SecurityFocus.com Newsletter #62 2000-09-29->2000-10-05

To: BUGTRAQ-JP@SECURITYFOCUS.COM
Subject: SecurityFocus.com Newsletter #62 2000-09-29->2000-10-05
From: SAKAI Yoriyuki <sakai@LAC.CO.JP>
Date: Tue, 10 Oct 2000 19:33:05 +0900
Reply-To: SAKAI Yoriyuki <sakai@LAC.CO.JP>
Sender: BUGTRAQ-JP List <BUGTRAQ-JP@SECURITYFOCUS.COM>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

$B:d0f(B@$B%i%C%/$G$9!#(B

SecurityFocus.com Newsletter $BBh(B 62 $B9f$NOBLu$r$*FO$1$7$^$9!#(B
$BLu$N$J$$9`L\$K$D$$$F$O!VF|K\8lLu$J$7!W$H$7$F6hJL$7$F$"$j$^$9!#(B

- --------------------------------------------------------------------------
SecurityFocus.com Newsletter $B$K4X$9$k(BFAQ:
<URL: http://www.securityfocus.com/forums/sf-news/faq.html>
BugTraq-JP $B$K4X$9$k(B FAQ:
<URL: http://www.securityfocus.com/forums/bugtraq-jp/faq.html>
- --------------------------------------------------------------------------
$B0zMQ$K4X$9$kHw9M(B:
$B!&$3$NOBLu$O(B Security-Focus.com $B$N5v2D$r3t<02qe$G9T$o(B
  $B$l$F$$$^$9!#(B
$B!&(BSecurityFocus.com Newsletter $B$NOBLu$r(B Netnews, Mailinglist,
  World Wide Web, $B=q@R(B, $B$=$NB>$N5-O?G^BN$G0zMQ$5$l$k>l9g$K$O%a!<%k$N(B
  $BA4J80zMQ$r$*4j$$$7$^$9!#(B
$B!&F|K\8lHG%K%e!<%9%l%?!<(B 1 $B9f$+$i(B 3 $B9f$^$G$K$O$3$NHw9M$,IU$$$F$$$^$;(B
  $B$s$,=`MQ$9$k$b$N$H$7$^$9!#(B
$B!&$^$?!"(BSecurity-Focus.com $BDs6!$N(B BugTraq-JP $B%"!<%+%$%V(B [*1] $B$X$N$$$+(B
  $B$J$k7A<0$N%O%$%Q!<%j%s%/$b>e5-$K=`$8$F$/$@$5$$!#(B
1) <URL http://www.securityfocus.com/templates/archive.pike?list=79>
- --------------------------------------------------------------------------
- --------------------------------------------------------------------------
$B$3$NOBLu$K4X$9$kHw9M(B:
$B!&$3$NOBLu$NE,MQ@.2L$K$D$$$F3t<02ql9g!"(BBUGTRAQ-JP $B$X(B Errata $B$H$7$F=$@5(B
  $BHG$r$4Ej9FD:$/$+!"Lul9g$K$O=$@5HG$r$G$-$k$@$1?WB.$KH/9T$7$^$9!#(B
- --------------------------------------------------------------------------
- --------------------------------------------------------------------------

$B86HG(B:
Message-ID:  <Pine.GSO.4.21.0010091136040.15078-100000@mail>
Date:         Mon, 9 Oct 2000 11:38:27 -0700

SecurityFocus.com Newsletter #62
- ---------------------------------
I. FRONT AND CENTER($BF|K\8lLu$J$7(B)
	1. Linux Focus Area: Clear Text Communication - Slaying the Beast

II. BUGTRAQ SUMMARY
	1. Apache Rewrite Arbitrary File Disclosure Vulnerability
	2. Microsoft Windows 2000 Simplified Chinese IME Vulnerability
	3. Slashcode Default Admin Password Vulnerability
	4. WebTeacher WebData File Import Vulnerability
	5. Smartwin Technology CyberOffice Shopping Cart 2.0 Price...
	6. SmartWin CyberOffice Shopping Cart 2.0 Client Information...
	7. Mandrake X session Local Xauthority Bypass Vulnerability
	8. XFCE 3.5.1 Local Xauthority Bypass Vulnerability
	9. Acme thttpd Arbitrary World-Readable File Disclosure Vulnerability
	10. Pegasus Email File Forwarding Vulnerability
	11. LBNL Traceroute Heap Corruption Vulnerability
	12. TrendMicro PC-Cillin DoS Vulnerability
	13. Bardon Data Systems WinU Weak Encrypted Password Vulnerability
	14. scp File Create/Overwrite Vulnerability
	15. Microsoft Windows NT 4.0 Invalid LPC Request DoS Vulnerability
	16. Multiple Vendor BSD libutil pw_error() Format String Vulnerability
	17. Microsoft Windows NT 4.0 / 2000 LPC Zone Memory Depletion DoS Vuln
	18. Multiple Vendor BSD fstat Format String Vulnerability
	19. AOL Instant Messenger DoS Vulnerability
	20. Microsoft Windows NT 4.0 / 2000 Predictable LPC Message...
	21. Multiple Vendor rpc.ypupdated Vulnerability
	22. Pegasus Mail Buffer Overflow Vulnerability
	23. IRIX permissions File Manipulation Vulnerability
	24. Multiple Vendor BSD eeprom Format String vulnerability
	25. Microsoft Windows NT 4.0 / 2000 Spoofed LPC Request Vulnerability
	26. Microsoft IE / Outlook com.ms.activeX.ActiveXComponent Arbitrary...
	27. OpenBSD photurisd Format String Vulnerability
	28. Microsoft IIS 5.0 Indexed Directory Disclosure Vulnerability
	29. Multiple Vendor Cfengine Format String Vulnerability
	30. Microsoft Windows 2000 Unattended Install OEMPreinstall Vuln
	31. OpenBSD Pending ARP Request Remote DoS Vulnerability
	32. Multiple Vendor MIME Header DoS Vulnerability
	33. GnoRPM Arbitrary File Overwrite Vulnerability
	34. Moreover.com CGI File Disclosure Vulnerability
	35. IBM WebSphere ikeyman Weak Encrypted Password Vulnerability

III. SECURITYFOCUS.COM NEWS ARTICLES
	1. Carnivore Details Emerge
	2. U.S. Picks New Encryption Standard

IV.SECURITY FOCUS TOP 6 TOOLS
	1. Samhain 0.9.5
	2. BUGS 3.4.3
	3. Linux Intrusion Detection System (LIDS) 0.9.9
	4. Snorticus 1.0
	5. The Coroner's Toolkit (TCT) 1.03
	6. Bcrypt 2.3


I. FRONT AND CENTER($BF|K\8lLu$J$7(B)
- ---------------------------------

II. BUGTRAQ SUMMARY
- -------------------

1. Apache Rewrite Arbitrary File Disclosure Vulnerability
BugTraq ID: 1728
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-09-29
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1728
$B$^$H$a(B:

mod_rewrite $B$O(B Apache 1.2 $B$*$h$S$=$l0J9_$NHG$K4^$^$l$k%b%8%e!<%k$G$"$k!#(B
$B$3$l$OFCJL$J(B URL $B$r(B Web $B%5!<%P>e$N%U%!%$%k%7%9%F%`Fb$K$"$k%U%!%$%k$XBP(B
$B1~$E$1$k$?$a$KMQ$$$i$l$F$$$k!#(B

$B$b$7!"(BRewriteRule $B%G%#%l%/%F%#%V$,@55,I=8=$r4^$`$h$&$J%U%!%$%k$XBP1~$E(B
$B$1$i$l$F$$$k>l9g!"$3$N7k2L!"967be$N%U%!%$%k$,;2>H$G$-$k$h$&(B
$B$K$J$C$F$7$^$&!#(B

RewriteRule $B%G%#%l%/%F%#%V$NNc(B: ($B:G=i$N9T$,LdBj$H$J$jF@$kNc$G$"$k(B)

RewriteRule	/test/(.*)		/usr/local/data/test-stuff/$1
RewriteRule	/more-icons/(.*)		/icons/$1
RewriteRule	/go/(.*)		http://www.apacheweek.com/$1

($B$J$*!"$3$N>pJs$O(B Apache development $B%j%9%H$N(B 09-22 $B$K0M$C$?(B)

2. Microsoft Windows 2000 Simplified Chinese IME Vulnerability
BugTraq ID: 1729
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-09-29
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1729
$B$^$H$a(B:

