SecurityFocus.com Newsletter #33 2000-03-13 ->2000-03-20

To: BUGTRAQ-JP@SECURITYFOCUS.COM
Subject: SecurityFocus.com Newsletter #33 2000-03-13 ->2000-03-20
From: SAKAI Yoriyuki <sakai@LAC.CO.JP>
Date: Tue, 21 Mar 2000 15:00:02 +0900
Reply-To: SAKAI Yoriyuki <sakai@LAC.CO.JP>
Sender: BUGTRAQ-JP List <BUGTRAQ-JP@SECURITYFOCUS.COM>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

$B:d0f(B@$B%i%C%/$G$9!#(B

SecurityFocus.com Newsletter $BBh(B 33 $B9f$NOBLu$r$*FO$1$7$^$9!#(B
$BLu$N$J$$9`L\$K$D$$$F$O!VF|K\8lLu$J$7!W$H$7$F6hJL$7$F$"$j$^$9!#(B
SecurityFocus.com Newsletter $B$K4X$9$k(BFAQ:
<URL: http://www.securityfocus.com/forums/sf-news/faq.html>
BugTraq-JP $B$K4X$9$k(B FAQ:
<URL: http://www.securityfocus.com/forums/bugtraq-jp/faq.html>
- -----------------------------------------------------------------------
- -----------------------------------------------------------------------
$B0zMQ$K4X$9$kHw9M(B:
$B!&$3$NOBLu$O(B Security-Focus.com $B$N5v2D$r3t<02qe$G9T$o(B
  $B$l$F$$$^$9!#(B
$B!&(BSecurityFocus.com Newsletter $B$NOBLu$r(B Netnews, Mailinglist,
  World Wide Web, $B=q@R(B, $B$=$NB>$N5-O?G^BN$G0zMQ$5$l$k>l9g$K$O%a!<%k$N(B
  $BA4J80zMQ$r$*4j$$$7$^$9!#(B
$B!&F|K\8lHG%K%e!<%9%l%?!<(B 1 $B9f$+$i(B 3 $B9f$^$G$K$O$3$NHw9M$,IU$$$F$$$^$;(B
  $B$s$,=`MQ$9$k$b$N$H$7$^$9!#(B
$B!&$^$?!"(BSecurity-Focus.com $BDs6!$N(B BugTraq-JP $B%"!<%+%$%V(B [*1] $B$X$N$$$+(B
  $B$J$k7A<0$N%O%$%Q!<%j%s%/$b>e5-$K=`$8$F$/$@$5$$!#(B
1) <URL http://www.securityfocus.com/templates/archive.pike?list=79>
- -----------------------------------------------------------------------
- -----------------------------------------------------------------------
$B$3$NOBLu$K4X$9$kHw9M(B:
$B!&$3$NOBLu$NE,MQ@.2L$K$D$$$F3t<02qpJs$r$*FO$1$9$k(B SecurityFocus.com $B$G$O?7$7$$!"(B
$B>\:Y$KEO$k%;%-%e%j%F%#%3%s%F%s%D$r=`Hw$$$?$7$^$7$?!#$3$NL5NA%5!<%S%9$O(B
Solaris $B$r$*;H$$$N3'MM$,%;%-%e%j%F%#>e$NH=CG$N:`NA$K$*;H$$D:$1$k$b$N$G(B
$B$9!#>\$7$/$O0J2<$N(B URL $B$r$4Mw$/$@$5$$!#(B

