SecurityFocus.com Newsletter #36 2000-03-31 -> 2000-04-06

To: BUGTRAQ-JP@SECURITYFOCUS.COM
Subject: SecurityFocus.com Newsletter #36 2000-03-31 -> 2000-04-06
From: SAKAI Yoriyuki <sakai@LAC.CO.JP>
Date: Tue, 11 Apr 2000 09:38:16 +0900
Reply-To: SAKAI Yoriyuki <sakai@LAC.CO.JP>
Sender: BUGTRAQ-JP List <BUGTRAQ-JP@SECURITYFOCUS.COM>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

$B:d0f(B@$B%i%C%/$G$9!#(B

SecurityFocus.com Newsletter $BBh(B 36 $B9f$NOBLu$r$*FO$1$7$^$9!#(B
$BLu$N$J$$9`L\$K$D$$$F$O!VF|K\8lLu$J$7!W$H$7$F6hJL$7$F$"$j$^$9!#(B
SecurityFocus.com Newsletter $B$K4X$9$k(BFAQ:
<URL: http://www.securityfocus.com/forums/sf-news/faq.html>
BugTraq-JP $B$K4X$9$k(B FAQ:
<URL: http://www.securityfocus.com/forums/bugtraq-jp/faq.html>

$BLuCm(B:
$B:#=5$N(B Newsletter $B$K$O!V%;%-%e%j%F%#D4::(B(SECURITY SURVEY RESULTS)$B!W$O(B
$B$"$j$^$;$s!#GQ;_$5$l$?$b$N$H9M$($i$l$^$9!#(B

- -----------------------------------------------------------------------
- -----------------------------------------------------------------------
$B0zMQ$K4X$9$kHw9M(B:
$B!&$3$NOBLu$O(B Security-Focus.com $B$N5v2D$r3t<02qe$G9T$o(B
  $B$l$F$$$^$9!#(B
$B!&(BSecurityFocus.com Newsletter $B$NOBLu$r(B Netnews, Mailinglist,
  World Wide Web, $B=q@R(B, $B$=$NB>$N5-O?G^BN$G0zMQ$5$l$k>l9g$K$O%a!<%k$N(B
  $BA4J80zMQ$r$*4j$$$7$^$9!#(B
$B!&F|K\8lHG%K%e!<%9%l%?!<(B 1 $B9f$+$i(B 3 $B9f$^$G$K$O$3$NHw9M$,IU$$$F$$$^$;(B
  $B$s$,=`MQ$9$k$b$N$H$7$^$9!#(B
$B!&$^$?!"(BSecurity-Focus.com $BDs6!$N(B BugTraq-JP $B%"!<%+%$%V(B [*1] $B$X$N$$$+(B
  $B$J$k7A<0$N%O%$%Q!<%j%s%/$b>e5-$K=`$8$F$/$@$5$$!#(B
1) <URL http://www.securityfocus.com/templates/archive.pike?list=79>
- -----------------------------------------------------------------------
- -----------------------------------------------------------------------
$B$3$NOBLu$K4X$9$kHw9M(B:
$B!&$3$NOBLu$NE,MQ@.2L$K$D$$$F3t<02qe0L(B6$B0L$N%D!<%k(B
    1. IISperms (NT)
    2. DynFw for ipchains 0.2.1 (Linux)
    3. Netsaint Console Monitor 0.50c (HP-UX, IRIX, Linux and Solaris)
    4. VTun (FreeBSD, Linux, NetBSD, OpenBSD and Solaris)
    5. Linux Trustees 1.6 (Linux)
    6. Sentinel Project 0.09 (FreeBSD, NetBSD and OpenBSD) V.
V. $B5a?M0FFb(B($BF|K\8lLu$J$7(B)
VI. $B:#=5$N(B INCIDENTS LIST $B$+$i(B
    1. Lots of DNS Exploit attempts (Thread)
    2. rooted by r0x - from address 212.177.241.127 (Thread)
    3. Scans on Port 98 (linuxconf) (Thread)
    4. Cracked by the Brazilians (Thread)
    5. Cracking tools and backdoors [was cracked by Brazilians]
       (Thread)
    6. Smurf/broadcast "pings" (Thread)
    7. Port 65535, again (Thread)
    8. connections from Microsoft to dns server? (Thread)
VII. $B:#=5$N(B VULN-DEV RESEARCH LIST $B$+$i(B
    1. Kill BIOS   (Thread)
    2. Windows: Local Security Workarounds-DD   (Thread)
    3. Award BIOS passwords (Thread)
    4. local security workaround through IE   (Thread)
VIII. $B:#=5$N(B MICROSOFT FOCUS LIST $B$+$i(B
    1. 2k with webhosting...?   (Thread)
    2. R: Nessus Scanner   (Thread)
    3. Nessus Scanner   (Thread)
    4. HELP.....any suggestions welcome.....   (Thread)
    6. Upcoming new pager (Thread)
    7. Home firewalling-one solution for NT (Thread)
    8. PcAnywhere weak password encryption (Thread)
    9. Server Tools (Thread)
    10. Home firewalling (Thread)
    11. Proxy Server on Windows 2000 (Thread)
    12. FW: PcAnywhere weak password encryption (Thread)
    13. Thanks for the Administrator Quotes (Thread)
    14. Need System Administrator Quotes   (Thread)


