Dj$5$l$F$$$^$9!#(B

5. iptables-control v1.0.3
$B:n<T(B: Francesco 'StealthP' NOSPAM@stealthp.net
$B4XO"$9$k(BURL:
http://devzone.stealthp.org/iptables-control
$BF0:n4D6-(B: Linux, POSIX
$B$^$H$a(B:

Iptables-Control $B$O9bB.$GMxMQ$7$d$9$$(B iptables $BMQ$N%U%#%k%?%j%s%0%k!<%k(B
$B$r@_Dj$9$k%=%U%H%&%'%"$G$9!#$3$N%=%U%H%&%'%"$NFCD'$OCJ3,E*$GBPOC<0$K@_(B
$BDj$9$k%9%/%j%W%H!"(BTCP/UDP $B%]!<%H$N@_Dj!"%k!<%F%#%s%0$d%^%9%+%l!<%I$N$?(B
$B$a$N(B LAN $B$N@_Dj!"$=$7$F(B ICMP $B$N%U%#%k%?%j%s%0$G$9!#(B

6. l0stat v1.1
$B:n<T(B: DLC Sistemas
$B4XO"$9$k(BURL:
http://www.dlcsistemas.com/html/l0stat.html
$BF0:n4D6-(B: Windows 2000, Windows 95/98, Windows NT
$B$^$H$a(B:

L0stat $B$O(B NT $B%"%+%&%s%H$*$h$S%Q%9%o!<%I$N6/EY$K4X$9$kE}7W%l%]!<%H$r@8@.(B
$B$7$^$9!#(B

$B$3$N%f!<%F%#%j%F%#$O(B L0phtCrack $B$rMxMQ$7$FD4::$r9T$C$?7k2L$r5-O?$7$?%U%!(B
$B%$%k!"$"$k$$$O(B LC3 $B$rMxMQ$7$FD4::$r9T$C$?7k2L$N%F%-%9%H%U%!%$%k$r85$K!"(B
Windows NT $B$N4IM}<T$d%;%-%e%j%F%#4IM}<T$KD4::BP>]$N%3%s%T%e!<%?$N(B SAM
$B%G!<%?%Y!<%9$N%;%-%e%j%F%#$K4X$9$kI}9-$$;kLn$rM?$($k$?$a$N=hM}$r9T$$$^(B
$B$9!#(B

NT $B%Q%9%o!<%I$rH/8+$9$kJ}K!$H$7$F!"(BL0phtCrack $B$d(B LC3 $B$OAG@2$i$7$$%D!<%k(B
$B$G$9!#(B

$B<+J,C#<+?H$N%Q%9%o!<%I$rCN$j$?$$$H$O9M$($J$$>l9g$G$b!"%Q%9%o!<%I$NDxEY(B
$B$K4X$9$kI}9-$$;kLn$r5a$a$?$$>l9g$K$O!"$5$i$K0lJb@h$X?J$`$Y$-$G$9!#(B
$BNc$($P!"4k6HFb$N(B 1000 $B$D$N%"%+%&%s%H$rJz$($k(B Windows NT $B$N%"%+%&%s%H%G!<(B
$B%?%Y!<%9$KBP$9$k%;%-%e%j%F%#%l%Y%k$NI>2A$O$I$N$h$&$K2DG=$K$J$k$G$7$g$&(B
$B$+!#(B

$B$=$3$,(B L0stat $B$N$?$a$N4D6-$J$N$G$9!#(BL0stat $B$O(B L0phtCrack $B$rCV$-49$($k(B
$B%=%U%H%&%'%"$G$O$"$j$^$;$s!#(BL0stat $B$O(B L0phtCrack $B$d(B LC3 $B$,<h$j=P$7$?(B
$B%G!<%?$NJs9p%D!<%k$G$9!#(B
--
$BLu(B: $B:d0f=g9T(B(SAKAI Yoriyuki)$B!">.3^8691M:(B(OGASAWARA Tsuneo)$B!"(B
$B@PED6G5W(B(ISHIDA Akihisa)$B!"<r0fH~5.(B(SAKAI Miki)$B!"(B
$B?7D.5W9,(B(SHINMACHI Hisayuki)
$B4F=$(B: $B:d0f=g9T(B(SAKAI Yoriyuki)
LAC Co., Ltd.
http://www.lac.co.jp/security/