http://www.securityfocus.com/sun/vulncalc


I. $B:#=5$N%O%$%i%$%H(B
    1. Info.Sec.Radio to interview head of Technical Security Branch
       of Canada's Federal Police Force, the RCMP.
II.  $B:#=5$N(B BUGTRAQ $B$+$i(B
    1. Linux atsar Input Validation Vulnerability
    2. RealServer Internal IP Address Disclosure Vulnerability
    3. NT Automated Tasks / Drive Mappings Vulnerability
    4. Atrium Software Mercur Mail Server 3.2 Buffer Overflow
       Vulnerability
    5. Sojourn File Access Vulnerability
    6. Oracle Web Listener Batch File Vulnerability
    7. Checkpoint Firewall-1 Internal Address Leakage Vulnerability
    8. Microsoft SQL Weak Password Encryption Vulnerability
    9. Atrium Software Mercur WebView WebMail-Client Buffer Overflow
       Vulnerability
    10. Trend Micro OfficeScan Unauthenticated CGI Usage Vulnerability
III.  Security Focus $B$N>e0L(B6$B0L$N5-;v(B
    1. The Coming Linux Plague (March 13, 2000)
    2. The Fine Print in UCITA (March 16, 2000)
    3. Sex Site Billing Companies Targeted By Russian Cybercrime
       (March 13, 2000)
    4. Information Freedom Catching On (March 16, 2000)
    5. Vast online credit card theft revealed (March 17, 2000)
    6. Hacker Finds a New Home for Stolen Cards (March 17, 2000)
IV. $B:#=5$N(B INCIDENTS $B$+$i(B
    1. Munged Napster Sessions (Thread)
    2. Undernet/telnet attempts?  (Thread)
    3. Strange RPC? service entries. (Thread)
	4. ingreslock message (Thread)
    5. lots of interest in port 109 (POP2)  (Thread)
    6. Mail and web server attack (Thread)
    7. Firewall (Thread)
    8. TCP port 3218 (Thread)
    9. Odd UPD scan (Thread)
    10. DUP packet replies at tvguide.com (Thread)
    11. Cracked; rootkit - entrapment question? (Thread)
    12. pop-2 scanning (Thread)
    13. Looking for Squid Proxies (Thread)
    14. TCP port 3218 (Thread)
    15. what are these? (Thread)
V. $B:#=5$N(B VULN-DEV RESEARCH LIST $B$+$i(B
    1. Unwanted automagic processing (Thread)
    2. MS Frontpage shtml.dll Path Leak Vulnerability (Thread)
    3. Hotline (Thread)
    4. Crashing Win9x (Thread)
    5. NT 4.0 (Workstation) Logon Authentication Vulnerability
       (Thread)
    6. Crashing Win9x with smbclient (Thread)
    7. Intel Corporation, Express 550 (Thread)
    8. spoofing the ethernet address (Thread)
    9. Linux Mandrake 6.1 PAM/userhelper exploit (Thread)
    10. Exploiting any network protocol with secondary data channels
       (Thread)
    11. Buffer overflow in AIM 3.5.1856 (Thread)
VI.   $B5a?M>pJs(B($BF|K\8lLu$J$7(B)
VII.  $B%;%-%e%j%F%#D4::(B
    1. Which remote accessing service presents the greatest security
       risks?
VIII. Security Focus $B$,A*$V>e0L(B6$B0L$N%D!<%k(B
    1. ShadowScan 1.00.093 (Windows 95/98 $B$*$h$S(B Windows NT)
    2.  SecurityFocus.com Pager (Win95/98/NT)
    3. Cold Fusion Scan 1.0 (Win95/98/NT)
    4. Atlas 1.0 (Win95/98)
    5. kfirewall 0.4.2 (Linux)
    6. cgi scanner 3.6 (UNIX/PERL)


I. $B:#=5$N%O%$%i%$%H(B
- -------------------

1. Info.Sec.Radio to interview head of Technical Security Branch of
Canada's Federal Police Force, the RCMP

http://www.securityfocus.com/radio/

II.  $B:#=5$N(B BUGTRAQ $B$+$i(B
     2000-03-13 $B$+$i(B 2000-03-20 $B$^$G(B
- ------------------------------------

1. Linux atsar Input Validation Vulnerability
BugTraq ID: 1048
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-03-11
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1048
$B$^$H$a(B:

atsar $B$O(B AT Com@uting $B$,(B GPL $B$N85$GDs6!$9$k(B Linux $BMQ$NIi2Y%b%K%?%j%s%0(B
$B%=%U%H%&%'%"$G$"$k!#(Batsadc $B$K$O(B setuid root $B$K@_Dj$5$l$?%P%$%J%j$r%Q%C(B
$B%1!<%8Fb$K4^$s$G$$$k!#(Batsadc $B$O=PNO%U%!%$%k$r0z?t$G;XDj2DG=$G$"$j!"(Batsadc
$B$re=q$-$5$l(B) $B$?8e$G$O%U%!%$%k$N=jM-(B
$BuBV$J$N(B
$B$G$"$k!#=>$C$F%U%!%$%k$OCV$-49$(2DG=$G$"$j!"2~$6$s$5$l$?%7%9%F%`%U%!%$(B
$B%k$rMQ$$$kMM!9$JJ}K!$rMQ$$$F%m!<%+%k$+$i(B root $B8"8B$rC%2. RealServer Internal IP Address Disclosure Vulnerability
BugTraq ID: 1049
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-03-08
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1049
$B$^$H$a(B:

$B%G%U%)%k%H>uBV$N(B Real Server $B$O%5!<%P<+?H$N(B IP $B%"%I%l%9$r%/%i%$%"%s%H$X(B
$BAw$i$l$k%G!<%?Fb$K4^$s$G$$$k!#(B Real Server $B$,(B NAT $B4D6-$K%$%s%9%H!<%k$5(B
$B$l$?>l9g!"AH?%FbMxMQ$N!"1#JC$5$l$k$Y$-(B IP $B%"%I%l%9$rO3$i$7$F$7$^$&2DG=(B
$B@-$,$"$k!#(B($B$3$l$O%j%P!<%9%W%m%-%7$K$h$C$Fl9g$G$"$k(B)

3. NT Automated Tasks / Drive Mappings Vulnerability
BugTraq ID: 1050
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-03-14
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1050
$B$^$H$a(B:

$B%m%0%*%s$7$?%f!<%6$h$j$b9b$$8"8B$G1?MQ$5$l$k%I%i%$%V%^%C%T%s%0$5$l$?4D(B
$B6-$GF0:n$9$k<+F02=%?%9%/$O%I%i%$%V%^%C%T%s%0>uBV$rJQ$($k$3$H$K$h$j967b(B
$BBP>]$H$J$jF@$k!#967bBP>]$H$J$C$?%I%i%$%VFb$N%G%#%l%/%H%j9=B$$rJ#@=$7!"(B
$B$=$N8e%9%1%8%e!<%k%8%g%V$KEPO?$5$l$?$N%G!<%?$N@_Dj(B
$B%U%!%$%k$rCV$-49$($k;v$G%m!<%+%k$N967be>:$G$-$?8"8B$G0U?^E*$J%3!<(B
$B%I$rl9g!"$3$N%P%C%A%U%!%$%k$O%m!<%+%k$N(B Administrator $B8"8B$G4. Atrium Software Mercur Mail Server 3.2 Buffer Overflow Vulnerability
BugTraq ID: 1051
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-03-14
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1051
$B$^$H$a(B:

Atrium Software Mercur $B$O(B SMTP$B!"(BPOP3$B!"(BIMAP $B%a!<%k%5!<%P$G$"$k!#(B
$B%m%0%$%s%3%^%s%I$KITE,@Z$J6-3&%A%'%C%/$,$"$k$?$a!"(B3000 $BJ8;z$r1[$($kJ8;z(B
$B$,%f!<%6L>$H$7$F;XDj$5$l$?:]$K%"%W%j%1!<%7%g%s$,%/%i%C%7%e$7$F$7$^$&!#(B
$B$3$N8=>]$O(B Mercur $B%a!<%k%5!<%P$N(B POP3 $B%5!<%P$H(B IMAP $B%5!<%P$G@8$8$k!#(B

5. Sojourn File Access Vulnerability
BugTraq ID: 1052
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-03-14
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1052
$B$^$H$a(B:

Sojourn $B%5!<%A%(%s%8%s$rF0:n$5$;$F$$$k(B Web $B%5!<%P>e$NFI$_=P$78"8B$,$"$k(B
$B%U%!%$%k$,2?$G$"$C$F$bFI$_=P$;$F$7$^$&$l$OJ,N`L>$K=>$C$?$=$l$>$l$N(B .txt $B%U%!%$%k$K=>$$!"(B
sojourn.cgi $B$O(B cat $B0z?t$N:G8e$K(B .txt $B$N3HD%;R$rDI2C$7$F=hM}$r9T$C$F$$(B
$B$k!#$7$+$7!"$3$N(B CGI $B%W%m%0%i%`$O(B ../ $BJ8;zNs$r0UL#$"$kJ8;zNs$H$7$F$=$N(B
$B$^$^=hM}$7$F$7$^$&$?$a!"(BWeb $B%5!<%P$,FI$_=P$72DG=$J$9$Y$F$N(B .txt $B%U%!%$(B
$B%k$K%"%/%;%92DG=$G$"$k!#(B

$B$7$+$b!"(B.txt $B$,FI$_=P$7@h$N%U%!%$%kL>$G$J$1$l$P$J$i$J$$$H$$$&@)8B$O%j%/(B
$B%(%9%H$N:G8e$K(B%00 $B$rDI2C$9$k$3$H$G%P%$%Q%92DG=$G$"$k!#(B


6. Oracle Web Listener Batch File Vulnerability
BugTraq ID: 1053
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-03-15
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1053
$B$^$H$a(B:

$B%G%U%)%k%H>uBV$G(B Oracle Web Listener for NT $B$OMM!9$J%P%C%A%U%!%$%k$r(B
CGI $B%9%/%j%W%H$H$7$FMxMQ$9$k!#(BCGI $B%9%/%j%W%H$N%G%U%)%k%H$G$N%$%s%9%H!<(B
$B%k@h$O(B /ows-bin/ $B$G$"$k!#(B

$B$7$+$7!"$3$l$i%P%C%A%U%!%$%k$O%5!<%P>e$NB>$N%3%^%s%I$r$G;XDj$9$k;v$G9T$o$l$k!#$3$N:]%3%^%s%I$O(B
SYSTEM $B8"8B$GA0$OI,?\$NMWAG(B
$B$G$O$J$$$H9M$($i$l$k!#$3$l$O(B * $B$,2r$l$XIU$12C$($FE,MQ$5$l$F$7$^$&$+$i$G$"$k!#(B
$B$7$+$b!"%5!<%P>e$G%j%b!<%H$K$"$k7. Checkpoint Firewall-1 Internal Address Leakage Vulnerability
BugTraq ID: 1054
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-03-11
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1054
$B$^$H$a(B:

Checkpoint $BoF0:n(B
$B;~!"(B200 $B7o0J>e$N%3%M%/%7%g%sCf7Q!"(B40% $B$N(B CPU $BMxMQN(;~$K$*$$$F(B FireWall-1
$B$OFbIt%"%I%l%9$rMxMQ$7$?%3%M%/%7%g%sCf7Q$rl9g$NFbIt%"%I%l%9$O%k!<%F%#%s%0ITG=$G$"$j!"AH?%FbMxMQ@lMQ$G$"$j!"(B
$B:FCf7Q$,9T$o$l$k$b$N$G$"$j!"$3$N$h$&$J%Q%1%C%H$O@5$7$$%"%I%l%9$KFI$_BX(B
$B$($i$l$k$Y$-$b$N$G$"$k!#$7$+$7!"F10l$N%=!<%9%]!<%H$rMxMQ$7$F$7$^$&$N$G(B
$B$"$k!#$3$N>pJs$rMxMQ$9$k$3$H$G%U%!%$%d%&%)!<%kGX8e$N%"%I%l%9$,$I$N$h$&(B
$B$K$J$C$F$$$k$N$+$r!"%3%M%/%7%g%s$rCf7Q$9$k$?$a$KMxMQ$7$F$$$k%3%s%T%e!<(B
$B%?$,MxMQ$7$F$$$kFbIt%"%I%l%9$H6&$KD4$Y$k$3$H$,$G$-$F$7$^$&$N$G$"$k!#(B
$B$3$N>pJs$O%/%i%$%"%s%HB&$X$N967b$r9T$&967bpJs$K$J$C$F(B
$B$7$^$($k!#(B