I. $B:#=5$N%O%$%i%$%H(B
- -------------------

SecurityFocus.com $B$,$*Aw$j$9$k=54)%K%e!<%:%l%?!1. SecurityFocus.com needs your opinion on our new pager application!
($BF|K\8lLu$J$7(B)

2. SecurityFocus.com is hiring!
($BF|K\8lLu$J$7(B)

2. Site Content Manager
($BF|K\8lLu$J$7(B)


3. $B$*CN$i$;(B

$B$*5$$E$-$N$3$H$H$O;W$$$^$9$,!"$3$N=54)%K%e!<%:%l%?!$C$F$9$0$K(B
$B$*FI$_$K$J$j$?$$9`L\$r8+$D$1=P$7$d$9$/$J$C$F$*$j!"FI$`$N$K$+$+$k;~4V$b(B
$B>/$J$/$J$C$F$$$^$9!#(B

$BB>$K%3%a%s%H$,$4$6$$$^$7$?$i$I$&$>(B ah@securityfocus.com ($B1Q8l(B) $B$^$G$*4s(B
$B$;$/$@$5$$!#(B

II. $B:#=5$N(B BUGTRAQ $B$+$i(B
- -------------------


1. MS Index Server '%20' ASP Source Disclosure Vulnerability
BugTraq ID: 1084
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-03-31
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1084
$B$^$H$a(B:

Index Server $B$,(B IIS $B>e$N(B ASP $B$N%=!<%9!"$*$h$SB>$N%5!<%P%5%$%I$G=hM}$5$l(B
$B$k%U%!%$%k$rI=<($7$F$7$^$&LdBj$,H/8+$5$l$?!#(B

$B$3$l$O%9%Z!<%9(B (URL $B%(%s%3!<%I$G$O(B %20) $B$r(B CiWebHitsFile $BJQ?t$G;XDj$5$l(B
$B$?%U%!%$%kL>$N8e$m$KIU2C$7!"(BCiHiliteType $BJQ?t$r(B "Full" $B$K@_Dj$7!"(B
CiRestriction $BJQ?t$r(B "None" $B$K@_Dj$9$k$3$H$G=hM}$5$l$kA0$N%=!<%9%U%!%$%k(B
$B$=$N$b$N$ro$N7ABV$H$O0[$J$k(B .htw $B%U%!%$%k$rMxMQ$7$?>l9g$G$b:F8=$9$k!#(B
$BDL>o$N7ABV$H$O0[$J$k(B .htw $B%U%!%$%k!"Nc$($P2>A[%U%!%$%k$N>l9g$N(B null.htw
$B$O%a%b%j$K5-21$5$l!"3HD%;R(B .htw $B$O%G%U%)%k%H$G(B webhits.dll $B$KBP1~$E$1$i(B
$B$l$F$$$k$+$i$G$"$k!#(B

2. Allaire Forums "rightAccessAllForums" Vulnerability
BugTraq ID: 1085
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-04-03
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1085
$B$^$H$a(B:

Allaire Forums 2.0.5 $B$G$O8"8B$r;}$?$J$$%f!<%6$,%;%-%e%"%9%l%C%I$r;2>H(B
$B$7$?$j5-;v$rEj9F$G$-$F$7$^$($kLdBj$,$"$k!#$3$l$O(B rightAccessAllForums
$BJQ?t$N3. FCheck Shell Metacharacter in Filename Vulnerability
BugTraq ID: 1086
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-04-03
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1086
$B$^$H$a(B:

FCheck $B$,(B -l $B%9%$%C%A$rMxMQ$7$F5/F0$5$l$?:]!"I8=`=PNO$KBe$($F(B syslog $B$X(B
$B%m%0FbMF$r=PNO$9$k!#$3$N:]!"(Bsystem() $B4X?t$r%U%!%$%kL>$r0z?t$K;H$C$F8F$S(B
$B=P$7$F$$$k!#$7$?$,$C$F!"%U%!%$%kL>$K%7%'%k$GMQ$$$i$l$k%a%?%-%c%i%/%?$,%3(B
$B%^%s%I$KB3$1$FM?$($i$l$?:]!"%3%^%s%I$O(B FCheck $B$HF10l$N8"8B$GF0:n$5$;$i$l(B
$B$F$7$^$&!#(B($BB?$/$N>l9g!"(Broot $B$G$"$k(B)
FCheck $B$G4F;k$5$l$k%U%!%$%k%7%9%F%`Fb$K%U%!%$%k$r:n@.$G$-$k%f!<%6$OC/$G(B
$B$"$C$F$b$3$NLdBj$rFM$$$?967b$,2DG=$G$"$k!#(B

4. Microsoft Excel XML Vulnerability
BugTraq ID: 1087
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-04-03
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1087
$B$^$H$a(B:

$BDL>o!"(BMicrosoft Excel $B$O%f!<%6$,8=:_;HMQ>uBV$N%9%W%l%C%I%7!<%H30$K$"$k(B
$B%^%/%mF~$j$N%U%!%$%k$r3+$3$&$H$9$k:]$K7Y9p%@%$%"%m%0$r=P$9!#$7$+$7!"(B
$B30It$N%F%-%9%H%U%!%$%k$K(B Excel 4.0 Macro Language (XML) $B$G=q$+$l$?%^%/%m(B
$B$r4^$`%^%/%mF~$j$N%U%!%$%k$r3+$/:]$K$O7Y9p%@%$%"%m%0$O=PNO$5$l$J$$$N$G(B
$B$"$k!#$3$N8=>]$O(B Excel $B$G!V9b$$%;%-%e%j%F%#>uBV!W$N%*%W%7%g%s$r%f!<%6$,(B
$B@_Dj$7$F$$$?>l9g$K$b@8$8$k$?$a!"$3$N%*%W%7%g%s$r@_Dj$7$F$$$?>l9g$K$b!"$3(B
$B$NLdBj$N1F6A$r5. Real Networks RealPlayer 6/7 Location Buffer Overflow Vulnerability
BugTraq ID: 1088
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-04-03
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1088
$B$^$H$a(B:

Real Networks RealPlayer 6.0 $B$*$h$S(B 7.0 $B$N(B location $B%U%#!<%k%I$r=hM}$9$k(B
$B%3!<%I$K$OL$%A%'%C%/$N%P%C%U%!$,4^$^$l$F$$$k!#$3$N$?$a(B 300 $BJ8;z0J>e$NJ8;z(B
$BNs$r4^$`(B URL $B$N%j%/%(%9%H$r9T$&$3$H$K$h$j%"%W%j%1!<%7%g%s$r%/%i%C%7%e$5$;!"(B
$BDL>o$NF0:n>uBV$XI|5l$5$;$k$K$O%=%U%H%&%'%"$N:F5/F0$rI,MW$J>uBV$K$5$;$F$7(B
$B$^$&!#$3$NLdBj$rMxMQ$7!"0U?^E*$J%3!<%I$Nl9g$K!"%j%b!<%H$+$i$b967b2DG=!"$H$$$&$3$H$G$"$k!#$3$N(B
$B>l9g!"(BRealPlayer$B$H6&$KF0:n$7$F$$$k(B Web $B%V%i%&%6$b%/%i%C%7%e$7!"DL>o$NF0(B
$B:n>uBV$KI|5"$9$k$?$a$K%=%U%H%&%'%"$N:F5/F0$,I,MW$G$"$k!#(B