-----------1031748351-1670762
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"

MIISGgYJKoZIhvcNAQcCoIISCzCCEgcCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC
DzwwggI8MIIBpQIQMlAzz1DRVvNcga1lXE/IJTANBgkqhkiG9w0BAQIFADBfMQswCQYDVQQG
EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDEgUHVibGlj
IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNOTYwMTI5MDAwMDAwWhcNMjAw
MTA3MjM1OTU5WjBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1
BgNVBAsTLkNsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw
gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOUZv22jVmEtmUhx9mfeuY3rt56GgAqRDvo4
Ja9GiILlc6igmyRdDR/MZW4MsNBWhBiHmgabEKFz37RYOWtuwfYV1aioP6oSBo0xrH+wNNeP
NGeICc0UEeJORVZpH3gCgNrcR5EpuzbJY1zF4Ncth3uhtzKwezC6Ki8xqu6jZ9rbAgMBAAEw
DQYJKoZIhvcNAQECBQADgYEAS0RmYGhk5Jgb87By5pWJfN17s5XAHS7Y2BnQLTQ9xlCaEIaM
qj87qAT8N1KVw9nJ283yhgbEsRvwgogwQo4XUBxkerg+mUl0l/ysAkP7lgxWBCUMfHyHnSSn
2PAyKbWk312iTMUWMqhC9kWmtja54L9lNpPC0tdr3N5Z1qI1+EUwggI9MIIBpgIRAM26f1bw
3+S8VP4irLNyqlUwDQYJKoZIhvcNAQECBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZl
cmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmlj
YXRpb24gQXV0aG9yaXR5MB4XDTk2MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkG
A1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1
YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUA
A4GNADCBiQKBgQDlGb9to1ZhLZlIcfZn3rmN67eehoAKkQ76OCWvRoiC5XOooJskXQ0fzGVu
DLDQVoQYh5oGmxChc9+0WDlrbsH2FdWoqD+qEgaNMax/sDTXjzRniAnNFBHiTkVWaR94AoDa
3EeRKbs2yWNcxeDXLYd7obcysHswuiovMaruo2fa2wIDAQABMA0GCSqGSIb3DQEBAgUAA4GB
AEw/uIvGaN/uQzMOXemmyweETXoz/5Ib9Dat2JUiNmgRbHxCzPOcLsQHPxSwD0//kJJ2+eK8
SumPzaCACvfFKfGCIl24sd2BI6N7JRVGMHkW+OoFS5R/HcIcyOO39BBAPBPDXx9T6EjkhrR7
oTWweyW6uNOOqz84nQA0AJjz0XGUMIICPTCCAaYCEQDz1GWTDuTHHs1vChERVlizMA0GCSqG
SIb3DQEBAgUAMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE3MDUG
A1UECxMuQ2xhc3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe
Fw05NjAxMjkwMDAwMDBaFw0wNDAxMDcyMzU5NTlaMF8xCzAJBgNVBAYTAlVTMRcwFQYDVQQK
Ew5WZXJpU2lnbiwgSW5jLjE3MDUGA1UECxMuQ2xhc3MgMSBQdWJsaWMgUHJpbWFyeSBDZXJ0
aWZpY2F0aW9uIEF1dGhvcml0eTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA5Rm/baNW
YS2ZSHH2Z965jeu3noaACpEO+jglr0aIguVzqKCbJF0NH8xlbgyw0FaEGIeaBpsQoXPftFg5