$B$3$NLdBj$O(B Windows NT $B$H(B Solaris $B$N$I$A$i$N%W%i%C%H%U%)!<%`$N(B FireWall-1
$B$K1F6A$7$F$$$k!#$3$NLdBj$NJs9p8. Microsoft SQL Weak Password Encryption Vulnerability
BugTraq ID: 1055
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-03-14
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1055
$B$^$H$a(B:

$B!V%m%0%$%sL>$H%Q%9%o!<%I$r>o$K?R$M$k!W9`L\$,@_Dj$5$l$F$$$J$/!"(BWindows
Integrated Security $B$,;H$o$l$F$$$J$$>l9g!"(BEnterprise Manager for SQL
Server 7 $B$O%m%0%$%s(B ID $B$H%Q%9%o!<%I$r0J2<$K<($9%l%8%9%H%j%-!<$K5-O?$7(B
$B$F$7$^$&!#(B
HKCU\SOFTWARE\Microsoft\MSSQLServer\SQLEW\Registered Server X

$B%Q%9%o!<%I$r0E9f2=$9$k%"%k%4%j%:%`$OJ8;zNs$NJ8;z$N0LCV$K0MB8$7$?!"(B
2 $B%P%$%HKh$KJ8;z$N(B XOR $B$r$H%Q%9%o!<%I$r>o$K?R$M$k!W9`L\$,@_Dj$5$l$F$$$k>l9g!"(B
$B$"$k$$$O(B Windows Integrated Security $B$,MQ$$$i$l$F$$$k>l9g!"(BID $B$H%Q%9(B
$B%o!<%I$O$^$C$?$/J]B8$5$l$J$$!#(B

9. Atrium Software Mercur WebView WebMail-Client Buffer Overflow Vulnerability
BugTraq ID: 1056
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-03-16
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1056
$B$^$H$a(B:

WebView WebMail-Client $B$O(B Mercur SMTP/POP3/IMAP4 Mail Server $BMQ$N(B Web
$B%V%i%&%67PM3$GEE;R%a!<%k$NFI$_=q$-$r2DG=$K$9$k%"%I%*%s%W%m%0%i%`$G$"$k!#(B

$B%]!<%HHV9f(B 1080 $B$GBT$Al9g$N(B GET $B%j%/%(%9%H$N=hM}$K(B
$B$*$$$F6-3&%A%'%C%/$,ITE,@Z$JItJ,$,$"$k!#%]!<%HHV9f(B 1080 $B$K$*$$$F!"(B
1000 $B8D$r1[$($kJ8;zNs$r4^$`(B GET $B%j%/%(%9%H$rM?$($k;v$G(B WebView WebMail-
Client $B$,%/%i%C%7%e$7$F$7$^$&!#(B

$BNc(B:
http: //target/&mail_user=<1000$B8D$r1[$($kJ8;zNs(B>

10. Trend Micro OfficeScan Unauthenticated CGI Usage Vulnerability
BugTraq ID: 1057
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-03-16
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1057
$B$^$H$a(B:

Trend Micro OfficeScan $B$O%M%C%H%o!<%/A4BN$rBP>]$H$7$?%"%s%A%&%$%k%9%=%U(B
$B%H%&%'%"$G$"$k!#$3$N%=%U%H%&%'%"$N4IM}MQ%=%U%H%&%'%"$r%$%s%9%H!<%kCf!"(B
$B4IM}l9g!"(B
$B4IM}http://target/officescan/ $B$H$$$&(B URL $B$KBP$7$FG'>Z:n6H(B
$B$r9T$C$F$+$i9T$o$l$k!#$3$N:]$^$:4IM}MQ%Q%9%o!<%I$KBP1~$9$k%f!<%6L>$r?R(B
$B$M$i$l$k$N$G$"$k$,!"(BTMLogon=<password> $B$H$$$&FCDj$NJ8;zNs$,%9%K%U%!$r;H(B
$B$$C5$7$F$$$k%f!<%6$K$h$C$F2#e$NLdBj$h$j=EBg$JLdBj$,B8:_$9$k!#$=$l$O4IM}MQ(B Web $B%5!<%P$X%"%/%;%9(B
$B$G$-$k$I$s$J%f!<%6$G$bFCDj$N(B URL $B$rMW5a$9$k$3$H$K$h$j$$$+$J$kG'>Z5!G=$J(B
$B$7$G4IM}5!G=$rF~$H4IM}MQ%$%Y%s%H%3!<%IHV9f$+$i$J$k(B
jdkRqNotify.exe $B$X$NMW5aJ8;zNs$G%M%C%H%o!<%/>e$N$I$N$h$&$J%f!<%6$G$"$C$F(B
$B$b;XDj$7$?4IM}5!G=$rhttp://target/officescan/cgi/jdkRqNotify.exe?domain=<domain name>&event=<event code number>

$B%3!<%IHV9f$NNc(B:
11: Scan now
12: Uninstall
14: Roll back
15: New alert message
16: New intranet proxy
17: New privilege
18: New protocol
19: New password
20: New client


III.  Security Focus $B$N>e0L(B6$B0L$N5-;v(B
- ------------------------------------
1. The Coming Linux Plague (March 13, 2000)
URL:
	http://www.securityfocus.com/commentary/2

2. The Fine Print in UCITA (March 16, 2000)
URL:
	http://www.securityfocus.com/commentary/4

3. Sex Site Billing Companies Targeted By Russian Cybercrime (March 13,
2000) URL:
	http://www.securityfocus.com/news/3

4. Information Freedom Catching On (March 16, 2000)
URL:
	http://www.securityfocus.com/news/5

5. Vast online credit card theft revealed (March 17, 2000)
URL:
	http://www.msnbc.com/news/382561.asp

6. Hacker Finds a New Home for Stolen Cards (March 17, 2000)
URL:
        http://www.internetnews.com/ec-news/article/0,1087,4_323241,00.html


IV.  $B:#=5$N(B INCIDENTS $B$+$i(B
- --------------------------

1. Munged Napster Sessions (Thread)
URL:
	http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=20000314021712.CF91B106FB@schadenfreude.meshuggeneh.net

2. Undernet/telnet attempts?  (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=75B741AEA780D3118D6500508B4499A001965C75@cadillac.office.wxs.nl

3. Strange RPC? service entries. (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=20000313095534.5770.0@argo.troja.mff.cuni.cz

4. ingreslock message  (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=38CD2727.26D3F760@RZ.RWTH-Aachen.DE

5. lots of interest in port 109 (POP2)  (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=20000313205308.24475.qmail@securityfocus.com

6. Mail and web server attack  (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=20000314135432.1709.qmail@securityfocus.com

7. Firewall (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=Pine.GUL.4.21.0003142235580.21371-100000@red1.cac.washington.edu

8. TCP port 3218 (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=20000314232752.A6369@stwing.upenn.edu

9. Odd UPD scan (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=BC60D9A2A99CD311BB6B009027B09D2F02CE85@sea1sa02.punchnetworks.com

10. DUP packet replies at tvguide.com (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=200003151649.LAA18294@granger.mail.mindspring.net

11. Cracked; rootkit - entrapment question? (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-8&thread=D6C7B533F7C4D311BBD800001D121E7F0152D9@clmail.cmccontrols.com

12. pop-2 scanning (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-15&thread=20000315192246.524.qmail@securityfocus.com

13. Looking for Squid Proxies (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-15&thread=200003161445.GAA01133@cwsys.cwsent.com

14. TCP port 3218 (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-15&thread=XFMail.20000316120331.G.E.Fowler@lboro.ac.uk