Input Method Editor $B$H$OI8=`E*$J(B 101 $B%-!<%\!<%I$GI=0UJ8;z(B($BNc$($PCf9q8l!"(B
$B4Z9q8l(B)$B$NF~NO$r2DG=$K$9$k%=%U%H%&%'%"$G$"$k!#J*M}E*!"$"$k$$$O2>A[E*(B
($BNc$($P!"(BTerminai Server $B$N%;%C%7%g%s$r2p$7$F(B)$B$K4JBN;zMQ$NCf9q8l(B IME $B$,(B
$B%$%s%9%H!<%k$5$l$F$$$k(B Windows 2000 $B$K%"%/%;%92DG=$J!"$$$+$J$k%f!<%6$,(B
LocalSystem $B$N8"8B$G!"$=$&$"$k$Y$-$$$+$J$ko!"(BIME $B$O$"$kFCDj$N%f!<%6$N%;%-%e%j%F%#8"8B2<$GF0:n$7$J$1$l$P$J$i$J(B
$B$$!#$7$+$7!"%m%0%*%s2hLL$N=hM}Cf$K$*$$$F!"4JBN;zMQ$NCf9q8l(B IME $B$O(B
LocalSystem $B$N8"8B(B ($B$3$l$O(B OS $B$N8"8B$G$"$k(B) $B$GF0:n$7!"L$%m%0%*%s>uBV$N(B
$B%f!<%6$X$OMxMQ$5$;$F$O$J$i$J$$5!G=$rI=<($7$F$7$^$&$N$G$"$k!#(B
$B$3$NLdBj$N$?$a!"$$$+$J$k%f!<%6$,%f!<%6L>$*$h$S%Q%9%o!<%I$rF~NO$9$k$3$H(B
$B$J$/%$%s%?%i%/%F%#%V$K%7%9%F%`$X%m%0%*%s2DG=$J$N$G$"$k!#$3$NLdBj$rFM$$(B
$B$?967b$,@.8y$7$?>l9g!"%7%9%F%`$X$N%U%k%"%/%;%9!"%7%9%F%`$N40A4$J8"8BC%(B
$Bl9g$K$N$_!"1Q8l(B
$BHG$N(B Windows 2000 $B$G$bF1MM$NLdBj$,9M$($i$l$k!#%7%9%F%`%;%C%H%"%C%W;~$K(B
$BAH$_9~$^$l$F$$$J$$>l9g$K$O!"1Q8lHG$O$3$NLdBj$N1F6A$r3. Slashcode Default Admin Password Vulnerability
BugTraq ID: 1731
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-09-29
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1731
$B$^$H$a(B:

Slashcode $B$O7G<(HD!"%a%C%;!<%8%\!<%I%7%9%F%`$H$7$F@_7W$5$l$?%G!<%?%Y!<(B
$B%9$G$"$k!#(B

Slashcode $B$N%$%s%9%H!<%k;~$K$O%G%U%)%k%H%Q%9%o!<%I$r4IM}$O(B God $B$G$"$j!"(Bauthor $B$"$k$$$O(B author1 $B$,JQ99$5$l$F$$$J$$(B
$B>l9g$N%G%U%)%k%H$N%Q%9%o!<%I$G$"$k!#(B

$B$3$NLdBj$rFM$$$?967b$,@.8y$7$?>l9g!"%f!<%6$O4IM}4. WebTeacher WebData File Import Vulnerability
BugTraq ID: 1732
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-02
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1732
$B$^$H$a(B:

WebTeacher WebData $B$O(B World Wide Web $B;q8;Fb$rC5::$9$k%G!<%?%Y!<%9%W%m%0(B
$B%i%`$G$"$k!#(B

WebData $B$X@5Ev$J%"%+%&%s%H$r;}$D$$$+$J$k%f!<%6$O(B WebData $B%G%#%l%/%H%j$X(B
$B%7%9%F%`Fb$N%"%/%;%92DG=$J$$$+$J$k%U%!%$%k$r%$%s%]!<%H$G$-$k2DG=@-$,$"$k(B
$BLdBj$,$"$k!#$3$l$O!"%f!<%6$,(B / $B%G%#%l%/%H%j0J2<$N$$$+$J$k%U%!%$%k$X!"%G!<(B
$B%?%Y!<%9$r2p$7$F!"Nc$((B WebData $B$,FCDj$N%U%!%$%k$X%"%/%;%9$9$kMM$K@_Dj$5(B
$B$l$F$$$?$H$7$F$b!"%"%/%;%9$G$-$k$3$H$,>Z5r$H$J$k!#(B
$B%$%s%]!<%H5!G=$ODL>o!"%U%!%$%k$N%G!<%?%Y!<%9$X$N%"%C%W%m!<%I$r8BDj$5$l$?(B
$B%f!<%6$,2DG=$H$7$F$*$/$Y$-$G$"$k!#$7$+$7!"$3$N%=%U%H%&%'%"$G$O$$$+$J$k%U%!(B
$B%$%k$G$"$C$F$b%5!<%P$X%$%s%]!<%H$G$-$F$7$^$($k$N$G$"$k!#(B

5. Smartwin Technology CyberOffice Shopping Cart 2.0 Price Modification Vuln
BugTraq ID: 1733
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-02
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1733
$B$^$H$a(B:

Smartwin Technology CyberOffice Shopping Cart $B$OEE;R>&e$GDs6!$9$k%"%W%j%1!<%7%g(B
$B%s$G$"$k!#(B

$B$7$+$7!"$3$N%=%U%H%&%'%"$NCmJ8%U%)!<%`$O%m!<%+%k$X%U%)!<%`$r%@%&%s%m!<%I(B
$B$9%?!<%2%C%H$X?7$7$$CM$rF~$l$?>e$G:FEYCmJ8=hM}$r9T$&$3$H$G!"MF0W$K2~JQ2D(B
$BG=$G$"$k!#(B
$B3F>&IJ$N2A3JKh$NNL$O$$$+$J$k0U?^$7$?CM$XCV49$(2DG=$G$"$k!#(B

6. SmartWin CyberOffice Shopping Cart 2.0 Client Information Disclosure Vuln
BugTraq ID: 1734
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-02
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1734
$B$^$H$a(B:

Smartwin Technology CyberOffice Shopping Cart $B$OEE;R>&e$GDs6!$9$k%"%W%j%1!<%7%g(B
$B%s$G$"$k!#(B

$B$7$+$7!"$3$N%"%W%j%1!<%7%g%s$rF0:n$7$F$$$k(B Web $B%5%$%HFb$N(B _private $B%G%#(B
$B%l%/%H%j$X%j%b!<%H$N%f!<%6$,FI$_=P$72DG=$H$$$&LdBj$,B8:_$9$k!#(B
$B%G%U%)%k%H$G(B _private $B%G%#%l%/%H%j$K$O$I$N$h$&$J%f!<%6$KBP$7$F$G$bFI$_(B
$B=P$72DG=$J8"8B$,M?$($i$l$F$$$k!#$3$N%G%#%l%/%H%j$X$O8\5R$NHkL)>pJs(B
($B8\5R$NCmJ8>pJs!"0E9f2=$5$l$F$$$J$$%/%l%8%C%H%+!<%I>pJsEy(B)$B$,(B Microsoft
Access $B7A<0$G3JG<$5$l!"$3$l$O967bhttp://target/_private/shopping_cart.mdb" $B$X%"%/%;%9$9$k$@$1$G$h$$!#(B

7. Mandrake X session Local Xauthority Bypass Vulnerability
BugTraq ID: 1735
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-09-29
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1735
$B$^$H$a(B:

Mandrake 7.1 $B$K4^$^$l$k(B X11 $B5/F0MQ%9%/%j%W%H(B (/etc/X11/Xsession) $B$K$O(B
xhost + localhost $B$H$$$&9T$,4^$^$l$k!#$3$l$O(B localhost $B$KBP$7$F$O(B
Xauthority $B5!9=$r;HMQDd;_$7!"(Blocalhost $B$N$$$+$J$k%f!<%6$N(B X $B%/%i%$%"(B
$B%s%H$O(B X $B$X@\B32DG=$K$9$k$3$H$r0UL#$7$F$$$k!#$7$+$7$3$N@_Dj$O!"J#?t$N(B
$B%f!<%6$,%m%0%$%s$9$k2DG=@-$,$"$k%7%9%F%`$K$*$$$F$O!"(BX $B$r;H$C$?967b$r(B
$B9T$($F$7$^$&$H$$$&4m81@-$,$"$k!#(B
($B%-!<%o!<%I(B logging$B!"(Bwindow watching$BEy(B)

$B$3$N7k2L!"D>@\E*$J2DG=@-$H$7$F8"8B$N>e>:(B($B967bl9g(B)$B!"$"$k$$$OB>$N2DG=@-(B($BNc$($PB>$N%[%9%H$H$N?.Mj4X(B
$B78$,$"$C$?>l9g(B)$B$,9M$($i$l$k!#(B