a27B9hXVqKg/qhIGjTGsf7A01480Z4gJzRQR4k5FVmkfeAKA2txHkSm7NsljXMXg1y2He6G3
MrB7MLoqLzGq7qNn2tsCAwEAATANBgkqhkiG9w0BAQIFAAOBgQAjyGZsVZ9SYWqvFx3is89H
jkwbAjN1+UXvm0exsSugNTbRUnBpybul85NbkmD5ZH7xwT/p0RXx0sAXvaSdF67hB8+6gZbE
rnEZ9s5kv6cZ9VUof3wz1sK5t+slKf0p+GJwQTHdwwfbElMWYNCdB/kAZfyNbBhQILdn3H79
cEstDzCCAzwwggKloAMCAQICEAQa2pqnxtqHdYa+MJp9N08wDQYJKoZIhvcNAQECBQAwXzEL
MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAx
IFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk5MDkxNDAwMDAw
MFoXDTA5MDkwOTIzNTk1OVowgbUxHDAaBgNVBAoTE1ZlcmlTaWduIEphcGFuIEsuSy4xHzAd
BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxPjA8BgNVBAsTNVRlcm1zIG9mIHVzZSBh
dCBodHRwczovL3d3dy52ZXJpc2lnbi5jby5qcC9SUEEgKGMpIDk4MTQwMgYDVQQDEytWZXJp
U2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQDnvpzpMy1glZcGiPmrsWEvOOXjEuTGvnb95mH1mMGeDPD3HmpNa7WG
Cp2NaO3eVRcRaBICMi2F3Edx6/eL5KtrsnroadWbYLPfBpPJ4BYttJND7Us7+oNdOuQmwFhj
xm9P25bndFT1lidp0Gx/xN5ekq3mNwt5iSWVdqOuEYKApQIDAQABo4GhMIGeMCQGA1UdEQQd
MBukGTAXMRUwEwYDVQQDEwxBZmZpbGlhdGUxLTUwEQYJYIZIAYb4QgEBBAQDAgEGMEUGA1Ud
IAQ+MDwwOgYKYIZIAYb4RQEHCzAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy52ZXJpc2ln
bi5jby5qcC9SUEEwDwYDVR0TBAgwBgEB/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEC
BQADgYEAuIwwUgDQeNCIO/tzaT6ISelw4QjYJ9up3+be1dxZGHKcEFGtPfwaBNvlTMLV3eW3
BG6W5QRbNNhIaoVl0g8Yw1YuIexVFD7yUKcvQfOOThuG0y93V6Runzha6iErOLabtv05we+V
UnSsknF+qOCLYP9uMIKB/JmDiWnNpnUbAHMwggU2MIIEn6ADAgECAhBYKwlOQWIg2t9s9Ul6
I3xqMA0GCSqGSIb3DQEBBAUAMIG1MRwwGgYDVQQKExNWZXJpU2lnbiBKYXBhbiBLLksuMR8w
HQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMT4wPAYDVQQLEzVUZXJtcyBvZiB1c2Ug
YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY28uanAvUlBBIChjKSA5ODE0MDIGA1UEAxMrVmVy
aVNpZ24gQ2xhc3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjAeFw0wMjA0MDEwMDAw
MDBaFw0wMzA0MDEyMzU5NTlaMIIBIzELMAkGA1UEBhMCSlAxHDAaBgNVBAoUE1ZlcmlTaWdu
IEphcGFuIEsuSy4xNDAyBgNVBAsUK1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFs
IFN1YnNjcmliZXIxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9DUFMg
SW5jb3JwLiBieSBSZWYuLExJQUIuTFREKGMpOTYxPzA9BgNVBAsUNkRpZ2l0YWwgSUQgQ2xh
c3MgMSAtIFNNSU1FIE9yYW5nZXNvZnQgSW5jLi9XaW5iaWZmLzIuMTEXMBUGA1UEAxMOU0FL