15. what are these? (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-03-15&thread=XFMail.20000316232929.djk@tobit.co.uk


V. $B:#=5$N(B VULN-DEV RESEARCH LIST $B$+$i(B
- -------------------------------------

1. Unwanted automagic processing (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-8&thread=12UQKA-0005iM-00@gate.westel900.hu

2. MS Frontpage shtml.dll Path Leak Vulnerability (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-8&thread=JEENLNLIMOLKDGAHKOCHEEPODAAA.marc@eeye.com

3. Hotline (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-8&thread=NDBBJPBMKLJJBCHBNEAIOEIGCCAA.jlintz@optonline.net

4. Crashing Win9x (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-8&thread=20000315085426.29030.cpmta@c008.sfo.cp.net

5. NT 4.0 (Workstation) Logon Authentication Vulnerability (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-8&thread=NDBBIKOFOLKHBDNJIAKCEEJJCCAA.mrousseau@secured.org

6. Crashing Win9x with smbclient (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-8&thread=20000315104542.B28738@trillian.adap.org

7. Intel Corporation, Express 550 (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-8&thread=Pine.LNX.4.10.10003151605360.32739-100000@inetarena.com

8. spoofing the ethernet address (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-8&thread=Pine.GSO.4.21.0003151412230.21920-100000@campus

9. Linux Mandrake 6.1 PAM/userhelper exploit (Thread)
URL:
       http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-15&thread=38D169B5.5B1E1727@nitnet.com.br

10. Exploiting any network protocol with secondary data channels (Thread)
URL:
	http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-15&thread=38D1FECA.6954A347@enternet.se

11. Buffer overflow in AIM 3.5.1856 (Thread)
URL:
        http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-03-15&thread=38D52362.D0B1AEF2@rit.edu


VI.  $B5a?M>pJs(B ($BF|K\8lLu$J$7(B)
- ----------------------------

VII.  $B%;%-%e%j%F%#D4::(B
      2000-03-13 $B$+$i(B 2000-03-20 $B$^$G(B
- -------------------------------------
$Be$N%j%9%/$K(B
$B1F6A$rM?$($F$$$k$H;W$$$^$9$+(B?

$B2sEz(B:
RPC/DCOM					21% / 34 $BI<(B
Web (CGI $B$r4^$`(B)				28% / 45 $BI<(B
SSH						2% / 4 $BI<(B
FTP						5% / 8 $BI<(B
NFS/NETBIOS					20% / 32 $BI<(B
Telnet (telnet$B%5!<%S%9$NDs6!(B)			20% / 32 $BI<(B

$BA4EjIe0L(B6$B0L$N%D!<%k(B
       2000-03-13 $B$+$i(B 2000-03-20 $B$^$G(B
- -------------------------------------------
1. ShadowScan 1.00.093 (Windows 95/98 $B$*$h$S(B Windows NT)
$B:nhttp://www.rsh.kiev.ua

Shadow Advantis Administator Tools - Ping (SSPing)$B!"(BPort Scanner$B!"(BIP
Scanner$B!"(BSite Info ($B%?!<%2%C%H$GF0:n$7$F$$$k%5!<%S%9$NF1Dj(B)$B!"(BNetwork
Port Scanner$B!"(BTracert$B!"(BTelnet$B!"(BNslookup$B!"(BFinger$B!"(BEcho$B!"(BTime$B!"(BUPD test
File Info$B!"%U%!%$%kHf3S!"(BNetstat$B!"(BSysInfo$B!"(BCrypt$B!"%U%!%$%k$N(B CRC$B!"(B
DBF $B$N;2>H$HJT=8!"(BDiskInfo$B!"(BNTprocess$B!"(BKeyboard $B%F%9%H!"(BDNS info
Shadow Hack and Crack - WinNuke$B!"(BMail Bomber$B!"(BPOP3$B!&(BHTTP$B!&(BSOCKS$B!&(BFTP$B$N(B
$B%/%i%C%-%s%0(B($BC5::J}K!$K=>$C$?%Q%9%o!<%I$NF1Dj(B)$B!"(BUnix $B%Q%9%o!<%I%/%i%C%/!"(B
sendmail $B1[$7$N(B finger$B!"%P%C%U%!%*!<%P!<%U%m!2.  SecurityFocus.com Pager (Win95/98/NT)
$B:nhttp://www.securityfocus.com/pager/sf_pgr20.zip