8. XFCE 3.5.1 Local Xauthority Bypass Vulnerability
BugTraq ID: 1736
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-02
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1736
$B$^$H$a(B:

XFce $B$OMM!9$J(B UNIX $B%7%9%F%`8~$1$N%G%9%/%H%C%W4D6-$rDs6!$9$k%=%U%H%&%'%"(B
$B$G$"$k!#$3$N%=%U%H%&%'%"$N%P!<%8%g%s(B 3.5.1 $B$K4^$^$l$k%9%?!<%H%"%C%W%9%/(B
$B%j%W%H(B /etc/X11/xfce/xinitrc $B$K$O0J2<$K<($99T$,4^$^$l$F$$$k!#(B

xhost +$HOSTNAME

$B$7$+$7$3$N@_Dj$O!"J#?t$N(B
$B%f!<%6$,%m%0%$%s$9$k2DG=@-$,$"$k%7%9%F%`$K$*$$$F$O!"(BX $B$r;H$C$?967b$r(B
$B9T$($F$7$^$&$H$$$&4m81@-$,$"$k!#(B
($B%-!<%o!<%I(B logging$B!"(Bwindow watching$BEy(B)
$B$3$N7k2L!"D>@\E*$J2DG=@-$H$7$F8"8B$N>e>:(B($B967bl9g(B)$B!"$"$k$$$OB>$N2DG=@-(B($BNc$($PB>$N%[%9%H$H$N?.Mj4X(B
$B78$,$"$C$?>l9g(B)$B$,9M$($i$l$k!#(B

9. Acme thttpd Arbitrary World-Readable File Disclosure Vulnerability
BugTraq ID: 1737
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-02
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1737
$B$^$H$a(B:

Acme thttpd HTTP $B%5!<%P$K$O(B thttpd $B$N3HD%MQ(B CGI $B%W%m%0%i%`$H$7$F(B ssi
$B$H8F$P$l$k!"B>$N(B HTTP $B%G!<%b%s$K$OAH$_9~$_:Q$_$N(B Server Side Include
$B5!G=$rDs6!$9$k$?$a$N%W%m%0%i%`$,4^$^$l$F$$$k!#(B

ssi $B%9%/%j%W%H$rMQ$$!"%U%!%$%kL>$O%U%#%k%?$5$l!"(Bssi $B$X(B PATH_TRANSLATED
$B4D6-JQ?t$,7k2L$H$7$FM?$($i$l$k!#$3$N:]!"FCDj$N%(%9%1!<%W%7!<%1%s%9$O(B
ssi $B$K$h$C$F$OE,@Z$K%U%#%k%?%j%s%0$5$l$:!"7k2L$H$7$F!"2~$6$s$5$l$?(B URL
$B$rM?$($k$3$H$K$h$j(B($B%U%#%k%?%j%s%0$r%P%$%Q%9$9$k$?$a$K(B HEX $BI=5-$GCV49(B
$B$($?(B .. $B$rMQ$$$k(B)$B!"967be$N4{CN$N>l=j$K$"$k0U?^$9$k%U%!(B
$B%$%k$r;2>H$G$-$F$7$^$($k$N$G$"$k!#(B

10. Pegasus Email File Forwarding Vulnerability
BugTraq ID: 1738
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-03
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1738
$B$^$H$a(B:

$B0-0U$"$k(B Web $B%5%$%H$N4IM}l9g!"%m!<%+%k$N%U%!%$%k$O<+F0E*$K$3$N%=%U%H%&%'(B
$B%"$r2p$7$F;vA0$N7Y9p$J$7$KAwIU$5$l$F$7$^$&$N$G$"$k!#(B

<img src="mailto:email@address.com -F c:\path\file.ext">

11. LBNL Traceroute Heap Corruption Vulnerability
BugTraq ID: 1739
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-09-28
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1739
$B$^$H$a(B:

traceroute $B$OHs>o$KCN$i$l$?!"(B2$B%[%9%H4V$N%M%C%H%o!<%/$N%Q%9$r2r@O$9$k$?(B
$B$a$N%M%C%H%o!<%/J,@O%D!<%k$G$"$k!#(BUNIX $B%7%9%F%`$K$*$$$F!"(Btraceroute $B%3(B
$B%^%s%I$OE57?E*$K(B setuid root $B$G%$%s%9%H!<%k$5$l$F$$$k!#$3$l$O(B raw $B%=%1%C(B
$B%H$r!"$"$k$$$O%T%j%*%I$G6h@Z$i$l$?(B IP $B%"%I%l%9(B
$B$r(B -g $B%Q%i%a!<%?$XM?$($i$l$?:]$K8F$S=P$5$l$F$$$k!#(B
$B$3$N4X?t$O!"4X?t<+?H$K3d$jEv$F$i$l$?%a%b%j$KBe$($F!"M=$a3d$jEv$F:Q$_$N(B
$B%a%b%j$rMQ$$$k!#:G=i$N%$%s%9%?%s%9$G$"$k(B -g $B$,2rl9g!":G=i$N%$%s%9%?%s%9$HF1MM$K!"(B
free() $B4X?t$OL$2rJ|$N%a%b%j>e$N8E$$%P%C%U%!Fb$K%G!<%?$,;O$^$C$F$$$kMM$J(B
$B%]%$%s%?$K$*$$$F8F$S=P$5$l$k$N$G$"$k!#(Bfree() $B4X?t$,@5$7$$(B malloc $B$5$l$?(B
$BNN0h$N%X%C%@$r%]%$%s%?$NA0$K8+$D$1$i$l$J$$>l9g!"$=$l$O$=$N$^$^2rl9g$O!"%]%$%s%?$,;X$7$F$$$k%a%b%jNN0h(B
$B$,%f!<%6$K$h$C$F%3%s%H%m!<%k$5$lF@!"(Bfree() $B4X?t$,8F$P$l$kA0$K$J$s$+$i$+(B
$B$N0U?^$9$k%G!<%?$G=q$-9~$_2DG=$G$"$k>l9g$G$"$k!#967bl9g!"0-0U(B
$B$"$k(B malloc $B%X%C%@$r:n@.$7Cm0U?<$/:G=i$N(B savestr() $B$,MxMQ$9$k%P%C%U%!$X(B
$B!"0J8e(B free() $B$,FsHVL\$N(B savestr() $B$,8F$P$l$?8e$K;2>H$9$kMM$KKd$a9~$`2D(B
$BG=@-$,9M$($i$lF@$k!#$3$NLdBj$rFM$$$?967b$rLLE]$J$b$N$K$7$F$$$kE@$O!"(B
savestr() $B4X?t$,I,MW$H$7$F$$$k4X?t!"%P%C%U%!$XM?$($i$l$k%f!<%6$+$i$N%G!<(B
$B%?l9g!"%R!<%WFb$N0U?^$9$k>l=j$r0U?^$9$k(B
$B%G!<%?$G>e=q$-2DG=$G$"$k!#(B(function $B%]%$%s%?$,5s$2$i$l$k(B)

$B967bl9g!"%m!<%+%k$+$i$N(B root
$B8"8B$NC%12. TrendMicro PC-Cillin DoS Vulnerability
BugTraq ID: 1740
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 1999-12-30
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1740
$B$^$H$a(B:

PC-cillin $B$O%M%C%H%o!<%/$KBP$9$k!"$"$k$$$O%G%9%/%H%C%W4D6-$KBP$9$k%"%s%A(B
$B%&%$%k%9%W%m%0%i%`$G$"$k!#(BJava/ActiveX $BJ]8n5!G=$O$9$Y$F$N(B HTTP $B%j%/%(%9%H(B
$B$r%]!<%HHV9f(B 8431 $B$GBT$AoF0:n$X$NI|5l$O%5!<%S%9$N:F5/F0$,I,MW$G$"$k!#(B

13. Bardon Data Systems WinU Weak Encrypted Password Vulnerability
BugTraq ID: 1741
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-08-16
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1741
$B$^$H$a(B:

Bardon Data Systems WinU $B$O(B Windows 95/98/NT $BMQ$N%;%-%e%j%F%#5!G=IU$-$N(B
$B%f!<%6%$%s%?%U%'!<%9$NCV49$(%=%U%H%&%'%"$G$"$k!#(B