6. SalesLogix eViewer DoS Vulnerability
BugTraq ID: 1089
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-03-31
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1089
$B$^$H$a(B:

SalesLogix eViewer $B$O(B SalesLogix 2000 $B%Q%C%1!<%8$K4^$^$l$k(B Web $B%"%W%j%1!<(B
$B%7%g%s$G$"$k!#(B

$B$3$N%=%U%H%&%'%"$O(B URL $B$r;H$C$FD>@\4IM}MQ%3%^%s%I$,;XDj$5$l$?:]!"$J$s$i(B
$BG'>Z$r9T$o$J$$$N$G$"$k!#0J2<$N(B URL $B$K<($7$?Nc$G$O%W%m%0%i%`$N%7%c%C%H%@(B
$B%&%sF0:n$,9T$o$l$k!#(B

http:&nbsp;//target/scripts/slxweb.dll/admin?command=shutdown

$B%7%c%C%H%@%&%s%3%^%s%I0J30$N%3%^%s%I$b%j%b!<%H$N%f!<%6$+$iF1MM$K;X<($,9T(B
$B$($k2DG=@-$,$"$k!#(B

$BDI5-(B:
$B$3$NLdBj$G<($5$l$?4IM}$r9T$&$?$a$N%W%m%0%i%`(B (slxweb.dll) $B$O%G%U%)%k%H$G(B
/scripts $B%G%#%l%/%H%j$K%$%s%9%H!<%k$5$l!"B>$N%G%#%l%/%H%j$X$O0\F0$G$-$J$$(B
$B$N$G$"$k!#$3$N!"%;%-%e%j%F%#>e$NLdBj$K$D$$$F$5$i$KIU$12C$($k$J$i$P!"$3$N(B
$B%Q%C%1!<%8$O(B Microsoft IIS $B$N%G%U%)%k%H$NF?L>%f!<%6L>(B (IUSR_{systemname})
$B$r(B slxwebuser $B$KJQ99$7!"$3$N%f!<%6$K(B Administration $B8"8B$rM?$($k@_Dj$rI,(B
$B?\$H$7$F$$$k!#(B

7. HP VirtualVault Aliased IP Addresses Vulnerability
BugTraq ID: 1090
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-04-06
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1090
$B$^$H$a(B:

HP $B$N(B VirtualVault $B$O(B Web $B%5!<%P$N>.J,$15!G=$r(B ($BLuCm(B: $B2>A[(B Web $B%5!<%PEy(B
$B$NDs6!$N$?$a$K0l$D$N(B Web $B%5!<%P$rJ#?t$K6h@Z$j!"3F6h@Z$C$?%5!<%P$,0lBf$N(B
Web $B%5!<%P$K8+$;$+$1$k$3$H$,2DG=$J@=IJ$G$"$k$H9M$($i$l$^$9(B) $Bl9g!"%M%C%H%o!<(B
$B%/%$%s%?%U%'!<%9$r7PM3$7$FL58"8B$N%G!<%?$NF~NO$r9T$($F$7$^$($kLdBj$,$"$k!#(B

8. Nbase-Xyplex EdgeBlaster DoS Vulnerability
BugTraq ID: 1091
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-04-06
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1091
$B$^$H$a(B:

NBase-Xyplex EdgeBlaster $B%k!<%?$O(B Form $B$r;H$C$FEE;R%a!<%k$r:9$7=P$9(B CGI
$B%W%m%0%i%`$N$NL\$K8+$($k>Z5r$O$J$/!"5!G=$rI|5l$5(B
$B$;$k$?$a$K$O%k!<%?$N:F5/F0$,I,MW$G$"$k!#(B

9. IBM ikeyman Java Class Creation Vulnerability
BugTraq ID: 1092
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-04-06
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1092
$B$^$H$a(B:

Solaris $B$H6&$KDs6!$5$l$k(B IBM $B$N(B IBMHSSB $B%Q%C%1!<%8$O(B IBM Web $B%5!<%P$K(B
SSL $B5!G=$rDs6!$9$k$b$N$G$"$k!#$3$N%Q%C%1!<%8$K$O%7%'%k%9%/%j%W%H$,4^$^(B
$B$l(B (/usr/bin/ikeyman)$B!"%G%U%)%k%H$G(B SUID $B>uBV$G$"$j!"%f!<%6$N(B CLASSPATH
$B$r10. Symantec pcAnywhere Weak Encryption Vulnerability
BugTraq ID: 1093
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-04-06
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1093
$B$^$H$a(B:

Symantec pcAnyware $B$O$H%Q%9%o!<%I$rEAAw$C$F!"C/$G$"$C$F$b(B NT $B%I%a%$%s%3%s%H%m!<%i$H(B pcAnyware $B$,F0:n$7$F(B
$B$$$k%3%s%T%e!<%?$H$N4V$N%M%C%H%o!<%/$rEpD0$9$k;v$G!"%f!<%6L>$H%Q%9%o!<%I(B
$B$rF~$H%Q%9%o!<%I$GG'>Z2DG=$G$"$k$,!"(B
$B$3$N>l9g!"LdBj$,$"$k0E9f2=$5$l$?G'>Z11. Ipswitch IMail Server 5.x/6.x DoS Vulnerability
BugTraq ID: 1094
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-04-06
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1094
$B$^$H$a(B:

IMail $B$NG'>Zl9g!"(BIMail $B$O0lEY$K(B1$B?M$N%f!<%6$7$+G'>Z$G$-$J$$$?$a!"(B
$BB>$N%f!<%6$NG'>Z$,$G$-$J$/$J$C$F$7$^$&$N$G$"$k!#(B

$B%/%i%$%"%s%H$,%3%M%/%7%g%s$r%?%$%`%"%&%H$5$;$?>l9g$K$O(BIMail$B$N5!G=$OI|5l(B
$B$9$k$,!"$=$l0J30$N1. 911 Virus hits Houston

$BJF9q%F%-%5%9=#$N(B FBI $B;YIt$O%&%#%k%9BP:v$X$N;Y1g$rMW@A$7$?!#(B

URL: http://www.securityfocus.com/news/14

2. Building in Big Brother

FBI $B6ID9(B Louis Freeh $B$OBP:v$9$k$KCM$9$k%5%$%P!<%"%?%C%/$N9J$j=P$7J}$rCN$C(B
$B$F$$$k!#(B

URL: http://www.securityfocus.com/commentary/13

3. "Copyright War" Declared

$B%H%m%s%H$K$*$$$F!"EE;R<+M3http://www.securityfocus.com/news/15


IV. Security Focus $B$N>e0L(B6$B0L$N%D!<%k(B
- ------------------------------------

1. IISperms (NT)
$B:nhttp://www.securityfocus.com/data/tools/auditing/host/iisperms.exe

IIS $B$N%;%-%e%j%F%#LdBj$N%H%i%V%k%7%e!<%F%#%s%0$r=u$1$k$?$a$N!VLdEz7?!W(B
$B%D!<%k(B $B$,(B Dynamic HTML (DHTML) $B$rMxMQ$7$?%f!<%F%#%j%F%#$H$7$FDs6!$5$l(B
$B$F$$$^$9!#(B


2. DynFw for ipchains 0.2.1 (Linux)
$BCxhttp://www.securityfocus.com/data/tools/dynfw.tgz

DynFW for ipchains constantly checks /var/log/messages for packets denied
by ipchains and responds by temporarily setting up firewallrules that deny
any access from the originating IPs. Optionally it can do an ident lookup
before setting up the rules.