QUkgWW9yaXl1a2kxHjAcBgkqhkiG9w0BCQEWD3Nha2FpQGxhYy5jby5qcDCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBANEwVujTRrltaiSI2DFkPlw5L6WWWeOOy9z0HqaPXf2d
JYfoGHqbpq5MVCkBUSOHSY1Tpi/RdziqxhIYzXvzsb0wC1V0RNzvLf8zXtk6IjTmHttX0QDx
AvoxfmehZ1vCOgQcdBbG2FajnYo7MOewxLrmHLCv0Gitqsi2IS3Eaxv7v5Pzobu82BzUMBl6
9XypVXIEQHTG6s34ji0LbDOO/F5JqTuG5QhQmQyNnJyhNU4/BYu3e1KgK9c0gnIArQAroRqP
/0HXU7Ueu/HAUXnrt7+YqzL5CZ/6m11gCLblzFs2+6XieQsekFSjxquSQjl88C3CwgRoaNkx
01rqqYzBJ8ECAwEAAaOCAVAwggFMMAkGA1UdEwQCMAAwgawGA1UdIASBpDCBoTCBngYLYIZI
AYb4RQEHAQEwgY4wKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9DUFMw
YgYIKwYBBQUHAgIwVjAVFg5WZXJpU2lnbiwgSW5jLjADAgEBGj1WZXJpU2lnbidzIENQUyBp
bmNvcnAuIGJ5IHJlZmVyZW5jZSBsaWFiLiBsdGQuIChjKTk3IFZlcmlTaWduMAsGA1UdDwQE
AwIFoDARBglghkgBhvhCAQEEBAMCB4AwcAYDVR0fBGkwZzBloGOgYYZfaHR0cDovL29uc2l0
ZWNybC52ZXJpc2lnbi5jb20vVmVyaVNpZ25KYXBhbktLVmVyaVNpZ25DbGFzczFDQUluZGl2
aWR1YWxTdWJzY3JpYmVyL0xhdGVzdENSTC5jcmwwDQYJKoZIhvcNAQEEBQADgYEALL1YFoVc
MyuHCFTkhPlz/3XIGtchllMRc+zha0qmA5wxbtgJT7hEl7IRrocWCSfweW4/KGZDQDMZM9wR
NRX19b4UTs2/opkQtX3eX4qNjUNnGdMjLTGTXzFqlph9b4ZYPvY5Xq+VQjpLBkqn2RQhdTLH
+BXc51LdzrtGw8H7s+4xggKmMIICogIBATCByjCBtTEcMBoGA1UEChMTVmVyaVNpZ24gSmFw
YW4gSy5LLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE+MDwGA1UECxM1VGVy
bXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvLmpwL1JQQSAoYykgOTgxNDAy
BgNVBAMTK1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXICEFgr
CU5BYiDa32z1SXojfGowCQYFKw4DAhoFAKCBsTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcB
MBwGCSqGSIb3DQEJBTEPFw0wMjA5MTExMjQ1MDBaMCMGCSqGSIb3DQEJBDEWBBR0hyrHxc0+
OEDtiidrfBIc0S+gTDBSBgkqhkiG9w0BCQ8xRTBDMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMC
AgIAgDAHBgUrDgMCBzANBggqhkiG9w0DAgIBQDANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0B
AQEFAASCAQA8e3hrKJk1ZAmLHqkR/L6fMXk78BzLHT4mTYUOwgEsfuGEPigafWCybl5XWRHG
ufKx61+QzAPNQ9BUxVupIzjwy7J4nGXt817FKLvEk5ETgblfEgGKjxxdgh9lyLOKAsihGZyt
gxDpW9WBDN2TqwHi7aJFeyjyr0izqsHFNvKQUsbz3k+77llqgANn9hksnXSn2pdUs6W4ia7N
yeSfQbgrM37I/UZqjJqkP4m67OL9q01Yy58GrD1oXgpfqvn4iuIphNmIYq6Mw0ZC0kIswbgx
LeowjOuMcDzMTPKANvwU+myv1r1KOiVJUJiL+trkl+QlsJTB7VKzk1UJPqdu4DCW

-----------1031748351-1670762--