$B$3$N%=%U%H%&%'%"$N%P!<%8%g%s(B 5.2 $B0JA0$N%P!<%8%g%s$G$O4IM}MQ%Q%9%o!<%I$r(B
$B0E9f2=$9$k$?$a$K@H14. scp File Create/Overwrite Vulnerability
BugTraq ID: 1742
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-09-30
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1742
$B$^$H$a(B:

scp $B$N%P!<%8%g%s(B 1.2.x $B$K!"%5!<%PB&$K2~JQ$5$l$?(B scp $B%P%$%J%j$rCV$-!"(B
$B$=$l$rE,Ev$KMQ$$$k$3$H$,$G$-$k$J$i$P!"%j%b!<%H%5!<%P$O%m!<%+%k$N%Q%9(B
$BL>$r%9%W!<%U%#%s%0$7!"%m!<%+%k$N%f!<%6$,;}$D%U%!%$%k$r>e=q$-$G$-$F$7(B
$B$^$($kLdBj$,H/8+$5$l$?!#(B

$BNc$($P!"0J2<$N%3%^%s%I$K$*$$$F!"(B

 scp user@remotehost:/somefile /home/user/newfile

$B%j%b!<%H$K$"$k2~JQ$5$l$?%5!<%P$O%U%!%$%kL>$r!"Nc$($P(B ../../etc/passwd
$B$NMM$KAwIU$7!"%m!<%+%k$N%f!<%6$N(B scp $B$O%G!<%?$r(B /home/user/../../etc/passwd
$B$XAw?.$9$k!#(B
(/home/user/../../etc/passwd $B$O(B /etc/passwd $B$HF1CM$G$"$k(B)


$B$J$*!"FC5-$7$F$*$+$M$P$J$i$J$$E@$H$7$F!"$3$l$O%m!<%+%k%f!<%6$,%?!<%2%C(B
$B%H$H$J$k%U%!%$%k$X=q$-9~$_8"8B$r;}$AF@$k>l9g$K$N$_%?!<%2%C%H$H$J$k%U%!(B
$B%$%k$O>e=q$-$G$-$F$7$^$($k$H$$$&E@$,$"$k!#$3$N7k2L$+$i!"(Bscp $B$r(B root $B8"(B
$B8B$G)$G$-$J$$$H$$$&$3$H$,;W$$=P$5$l$h$&!#(B

$B$3$NLdBj$O%j%b!<%H$N%3%s%T%e!<%?$G(B ssh $B%P!<%8%g%s(B 1.2.x $B$,F0:n$7$F$$$k(B
$B>l9g!"%/%i%$%"%s%H$N%P!<%8%g%s$K$O4X78$J$/@8$8$k!#(B

$B%j%b!<%HB&$K(B ssh-2.x $B$rMxMQ$7$F$$$k>l9g!"0[$J$k%W%m%H%3!<%k$,MxMQ$5$l(B
$B$F$*$j!"$3$N7k2L$rH?1G$7!"$3$NLdBj$N1F6A$O15. Microsoft Windows NT 4.0 Invalid LPC Request DoS Vulnerability
BugTraq ID: 1743
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-03
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1743
$B$^$H$a(B:

LPC (Local Procedure Call) $B$H$O%9%l%C%I$*$h$S%W%m%;%9$K!"(BRPC (Remote
Procedure Call) $B$,0[$J$k%[%9%H4V$GDL?.$r9T$($k$h$&$K$9$k$N$KBP$7$F!"(B
$B%m!<%+%k$N%3%s%T%e!<%?Fb$G8_$$$KDL?.$r9T$J$($kMM$K$9$k%a%C%;!<%88r49(B
$B%5!<%S%9$G$"$k!#(B
$B$3$N%W%m%H%3!<%k$N(B Windows 4.0 $B$G$Nl9g$N(B LPC $B$N%j%/%(%9%H$r==J,$Ko$N%5!<%P(B
$B$Nl9g!"%/%i%$%"%s%H$O(B
$B%+!<%M%kNc30$N$?$a$K%/%i%C%7%e$7$F$7$^$&!#(B

$BIU$12C$($k$J$i$P!"$b$7%/%i%$%"%s%H$,(B \DbgSsApiPort $B$"$k$$$O(B \DbgUiApiPort
$B$K@\B3$7!"%i%s%@%`$J%G!<%?$rM?$($?>l9g!"%/%i%$%"%s%H$O%/%i%C%7%e$7$F$7(B
$B$^$&!#(B

$B$3$l$i$N%7%J%j%*$N$I$A$i$N>l9g$G$"$C$F$b!"DL>oF0:n$X$NI|5l$O%7%9%F%`$N(B
$B:F5/F0$,I,MW$G$"$k!#(B

$B$3$NLdBj$O%f!<%6$,%$%s%?%i%/%F%#%V$K%m%0%*%s$G$-$k>l9g$K$N$_@8$8$5$;$k(B
$B$3$H$,2DG=$G$"$k!#=>$C$F!"%j%b!<%H$+$i$3$NLdBj$rFM$$$?967b$OIT2DG=$G$"(B
$B$k!#(B

$BB>$N(B Windows NT $B$N(B LPC $B$NH$5$l$?$$!#(B

16. Multiple Vendor BSD libutil pw_error() Format String Vulnerability
BugTraq ID: 1744
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-04
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1744
$B$^$H$a(B:

libutil $B$O6&M-%i%$%V%i%j$G$"$j!"?tB?$/$N0[$J$k(B UNIX $B%f!<%F%#%j%F%#%3%^(B
$B%s%I$G;H$o$l$k!VI8=`E*$J!W4X?t72$r4^$`!"$[$\$[$H$s$I$N(B UNIX $B$GMxMQ$5$l(B
$B$F$$$k!#$7$+$7!"(BBSD $B$N(B libutil $B$K$O=q<0;XDj;R$Nr7o$,@.N)$7$F$7(B
$B$^$&$N$G$"$k!#$b$7=q<0;XDj;R$,4X?t$XM?$($i$l$?J8;zNs$X4^$^$l$F$$$?>l9g!"(B
printf() $B4X?t$O!"o$G$"$l$PCM$r;2>H$9$Y$-%9%?%C%/$G$O$J$$JL$N;2(B
$B>H@h$r;2>H$7$F$7$^$&$N$G$"$k!#=q<0;XDj;R$r;H$$!"%a%b%j$X=q$-9~$_$,$G$-(B
$BF@$k$H$$$&;v17. Microsoft Windows NT 4.0 / 2000 LPC Zone Memory Depletion DoS Vulnerability
BugTraq ID: 1745
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-03
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1745
$B$^$H$a(B:

LPC (Local Procedure Call) $B$H$O%9%l%C%I$*$h$S%W%m%;%9$K!"(BRPC (Remote
Procedure Call) $B$,0[$J$k%[%9%H4V$GDL?.$r9T$($k$h$&$K$9$k$N$KBP$7$F!"(B
$B%m!<%+%k$N%3%s%T%e!<%?Fb$G8_$$$KDL?.$r9T$J$($kMM$K$9$k%a%C%;!<%88r49(B
$B%5!<%S%9$G$"$k!#(B
LPC $B$OFCJL$N%W!<%k$+$i(B LPC Zone $B$HCN$i$l$F$$$k>l=j$X%a%C%;!<%8%9%H%l!<(B
$B%8$N$?$a$N%a%b%j$r3d$jEv$F$k!#$b$7(B LPC Zone $B$,l9g!"%a%b%j$O%+!<%M%k$+$i(B
LPC Zone $B$X3d$jEv$F$i$l$k!#DL>o$N>l9g!"%a%b%j$O(B LPC Zone $B$,$b$O$d;H$o(B
$B$l$J$/$J$C$?>l9g$K$O%+!<%M%k$XJV5Q$5$l$k$Y$-$G$"$k!#$7$+$7!"FCJL$KAH(B
$B$_N)$F$i$l$?%j%/%(%9%H$r:n@.$9$k$3$H$G!"$b$7%j%/%(%9%H$,7+$jBX$($i$l(B
$B$?>l9g$K$O!"%a%b%j$r(B LPC Zone $B$K$h$C$FMxMQ$G$-$k$@$1$9$Y$F$N%+!<%M%k(B
$B%a%b%j$r;H$$@Z$k$h$&$K;E8~$1$k$3$H$,2DG=$J$N$G$"$k!#(B

$BDL>oF0:n$X$NI|5l$O%7%9%F%`$N:F5/F0$,I,MW$G$"$k!#(B

$B$3$NLdBj$O%f!<%6$,%$%s%?%i%/%F%#%V$K%m%0%*%s$G$-$k>l9g$K$N$_@8$8$5$;$k(B
$B$3$H$,2DG=$G$"$k!#=>$C$F!"%j%b!<%H$+$i$3$NLdBj$rFM$$$?967b$OIT2DG=$G$"(B
$B$k!#(B