DynFW for ipchains $B$O(B ipchain $B$K$h$C$F5qH]$5$l$?%Q%1%C%H$r5-O?$7$F$$$k(B
/var/log/messages $B$rDj>oE*$K%A%'%C%/$9$k%f!<%F%#%j%F%#$G!"(B IP $B%Q%1%C%H$NAw(B
$B$j85$+$i$N$$$+$J$k%"%/%;%9$r5qH]$9$k!"%U%!%$%d%&%)!<%k$N%k!<%k$N0l;~E*$J@_(B
$BDj5!G=$rDs6!$7$^$9!#%*%W%7%g%s$G%k!<%k@_DjA0$K(B ident $B$r;H$C$?;2>H$r9T$&$3(B
$B$H$b2DG=$G$9!#(B

3. Netsaint Console Monitor 0.50c (HP-UX, IRIX, Linux $B$*$h$S(B Solaris)
$B:nhttp://www.securityfocus.com/data/tools/nsc-0.50c.tar.gz

Netsaint Console Monitor (NSC) $B$O(B Netsaint $BMQ$N(B curse $B%i%$%V%i%j$r;H$C(B
$B$?%3%s%=!<%k$b;w$?%W%m%0%i%`$G$9!#9b2A$J5!G=$d(B GUI $B$r;H$o$:$K(B Netsaint
$B%5!<%S%9$,4F;k2DG=$K$J$j$^$9!#(B

4. VTun (FreeBSD, Linux, NetBSD, OpenBSD $B$*$h$S(B Solaris)
$B:nhttp://www.securityfocus.com/external/http%3a%2f%2fvtun.sourceforge.net%2f

VTun $B$O%H%i%U%#%C%/$N@)8B!"05=L!"0E9f2=$r(B TCP/IP $B%M%C%H%o!<%/>e$GMF0W$K(B
$B9T$($kMM$K$9$k2>A[%H%s%M%k$r:n@.$9$k$?$a$N%D!<%k$G$9!#$3$N%D!<%k$O%f!<%6(B
$B6u4V$GF0:n$7!"$$$+$J$k%+!<%M%kFb$N2~JQ$OITMW$G$9!#(BVTun $B$O(B IP, PPP, SLIP,
Ethernet $B>e$N$=$NB>$N%H%s%M%k2=$7$?$$%W%m%H%3!<%k$r%5%]!<%H$7$F$$$^$9!#(B
VTun $B$O4JC1$G9b$$A`:n@-$r;}$A!"MM!9$J%M%C%H%o!<%/$NMxMQ!"Nc$($P(B VPN$B!"(B
Mobile IP$B!"@)8BIU$-%$%s%?!<%M%C%H$X$N%"%/%;%9!"(BIP$B%"%I%l%9$NJ]8n$J$I$K(B
$BMxMQ2DG=$G$9!#(B

5. Linux Trustees 1.6 (Linux)
$B:nhttp://www.securityfocus.com/data/tools/trustees.16.tgz

$B$3$N%W%m%8%'%/%H$No$N%G%#%l%/%H%j$X$N%"%/%;%9$r$"$k%f!<%6$d%0%k!<%W(B($B$"$k$$$O!"(B
$B$"$k%f!<%6$d%0%k!<%W0J30$K(B) $B$KBP$7$F5v2D$5$l$k$+!"IT5v2D$H$J$k$+$r4IM}(B
$B2DG=$G$9!#(B

6. Sentinel Project 0.09 (FreeBSD, NetBSD and OpenBSD)
$B:nhttp://www.securityfocus.com/data/tools/sentinel-0.09.tar.gz

The Sentinel project is designed to be a portable, accurate implementation
of all publicly known promiscuous detection techniques. Sentinel currently
supports 3 methods of remote promiscuous detection: The DNS test,
Etherping test, and ARP test. Support for the ICMP Ping Latency test is
under development.

V. $B5a?M0FFb(B($BF|K\8l$J$7(B)
- -----------------------

VI. $B:#=5$N(B INCIDENTS LIST $B$+$i(B
- ------------------------------

1. Lots of DNS Exploit attempts (Thread)
$B4XO"$9$k(BURL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-04-01&Thread=38E89070.C9B6D2DE@rt1solutions.com

2. rooted by r0x - from address 212.177.241.127 (Thread)
$B4XO"$9$k(BURL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-04-01&Thread=Pine.LNX.4.10.10004040839050.8710-100000@ratbert.west.fibres.net

3. Scans on Port 98 (linuxconf) (Thread)
$B4XO"$9$k(BURL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-04-01&Thread=Pine.LNX.4.21.0004041103090.12854-100000@enki.corp.icopyright.com

4. Cracked by the Brazilians (Thread)
$B4XO"$9$k(BURL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-04-01&Thread=20000404182322.4545.qmail@web617.mail.yahoo.com