$B$3$N%W%m%0%i%`$O%f!<%6$N3'MM$K%V%i%&%6$r3+$-!"%3%s%F%s%DFbMF$r3NG'$9$k(B
$B$3$H$J$7$K(B Security Focus $B$,Ds6!$9$k(B Web $B%5%$%H$KDI2C$5$l$?9`L\$r3NG'(B
$B$G$-$k4D6-$rDs6!$7$^$9!#(B
$B%P%C%/%0%i%&%s%I$G95$($J$,$i!"%f!<%6$,;XDj$7$?<~4|$G%3%s%F%s%D$r3NG'$7!"(B
$B%7%9%F%`%H%l%$Fb$NE@LG$9$k%"%$%3%s!"%]%C%W%"%C%W%a%C%;!<%8!"$3$l$i$NN>(B
$BJ}$GJQ99$r$*CN$i$;$7$^$9!#(B($BDLCNJ}K!$O@_Dj2DG=$G$9(B)

3. Cold Fusion Scan 1.0 (Win95/98/NT)
$B:nhttp://www.securityfocus.com/data/tools/cfscan.zip

Cold Fusion $B@HuBV$N(B Allaire Cold Fusion
$B$r;XDj$5$l$?%3%s%T%e!<%?L>!"%I%a%$%sL>Kh$K%9%-%c%s$r9T$C$FC5$7=P$9%D!<(B
$B%k$G$9!#(B

4. Atlas 1.0 (Win95/98)
$B:nhttp://www.securityfocus.com/data/tools/Atlas.zip

$B$3$N%D!<%k$O(B Windows $B$"$k$$$O(B MS-DOS $B$GF0:n$9$k(B CGI $B%9%-%c%J%W%m%0%i%`(B
$B$G(B 65 $B5. kfirewall 0.4.2 (Linux)
$B:nhttp://www.securityfocus.com/data/tools/kfirewall-0.4.2.tar.gz
        http://megaman.ypsilonia.net/kfirewall/

kfirewall $B$O(B GUI $B$rMxMQ$7$?(B ipchains $B$"$k$$$O(B Version 0.4.0 $B$r=|$/(B
ipfwadm $BMQ$N%U%m%s%H%(%s%I%W%m%0%i%`$G$9!#(B
($B$I$A$i$N%W%m%0%i%`$rMxMQ$9$k$+$O%+!<%M%k$N%P!<%8%g%s$K0MB8$7$^$9(B)
$B?WB.$K!"4JC1$K$4<+?H$N%3%s%T%e!<%?$r967b$+$iKI8n$G$-!"%]!<%H$r:I$0;v(B
$B$,2DG=$G$9!#(Bkfirewall $B$O4JC1$G$9$0$K$*;H$$D:$1$^$9!#(B

6. cgi scanner 3.6 (UNIX/PERL)
$B:nhttp://www.securityfocus.com/data/tools/auditing/network/cgichk3_6.tgz
        http://www.singnet.com.sg/~cksss/

Cgi Scanner 3.6 $B$O4{CN$N(B CGI $B$Ne$N%[%9%HKh$K%9%-%c%s(B
$B$9$k%7%s%W%k$J%W%m%0%i%`$G$9!#(BCGI $B%W%m%0%i%`$NH/8+Cf$KCxpJs$bhttp://www.lac.co.jp/security/>

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.5.3i for non-commercial use <http://www.pgpi.com>

iQA/AwUBONaRUpQwtHQKfXtrEQKorgCeOhYdL0V2rPwidy1nn0O8oMEZ60MAoJc6
oKeY4EoybK5ytfrN4jT4CjU+
=hSWl
-----END PGP SIGNATURE-----