$BB>$N(B Windows NT $B$N(B LPC $B$NH$5$l$?$$!#(B

18. Multiple Vendor BSD fstat Format String Vulnerability
BugTraq ID: 1746
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-04
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1746
$B$^$H$a(B:

fstat $B$O(B BSD $BM3Mh$N(B UNIX $B$K$*$$$F%7%9%F%`>e$G3+$+$l$F$$$k%U%!%$%k$N>uBV(B
$B$rpJs$rF~e$NFCDj$N%P%$%H$@$1$r>e=q$-$9$k(B($B4X?t$N%j%?!<%s(B
$B%"%I%l%9$NLa$j@h$r4^$a$FJ8;zNs$OM?$($i$l$F$$$k(B)$BMM$K2r19. AOL Instant Messenger DoS Vulnerability
BugTraq ID: 1747
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-03
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1747
$B$^$H$a(B:

AOL Instant Messenger $B$O%M%C%H%o!<%/$K@\B3$7$F$$$k%f!<%64V$G%j%"%k%?%$(B
$B%`$N%a%C%;!<%88r49$rDs6!$9$k%"%W%j%1!<%7%g%s$G$"$k!#(B

Netscape $B$H6&$KDs6!$5$l$F$$$k(B AOL Instant Messenger $B$K$O(B DoS $B$r0z$-5/$3(B
$B$5$l$F$7$^$&LdBj$,$"$k!#DL>oM-$jF@$J$$?t$N(B %s $B$r%U%!%$%kL>$K;}$D%U%!%$(B
$B%k$r(B Windows NT $B$"$k$$$O(B 2000 $B$rF0:n$7$F$$$k%f!<%6$XAw$k$3$H$G!"$3$N%"(B
$B%W%j%1!<%7%g%s$O$3$N%"%W%j%1!<%7%g%s$N%&%#%s%I%&Fb$KI=<($5$l$?%U%!%$%k(B
$BL>$r2roF0:n$X$NI|5l$K$O%"%W%j%1!<%7%g%s$N:F5/F0$,I,MW$G$"$k!#(B

$B%U%!%$%kL>$NNc(B: %s%s%s%s%s%s%s%s%s%s.jpg

20. Microsoft Windows NT 4.0 / 2000 Predictable LPC Message Identifier
    Multiple Vulnerabilities
BugTraq ID: 1748
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-03
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1748
$B$^$H$a(B:


LPC (Local Procedure Call) $B$H$O%9%l%C%I$*$h$S%W%m%;%9$K!"(BRPC (Remote
Procedure Call) $B$,0[$J$k%[%9%H4V$GDL?.$r9T$($k$h$&$K$9$k$N$KBP$7$F!"(B
$B%m!<%+%k$N%3%s%T%e!<%?Fb$G8_$$$KDL?.$r9T$J$($kMM$K$9$k%a%C%;!<%88r49(B
$B%5!<%S%9$G$"$k!#(B

$B0J2<$K<($9%a%C%;!<%8$N%9%H%i%/%A%c$r9M$($k!#(B
($B$3$l$O3:Ev$9$k(B Bugtraq ID $B$N(B Credit $B$K$"$k(B Bindview Security Advisory
$B$+$i$N0zMQ$G$"$k!#(B)

typedef struct lpc_msg {
    unsigned short data_len;
    unsigned short msg_len;    /* normally data_len + sizeof (struct lpc_msg) */
    unsigned short msg_type;
    unsigned short address_range_offset;
    unsigned long pid;         /* process  id of client */
    unsigned long tid;         /* thread   id of client  */
    unsigned long mid;         /* message  id for this message */
    unsigned long callback_id; /* callback id for this message */
    /* unsigned char buff[0];  data_len bytes of data for this message */
} LPC_MSG;

NT $B$N(B LPC $B$N%a%C%;!<%8$NAw$je$K<($7$?(B PID (Process Identifier)$B!"(BTID (Thread Identifier)$B!"(B
MID (Message Identifier) $B$rA`:n$9$k!#(BLPC $B%a%C%;!<%8Cf$N(B MID $B$OM=B,(B
$B2DG=$G$"$j!"(BMID $B$NCM$rh$C(B
$Be>:$H$$$C$?$b$N$r$b$?$i$92DG=@-$,$"$k!#(B

$BLdBj(B1:
$B$3$NLdBj$O(B Windows NT 4.0 $B$KBP$7$F$N$_1F6A$7!"(B2000 $B$KBP$7$F$O$=$&$G$O$J(B
$B$$!#%]!<%H$X$N%3%M%/%7%g%s$X$N>h$Cl9g!"%W%m%;%9$OFCDj$N%]!<%H$KBP$9$k%O%s%I%k$rM?$($i$l$F$7$^(B
$B$&$N$G$"$k!#%/%i%$%"%s%H$+$i$N%W%m%;%9%j%/%(%9%H$O8"8B$rC%$N%/%i%$%"%s%H$+$i$N%a%b%j$N%"%/%;%9It$rDs6!$7$F$$$k>l9g!"B>$N(B
$B%/%i%$%"%s%H$,(B address_range_offset $B$rA`:n$9$k:]$K$O85!9$N%/%i%$%"%s%H(B
$B$O@5$7$$85!9$N(B PID$B!"(BTID$B!"(BMID$B$rDs6!$G$-$F$7$^$($k$N$G$"$k!#(B

$BLdBj(B3:
address_range_offset $B<:8z$rM?$($k$3$H$GBgNL$N(B LPC $B%j%/%(%9%H$r:n@.$7!"(B
$B%7%9%F%`Fb(B (2 $B$N(B 32 $B>h(B)$B$GMxMQ2DG=L>$9$Y$F$N(B MID $B$rMxMQ$7?T$/$5$;$k$3$H(B
$B$,2DG=$G$"$k!#$b$7!"$3$N8=>]$,5/$3$C$F$7$^$C$?>l9g!"%5!<%P$O%i%C%W$r5/(B
$B$3$7!"4{B8$N%j%/%(%9%H$X0n$l$?(B MID $B%j%/%(%9%H$r3d$jEv$F$F$7$^$&$N$G$"(B
$B$k!#$3$N$?$a!"$"$k0l$D$N%/%i%$%"%s%H$,%5!<%P$+$iB>$N%/%i%$%"%s%H$XITE,(B
$BEv$J1~Ez$rJV$9$h$&$K;E8~$1$k$3$H$,2DG=$J$N$G$"$k!#(B


$B$3$NLdBj$O%f!<%6$,%$%s%?%i%/%F%#%V$K%m%0%*%s$G$-$k>l9g$K$N$_@8$8$5$;$k(B
$B$3$H$,2DG=$G$"$k!#=>$C$F!"%j%b!<%H$+$i$3$NLdBj$rFM$$$?967b$OIT2DG=$G$"(B
$B$k!#(B

$BB>$N(B Windows NT $B$N(B LPC $B$NH$5$l$?$$!#(B

21. Multiple Vendor rpc.ypupdated Vulnerability
BugTraq ID: 1749
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 1995-12-19
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1749
$B$^$H$a(B:

rpc.ypupodated $B$O(B Network Information Service (NIS) $B$"$k$$$O(B Yellow Page(YP)
$B$N0lIt$r9=@.$9$k%G!<%b%s$G$"$k!#$3$N%G!<%b%s$O%/%i%$%"%s%H$+$i(B NIS $B%^%C(B
$B%W$N99?7$G$-$k5!G=$rDs6!$7$F$$$k!#$3$N%G!<%b%s$K$O0-0U$"$k%f!<%6$,(B root
$B8"8B$G%3%^%s%I$r22. Pegasus Mail Buffer Overflow Vulnerability
BugTraq ID: 1750
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-09-26
$B4XO"$9$k(BURL:
http://www.securityfocus.com/bid/1750
$B$^$H$a(B:

Pegasus Mail v3.11 $B$K$O%a%C%;!<%8$N%\%G%#Fb$KLs(B 90 K bytes $B0J>e$N%G!<(B
$B%?$,M?$($i$l$?:]%P%C%U%!%*!<%P!<%U%m!<$r@8$8!"%W%m%0%i%`$N%/%i%C%7%e$O(B
$B0z$-1[$5$l!"%j%b!<%H$+$i$N%3!<%I$N23. IRIX permissions File Manipulation Vulnerability
BugTraq ID: 1751
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 1995-03-02
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1751
$B$^$H$a(B:

IRIX $B$N(B /usr/lib/desktop/permissions $B%D!<%k$O!"(Bsuid $B$+$D(B sgid root $B$K@_(B
$BDj$5$l!"%U%!%$%k$N%Q!<%_%C%7%g%s$rJQ99$9$k$?$a%"%W%j%1!<%7%g%s$G$"$k!#(B
$B$3$N%D!<%k$O!"DL>o!"8"8B$N$"$k%U%!%$%k$N$_$r07$($k!#$7$+$7!"$3$N%D!<%k(B
$B$K$O!"0-0U$N$"$k%f!<%6$K$h$C$F%7%9%F%`>e$NG$0U$N%U%!%$%k$N%Q!<%_%C%7%g(B
$B%s$rJQ99$G$-$F$7$^$&LdBj$,$"$k!#(B

$B$3$l$O!"(BSGI SCR # 265071 $B$H$7$FEPO?$5$l$F$$$k!#(B

$B8"8B$N$J$$%U%!%$%k$N%Q!<%_%C%7%g%s$rJQ99$7$h$&$H;n$_$?>l9g!"(Bpermissions
$B%D!<%k$O!"%U%!%$%k$N=jM-A0$H%Q%9%o!<%I$rF~NO$9$k$h$&$KMW5a$9$k!#(B
$B$7$+$7!"%?!<%2%C%H%U%!%$%k$N%Q!<%_%C%7%g%s$NJQ99$,$J$5$l$k$N$O!"(B"Apply"
$B$r%@%V%k%/%j%C%/$7$?>l9g!"%Q%9%o!<%I$rF~NO$9$kA0$J$N$G$"$k!#(B

24. Multiple Vendor BSD eeprom Format String vulnerability
BugTraq ID: 1752
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-04
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1752
$B$^$H$a(B:


eeprom $B$O!"(BSparc $B%7%9%F%`$N%O!<%I%&%(%"!"(BEEPROM $B$NFbMF$NI=<($*$h$S=q$-(B
$B9~$_$K;HMQ$5$l$k%f!<%F%#%j%F%#$G$"$k!#$3$l$O%+!<%M%k%a%b%j$+$iFI$_=P$7!"(B
$B=q$-9~$_$r9T$J$&$?$a!"$7$P$7$P(B setgid kmem $B$G%$%s%9%H!<%k$5$l$k!#(BNetBSD
$B$H(B OpenBSD ($B$N(B SPARC $BHG(B) $B$KF1:-$5$l$F$$$k(B (NetBSD $B$N(Beeprom $B$+$iGI@8$7$?(B)
eeprom $B$N%P!<%8%g%s$K$O!"=q<0;XDj$r4^$s$@J8;zNs$r;H$C$?967b$r%m!<%+%k$+(B
$B$ie$NG$0U$N(B
$B>l=j$K=q$-9~$`$?$a$N%U%)!<%^%C%H%U%#!<%k%I$K=q<0;XDj;R$rA^F~$9$k$3$H$,(B
$B2DG=$G$"$k!#%9%?%C%/>e$N%G!<%?$,0lHL$N%f!<%6$K$h$C$F>e=q$-$G$-$k>l9g!"(B
$B25. Microsoft Windows NT 4.0 / 2000 Spoofed LPC Request Vulnerability
BugTraq ID: 1753
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-03
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1753
$B$^$H$a(B:

$B$3$N\:Y$O!"(Bhttp://www.securityfocus.com/bid/934 $B$r;2>H$5$l$?$$(B) $B$N?7http://www.microsoft.com/technet/security/bulletin/ms00-003.asp) $B$G$O!"(B
$B$3$N?7$7$$LdBj$K$D$$$F8@5Z$5$l$F$$$J$$!#(B

$B$3$N56B$$5$l$?(B LPC $B$KBP$9$k1~Ez$rFM$/r7o$,I,MW(B
$B$G$"$k!#$3$l$O!"8=:_l9g$G$"$k!#F1MM$K!"$3$Ne$G!"8"8B$N>e>:$,2DG=$G$"$k!#(B

$B$3$l$i$N@\%m%0%$%s$G$-$k>l9g$N$_2DG=$G$"$j!"$=$N$?$a!"(B
$B%j%b!<%H$+$i$3$N$N(B Windows NT $B$N(B LPC $B$NH$5$l$?$$!#(B

26. Microsoft IE / Outlook com.ms.activeX.ActiveXComponent Arbitrary Program...
BugTraq ID: 1754
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-05
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1754
$B$^$H$a(B:

$B0-0U$"$k(B Web $B%5%$%H$N4IM}l9g!"(BMicrosoft $B$N(B Internet Explorer$B!"(B
$B$b$7$/$O!"(BOutlook $B$G(B $B$=$N(B Web $B%Z!<%8$rFI$s$G$7$^$C$?%?!<%2%C%H%[%9%H>e(B
$B$GG$0U$N%W%m%0%i%`$NeLdBj$,$"$k$HI=<($7$F$b!"G$0U$N(B ActiveX $B%*%V%8%'%/%H$N@8@.$d%9%/%j%W%F(B
$B%#%s%0$r5v$7$F$7$^$&!#(B

$B2>$K!"(BOutlook $B$,(B'security update'$B$,E,MQ$5$l$F$$$?>l9g$G$b!"(BJava $B$rMxMQ(B
$B$9$l$P(B Active $B%9%/%j%W%H$NH$7$?%f!<%6$HF1$88"8B$rC%27. OpenBSD photurisd Format String Vulnerability
BugTraq ID: 1755
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-04
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1755
$B$^$H$a(B:

Photurisd $B$O!"(BOpenBSD $B$G(B IPSec $B$N804IM}$r9T$J$&%G!<%b%s$G$"$k!#$3$l$K$O!"(B
$B967bH$9$k@_Dj%U%!%$%k$,$"$k%G%#%l%/%H%j(B
$B$r5-$7$?%Q%i%a!<%?$rl9g!"%f!<%6$,F~NO$7$?%G%#%l(B
$B%/%H%j$r%U%)!<%^%C%HJ8;zNs$N0lIt$H$7$F%m%0$r:3J$G$-$k!#(B

28. Microsoft IIS 5.0 Indexed Directory Disclosure Vulnerability
BugTraq ID: 1756
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-04
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1756
$B$^$H$a(B:

Microsoft Internet Information Server 5.0 $B$G$O(B Index Server $B$,MxMQ2DG=(B
$B$G$"$k>l9g!"%j%b!<%H%f!<%6$O!"(BWeb Distributed Authoring and Versioning
(WebDAV) $B8!:w$NH$9$k$3$H$,2DG=$G$"$k!#(B*.inc $B%U%!%$%k$dIaDL$N$N(B
Web $B%5%$%H$N%$%s%?!<%U%'%$%9$+$i$ODL>o%"%/%;%9$G$-$J$$%I%-%e%a%s%H$^$G(B
$B$b4^$s$@1#$7%U%!%$%k$,!"$3$N$d%Q%9%o!<%I$J$I5!L)07$$$N>pJs(B
$B$,5-$5$l$?%U%!%$%k$rH/8+$9$k$3$H$,2DG=$G$"$k!#(B

IIS 5.0 $B$G$O(B Index Server $B$O!"%G%U%)%k%H$GMxMQ$G$-$J$$>uBV$G$"$j!"(B
'Index' $B%W%m%Q%F%#$,@_Dj$5$l$F$$$k%G%#%l%/%H%j$N$_$,!"$3$N29. Multiple Vendor Cfengine Format String Vulnerability
BugTraq ID: 1757
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-01
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1757
$B$^$H$a(B:

Cfengine $B$O!"(BTCP/IP $B%M%C%H%o!<%/$K@\B3$5$l$?(B UNIX $B8_49$N%7%9%F%`$N8!::(B
$B$d@_Dj$r9T$J$&$?$a$N8@8l$K4p$E$$$?%7%9%F%`$G$"$k!#(Bcfd $B$O!"(Bcfengine $B$N%/(B
$B%i%$%"%s%H$+$i%j%b!<%H$G@_Dj$9$k$?$a$N%G!<%b%s%3%s%]!<%M%s%H$G!"(Bsyslog()
$B$NE,@Z$K@_7W$5$l$F$$$J$$8F$S=P$7ItJ,$,$"$k!#$=$N7k2L!"?.MQ$5$l$F$$$k%[(B
$B%9%H(B ($B$b$7$/$O!"%"%/%;%9%3%s%H%m!<%k$,$J$5$l$F$$$J$$$J$i!"G$0U$N%f!<%6(B)
$B$O%f!<%6$,F~NO$7$?%U%)!<%^%C%H;XDj;R$r4^$s$@$h$&$J0-0U$N$"$k%a%C%;!<%8(B
$B$r@8@.$7!"%M%C%H%o!<%/%G!<%b%s$KE>Aw$9$k2DG=@-$,$"$k!#:GDc$G$b!"%5!<%S(B
$B%9$r%/%i%C%7%e$9$k$3$H$,2DG=$G$"$k!#FCDj$N%U%)!<%^%C%H;XDj;R$rAw?.$9$k(B
$B$3$H$G!"0-0U$N$"$k%f!<%6$,%W%m%0%i%`$N%9%?%C%/ItJ,$r=q$-49$(!"l9g!"967be$G%F%9%H$7$?!#$7$+$7$3$l$O!"(B
Red Hat$B!"$^$?$O!"(BPowertools $B$N0lIt$G$O$J$$!#>/$J$/$H$b!"(BDebian $B$O!"%Q%C(B
$B%1!<%8$K(B cfengine $B$,4^$^$l$k!#(B