5. Cracking tools and backdoors [was cracked by Brazilians] (Thread)
$B4XO"$9$k(BURL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-04-01&Thread=Pine.GUL.4.21.0004041524140.24547-100000@red6.cac.washington.edu

6. Smurf/broadcast "pings" (Thread)
$B4XO"$9$k(BURL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-04-01&Thread=38EAFED2.20065.A800BE2@localhost

6. Port 65535, again (Thread)
$B4XO"$9$k(BURL:
        http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-04-01&Thread=20000406080303.25319.qmail@securityfocus.com

7. connections from Microsoft to dns server? (Thread)
$B4XO"$9$k(BURL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-04-01&Thread=Pine.LNX.4.21.0004061259090.12828-100000@doit.scorpions.net


VII. $B:#=5$N(B VULN-DEV RESEARCH LIST $B$+$i(B
- ---------------------------------------

1. Kill BIOS   (Thread)
 $B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-04-08&Thread=20000408123116.35874.qmail@hotmail.com

 2. Windows: Local Security Workarounds-DD   (Thread)
 $B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-04-08&Thread=Pine.LNX.4.10.10004081442340.25710-100000@blue.localdomain

 3. Award BIOS passwords (was Re: local security workaround through IE)   (Thread)
 $B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-04-08&Thread=Pine.LNX.4.10.10004081408080.25652-100000@blue.localdomain

 4. local security workaround through IE   (Thread)
 $B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-04-08&Thread=LPBBKHCMGBAMFCHNILDPEECBCAAA.andrew@mmedia.fsnet.co.uk


VIII. $B:#=5$N(B MICROSOFT FOCUS LIST $B$+$i(B
- --------------------------------------

1. 2k with webhosting...?   (Thread)
 $B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=EB38DE1BACC4D311BC24009027DE90983153EC@WLGEXCH1

2. R: Nessus Scanner   (Thread)
$B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=024a01bfa0a0$93be7f90$3b0a00b9@ntroden

3. Nessus Scanner   (Thread)
$B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=NEBBIMNLEKHAHDIIPMDJKEBICAAA.hispase@hispasecurity.com

4. HELP.....any suggestions welcome.....   (Thread)
$B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=020401bfa0e2$2f2eea00$6412a6d8@pdapowerr9zjbv

6. Upcoming new pager   (Thread)
$B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=Pine.GSO.4.21.0004071449500.12317-100000@mail

7. Home firewalling-one solution for NT   (Thread)
$B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=Pine.GSO.4.21.0004071302460.12317-100000@mail

8. PcAnywhere weak password encryption   (Thread)
$B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=4.3.1.2.20000407104422.03f67c10@cic-mail.lanl.gov

9. Server Tools   (Thread)
$B4XO"$9$k(BURL:
     http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=38ED42FE.68F41A3F@worldnet.att.net

10. Home firewalling   (Thread)
$B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=001801bfa000$c20b2e20$5e17433f@tidalwave.net

11. Proxy Server on Windows 2000   (Thread)
 $B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=E0F49F2A14BDD111978E00A0C9B322FE110237@SIDNTFS2

12. FW: PcAnywhere weak password encryption   (Thread)
 $B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=JEENLNLIMOLKDGAHKOCHGEJKDGAA.marc@eeye.com

13. Thanks for the Administrator Quotes   (Thread)
 $B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=862568B9.0057E4CA.00@unlnotes01.unl.edu

14. Need System Administrator Quotes   (Thread)
 $B4XO"$9$k(BURL:
      http://www.securityfocus.com/templates/archive.pike?list=88&date=2000-04-02&Thread=862568B7.0055DF00.00@unlnotes01.unl.edu

Translated by SAKAI Yoriyuki, UCHIDA Norimiti / LAC
<URL: http://www.lac.co.jp/security/>

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.5.3i for non-commercial use <http://www.pgpi.com>

iQA/AwUBOPH1aZQwtHQKfXtrEQJI8ACgww+NG0toDOCkxAl//Pgd3sQxPD0AnirN
/fDNfEFhSwCH6EnjiB915mWo
=qDdP
-----END PGP SIGNATURE-----