FreeBSD 3.4 $B$d(B 4.1 $B$G:F8=$7$h$&$H;n$_$?!#IT1?$@$C$?!#F1$8J}K!$G!"$^$?$O!"(B
$BJL$NJ}K!$G:F8=$G$-$?$H$7$F$b;d$O6C$+$J$$$@$m$&!#(B

Linux $B$G$J$$B>$N%W%i%C%H%U%)!<%`$G$O%F%9%H$7$F$$$J$$$,!"$b$7(B cfd $B$r30. Microsoft Windows 2000 Unattended Install OEMPreinstall Vulnerability
BugTraq ID: 1758
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-04-07
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1758
$B$^$H$a(B:

All Users $B$H(B Default User $B%G%#%l%/%H%j$O!"(BOEMPreinstall $B%*%W%7%g%s$,(B
1 $B$K@_Dj$5$l$F$$$k$H$$$&!"%"%s%5!<%U%!%$%k$GCm0U$5$l$F$$$J$$%$%s%9%H!<(B
$B%k$,9T$o$l$F$$$k4V!"$$$+$J$k8"8B$G$b=q$-9~$_2DG=$J$^$^$G$"$k!#(B
$B0-0U$N$"$k%f!<%6$O!"B>$N%f!<%6$,%7%9%F%`$K%m%0%$%s$7$h$&$H$9$k$H<+F0E*(B
$B$K31. OpenBSD Pending ARP Request Remote DoS Vulnerability
BugTraq ID: 1759
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-05
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1759
$B$^$H$a(B:

OpenBSD $B$K$O%j%b!<%H$+$i(B DoS $B$r0z$-5/$3$9$3$H$,$G$-$kj(B
$B$N>uBV$G$N07$$$K<:GT$9$k$?$a$K$h$k!#967b@7$H(B
$B$J$k%^%7%s$KBgNL$N(B ARP $B%j%/%(%9%H$rAw?.$7$?>l9g!"%+!<%M%k%Q%K%C%/$r0z$-(B
$B5/$3$7!"%?!<%2%C%H$H$J$k%7%9%F%`$rDd;_$5$;$k860x$H$J$k!#(B

$B$3$l$O!"FCDj$N4D6-2<$G2DG=$G$"$k!#967b$O0J2<$N$h$&$Ke$G$"$k$3$H(B) $B>e$K$"$k>l9g!"967b@7$H(B
$B$J$k%[%9%H$OB>$N%[%9%H$K(B MAC $B%"%I%l%9$rD4$Y$k$?$a$K(BARP $B%j%/%(%9%H$rAw?.(B
$B$9$k!#==J,$J?t$N(B ARP $B%j%/%(%9%H$,Aw$i$l$?>l9g!"%+!<%M%k$OuBV$K4Y$k!#(B

 "out of space in kmem_map"

$B$=$7$F!"%U%j!<%:$9$k!#(B

32. Multiple Vendor MIME Header DoS Vulnerability
BugTraq ID: 1760
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 1998-09-03
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1760
$B$^$H$a(B:

Apache Web Server $B$H(B MessageMedia UnityMail $B$O!"(B8000 $B%P%$%H$H$$$&0UL#$N(B
$B$"$k%5%$%:$N(B MIME $B%X%C%@$,Aw?.$5$l$?>l9g!"(BDoS $B967b$N1F6A$rJ}$N%=%U%H$O%/%i%C%7%e$7!"DL>o$N5!G=$r2sI|$9$k$K$O:F5/F0$,I,MW$H(B
$B$J$k!#B>$N(B Web $B%5!<%P$bF1MM$K!"$3$N967b$N33. GnoRPM Arbitrary File Overwrite Vulnerability
BugTraq ID: 1761
$B%j%b!<%H$+$i$N:F8=@-(B: $B$J$7(B
$B8xI=F|(B: 2000-10-02
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1761
$B$^$H$a(B:

Gnome $B>e$N%0%i%U%#%+%k$J(B RPM $B4IM}%D!<%k$G$"$k!"(BGnoRPM $B$N(B v0.95 $B0JA0$N(B
$B%P!<%8%g%s$K$O!"(Bgnomerpm $B$,0l;~%U%!%$%k$r07$&J}K!$KA0$rIU$1$?0l;~%U%!%$%k$r@8@.$9$k!#0-0U$"$k%f!<%6$O!";vA0$K(B
GnomeRPM $B$,(B root $B$K$h$C$F$,IU$1$i$l$?%7%s%\%j%C%/%j%s%/$r:n@.$G$-$k!#(B
$B$3$l$,l9g!"@5$7$/?dB,$5$l$?%7%s%\%j%C%/%j%s%/$K$h$C$F;X$5$l(B
$B$k%U%!%$%k$,!"(BGnomeRPM $B$K$h$C$F(B(root $B8"8B$G(B)$B>e=q$-$5$l$F$7$^$&!#(B

$B=EMW$J%U%!%$%k$,>e=q$-$5$l$?>l9g!"%m!<%+%k$+$i(B DoS $B$,0z$-5/$3$5$l$F$7(B
$B$^$&!#(B

34. Moreover.com CGI File Disclosure Vulnerability
BugTraq ID: 1762
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 2000-10-02
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1762
$B$^$H$a(B:

$B%K%e!<%9G[?.%Y%s%@(B Moreover.com $B$K$h$C$F6!5k$5$l$k(B cached_feed CGI $B%9%/(B
$B%j%W%H$N%P!<%8%g%s(B 1.0 $B$K$Ol9g!"(BCGI $B%9%/%j%W%H$,(B "$B5v$7$?(B" $BNN0h$N30$K(B(http $B%f!<%6$K(B
$B$h$C$FFI$a$k(B) $B%U%!%$%k$r3+<($7$F$7$^$&!#(B

$B%Y%s%@!<$O!"%9%/%j%W%H$r=$@5$7!"$3$N35. IBM WebSphere ikeyman Weak Encrypted Password Vulnerability
BugTraq ID: 1763
$B%j%b!<%H$+$i$N:F8=@-(B: $B$"$j(B
$B8xI=F|(B: 1999-10-24
$B4XO"$9$k(B URL:
http://www.securityfocus.com/bid/1763
$B$^$H$a(B:

IBM WebSphere $B$O!"(BIBM HTTP Server $B$H(B SSL $B@\B3$,MxMQ$G$-$k>l9g!"%5!<%P$N(B
$B>ZL@=q!"$^$?$O!"80%Z%"$r0E9f2=$9$k(B 'ikeman' $B$H8F$P$l$k%D!<%k$rF1:-$7$F(B
$B$$$k!#(Bikeman $B$O%Q%9%o!<%I$r%U%j!<$GMxMQ$G$-$k%9%/%j%W%H(B ($BBP1~$9$k(B Bugtraq ID
$B$N(B Exploit $B$r;2>H$5$l$?$$(B) $B$rMxMQ$7$FMF0W$KI|9f$G$-$k1#$7%U%!%$%k$KJ]B8(B
$B$9$k!#(B

III. SECURITYFOCUS.COM NEWS AND COMMENTARY
- ------------------------------------------

1. Carnivore Details Emerge
$BCx$N(B FBI $B%D!<%k$HAH$_9g$o$;$F!"(BWeb $B$r%5!<%U%#%s$7$F$$$k4V$K4F;k$NI8E*$,(B
$B8+$?(B Web $B%Z!<%8$r:F9=C[$9$k$3$H$,$G$-$k$3$H$rL@$i$+$K$7$?!#(B

http://www.securityfocus.com/templates/article.html?id=97

2. U.S. picks new Encryption Standard
$BCxA0$GCN$i$l$k$3$N%"%k%4%j%:%`$O!":#D+!"(B30 $BG/$NNr;K$r8X$k%G!<%?0E9fI8(B
$B=`(B (DES) $B$N8e7Q$H$7$F!"http://www.securityfocus.com/templates/article.html?id=96

IV.SECURITY FOCUS TOP 6 TOOLS
- -----------------------------
1. Samhain 0.9.5
AIX, HP-UX, Linux, Solaris and Unixware
$B:nhttp://samhain.sourceforge.net/

Samhain $B$O!"%M%C%H%o!<%/>e$N%[%9%H$r=8Cf4F;k$9$k$?$a$N%/%i%$%"%s%H%5!<(B
$B%P%"%W%j%1!<%7%g%s$H$7$F$bMxMQ$G$-$k!"%U%!%$%k%7%9%F%`$N0l4S@-%A%'%C%+!<(B
$B$G$9!#G'>Z$5$l$?(B TCP/IP $B$N@\B3$G%m%0%5!<%P$+$i$N%l%]!<%H$rAw?.$9$k$3$H(B
$B$K2C$($F!"$$$/$D$+$NB>$N%m%0$r$H$k5!G=(B ($BEE;R%a!<%k!"%3%s%=!<%k!"(B
tamper-resistant $B%m%0%U%!%$%k!"(Bsyslog) $B$,MxMQ$G$-$^$9!#(BSamhain $B$O!"(B
Linux$B!"(BAIX 4.1$B!"(BHP-UX 10.20$B!"(BUnixware 7.1.0$B!"(BSolaris 2.6 $B$GF0:n3NG'$,$J(B
$B$5$l$F$$$^$9!#(B

2. BUGS 3.4.3
FreeBSD, HP-UX, Linux, NetBSD, OpenBSD, Solaris, SunOS, UNIX,
Windows 2000, Windows 3.x,Windows 95/98 and Windows NT
$B:nhttp://www.bcrypt.com

BUGS $B$O6/NO$JHkL)800E9f%"%k%4%j%:%`$H$=$N%"%W%j%1!<%7%g%s$G$9!#;HMQ$9$k(B
$B$3$H$OFq$7$/$J$/!"%5%s%W%k%"%W%j%1!<%7%g%s$H%I%-%e%a%s%H$,$"$j$^$9!#$3(B
$B$N0E9f$N%i%$%V%i%j$O%U%j!<$GMxMQ$9$k$3$H$,$G$-$^$9!#%^%k%A%W%i%C%H%U%)(B
$B!<%`$KBP1~$7!"%*!<%W%s%=!<%9$G!"%U%!%$%k0E9f2=%"%W%j%1!<%7%g%s!"%;%-%e(B
$B%"$J%A%c%C%H!"%;%-%e%"$J(B"more"$B%3%^%s%I!"%m%0%$%s%"%W%j%1!<%7%g%s$J$I$+(B
$B$i$J$k%Q%C%1!<%8$,Ds6!$5$l$F$$$^$9!#(B

3. Linux Intrusion Detection System (LIDS) 0.9.9
$B:nhttp://www.lids.org/

Linux Intrusion Detection System $B$O%+!<%M%k$N%;%-%e%j%F%#$r3HD%$9$k%Q%C(B
$B%A$G$9!#0lEY$3$N%Q%C%A$,M-8z$K$J$C$?>l9g!"A*Br$5$l$?%U%!%$%k$X$N%"%/%;%9!"(B
$B$9$Y$F$N%7%9%F%`(B/$B%M%C%H%o!<%/4IM}A`:n!"$9$Y$F$N8"8BIU$-F0:n!"(Braw $B%G%P%$(B
$B%9$NF0:n!"%a%b%j$*$h$S(B I/O $B%"%/%;%9$O(B root $B$G$5$(MxMQ$G$-$J$/$G$-$^$9!#(B
$B$^$?!"MxMQ$9$k!"%7%9%F%`$N8"8BIU$-F0:n$rMxMQ$7!"3H(B
$BD%$7!"%M%C%H%o!<%/$H%U%!%$%k%7%9%F%`$K$D$$$F$N%;%-%e%j%F%#5!G=$r!"%+!<%M(B
$B%k$K%;%-%e%j%F%#5!G=$r3HD%$9$k$3$H$GDI2C$7$^$9!#$^$?!"=EMW$J%W%m%;%9$N1#(B
$BJC!"%M%C%H%o!<%/1[$7$N%;%-%e%j%F%#7Y9p%a%C%;!<%8$N4. Snorticus 1.0
Linux and Solaris
$B:nhttp://snorticus.baysoft.net/

Snorticus $B$O!"B??t$N%;%s%5$+$i=8$a$i$l$?(B Snort $B$N%G!<%?$N<+F08!:w$H=hM}(B
$B$r%5%]!<%H$9$k$?$a$K;H$o$l$kM-1W$J%9%/%j%W%H$N=89gBN$G$9!#4pK\E*$J9M$((B
$B$O!"%G!<%?$r<}=8$9$k$?$a$KG[CV$7$?B??t$N%;%s%5$r$b$D$3$H$G$9!#$3$N%G!<(B
$B%?$O0l;~4V$4$H$K(B'$BJq$^$l(B'$B!"=8$a$?%G!<%?$r2r@O$9$k$?$a$K;H$o$l$k%\%C%/%9(B
$B$K0z$C9~$a(B (SnortSnarf)$B!"$=$7$F!"(BWeb $B%$%s%?!<%U%'%$%9$+$i!"2r@O:Q$_$N%G(B
$B!<%?$r%"%J%j%9%H$,8+$k$?$a$K;H$o$l$^$9!#(BSnorticus $B$OB??t$N%5%$%H$+$i$N(B
$B%G!<%?$r07$&$@$1$G$J$/!"F1$8%;%s%5$rMxMQ$7$F(B ($BF1$8%;%s%5$KB??t$N(B Snort
$B$r!<%s$r$3$($?%5(B
$B%$%H$r%5%]!<%H$7$^$9!#%;%s%5!<$G8!:w$7$F@5$7$$F|IU(B/$B;~4V$r8!CN$7!"%"%J%j(B
$B%9%H%\%C%/%9$K$"$k$9$Y$F$N%G!<%?$OB?$/$F$b(B 1 $B;~4V$G$9!#(B

5. The Coroner's Toolkit (TCT)
FreeBSD, Linux, OpenBSD, Solaris and SunOS
$B:nhttp://www.porcupine.org/forensics/tct.html

TCT $B$O!"3d$j9~$_8e!"(BUNIX $B%7%9%F%`$N(B post-mortem $B2r@O$K;H$&$3$H$,$G$-$k(B
$B%W%m%0%i%`$r=8$a$?$b$N$G$9!#$3$N%=%U%H%&%(%"$O!"$o$l$o$l$,0lG/A0(B ($B$[$H(B
$B$s$IF1$8F|(B) $B$K3+9V(B free Computer Forensics Analysis class $B$N4V!":G=i(B
$B$K<($5$l$^$7$?!#(B

$BCmL\$KCM$9$k%3%s%]!<%M%s%H$O!">pJs$rJa$^$($k(B grave-robber $B%D!<%k!"%U%!(B
$B%$%k$,@8$-$F$$$k$+;`$s$G$$$k$+$N%Q%?!<%s$rI=<($9$k(B ils $B$H(B mactime $B%D(B
$B!<%k!">C$5$l$?%U%!%$%k$r:F@8$9$k(B unrm $B$H(B lazarus $B%D!<%k!"6. Bcrypt 2.3
Windows 2000, Windows 95/98 and Windows NT
$B:nhttp://www.bcrypt.com

$B$3$l$O$9$G$K9-$/CN$i$l$F$$$k(B bcrypt Windows $BHG%=%U%H%&%'%"$N?7$7$$(B Windows
$BHG%"%W%j%1!<%7%g%s$G$9!#$3$N%P!<%8%g%s$G$O?7$7$$0E9f2=%i%$%V%i%j$H?7$7(B
$B$/8_49@-$rJ]$A!"0E9f2=!"I|9f2=!"%-!<@8@.!"%U%!%$%k$N1#JC5!G=$,MxMQ$G$-(B
$B$kMM$K$J$C$F$$$^$9!#(BBUGS v3.4.0 $B$NDs6!$9$kF0E*%W%i%$%Y!<%H%-!<0E9f2=%"(B
$B%k%4%j%:%`$rMxMQ$7$?(B Windows GUI $B$rDs6!$7$F$$$^$9!#$^$?!"%f!<%6$,MxMQ$7(B
$B$d$9$/!"%*!<%W%s%=!<%9$G!"J#?t$N%W%i%C%H%U%)!<%`$GF0:n$7$^$9!#(B
$Bhttp://www.lac.co.jp/security/

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Edition 5.5.5J
Comment: SAKAI Yoriyuki

iQA/AwUBOeJx0ZQwtHQKfXtrEQJkJACePYCkWcS4UH8kzQa7mMX0nP4M+E4AoLsB
dmQBqmDrVx4A4pZqRjVsE6uE
=EVg6
-----END PGP SIGNATURE-----