******************** Windows & .NET Magazine Security UPDATE--brought to you by Security Administrator, a print newsletter bringing you practical, how-to articles about securing your Windows .NET, 2000, and NT systems. http://www.secadministrator.com ******************** ~~~~ THIS ISSUE SPONSORED BY ~~~~ VeriSign--The Value of Trust http://list.winnetmag.com/cgi-bin3/flo?y=eKWS0CJgSH0CBw0p5N0AQ ~~~~~~~~~~~~~~~~~~~~ ~~~~ SPONSOR: VERISIGN--THE VALUE OF TRUST ~~~~ Is your e-business secure enough? Learn why it's vital to encrypt your business transactions, secure your intranets, and authenticate your Web site with the strongest encryption available--128-bit SSL. To learn more, get VeriSign's FREE Guide, "Securing Your Web Site for Business" now: http://list.winnetmag.com/cgi-bin3/flo?y=eKWS0CJgSH0CBw0p5N0AQ ~~~~~~~~~~~~~~~~~~~~ January 30, 2002--In this issue: 1. IN FOCUS - Active Directory Security: Forests and Domains 2. SECURITY RISKS - FTP Bounce Vulnerability in SpoonFTP - Arbitrary Execution Vulnerability in PHP 4.0 3. ANNOUNCEMENTS - Microsoft TechEd 2002: The Definitive Microsoft Conference for Building Integrated Solutions - New! ADO.NET Webinar Series! 4. SECURITY ROUNDUP - News: KaVaDo Offers Web Application Security Scanner and Protection - News: Central Command Offers Discount Antivirus Software to Schools - News: Second Annual BNA Security Summit, February 27-28, in Washington, D.C. - News: RapidStream Announces High-Performance Security Appliances - News: Halifax Provides Security to Veteran's Affairs and IRS - News: Top Stories of 2001, #8: .NET and Open Alternatives Fight for the Future - Feature: Exchange Server Antivirus Software Buyer's Guide - News Correction: Reflex Magnetics ScreenMail for Outlook 5. INSTANT POLL - Results of Previous Poll: Performing Full Security Audits - Instant Poll: Single or Multiple Forests? 6. SECURITY TOOLKIT - Virus Center - FAQ: How Can I Execute Microsoft Snap-in Console Files Without Typing the .msc Extension? 7. NEW AND IMPROVED - Test Email Vulnerabilities - Understand Internet Security Concepts 8. HOT THREADS - Windows & .NET Magazine Online Forums - Featured Thread: WFV Folders in the System Root Folder - HowTo Mailing List - Featured Thread: VPN Clients Not Connecting 9. CONTACT US See this section for a list of ways to contact us. ~~~~~~~~~~~~~~~~~~~~ 1. ==== IN FOCUS ==== * ACTIVE DIRECTORY SECURITY: FORESTS AND DOMAINS Hello everyone, Have you seen Microsoft's white paper, "Design Considerations for Delegation of Administration in Active Directory"? Microsoft published the paper in November 2001, and you can download it at the company's Web site (see URL below). The paper discusses design concerns regarding the trust of service owners. Gartner Group's John Enck--former Lab Manager for Windows NT Magazine--brought the paper to my attention recently because of its recommendations. http://www.microsoft.com/windows2000/techinfo/planning/activedirectory/addeladmi n.asp In the paper's conclusion, Microsoft says companies "can deploy a single forest design with a single IT organization owning all forest and domain service management, and delegate data autonomy or isolation to other organizations by using [organizational units] OUs." The paper goes on to say, "Some organizations have specific autonomy or isolation requirements that make trusting a central service owner impractical or unwise. These organizations can deploy multiple forest designs, and enable inter-forest collaboration through additional management systems such as Microsoft Metadirectory Services (MMS)." So you need to build your Active Directory (AD) infrastructure carefully because, as the paper also points out, "Domain owners cannot prevent forest owners from controlling their services and accessing their data," and anyone joining a forest must trust service owners. In addition, the paper outlines several potentially exploitable circumstances that exist when you trust service owners in a single-forest model. Therefore, for maximum security with AD, you need to use multiple forests. Be sure to read the white paper for more details about the risks of a single-forest model. We're conducting a new poll this week to learn about your AD structure. "Do you use a single-forest or multiple-forest design with Active Directory, and if you use a single-forest design, will you change to multiple?" Visit our home page and give us your answer. Until next time, have a great week. Sincerely, Mark Joseph Edwards, News Editor markat_private 2. ==== SECURITY RISKS ==== (contributed by Ken Pfeil, kenat_private) * FTP BOUNCE VULNERABLITY IN SPOONFTP Arne Vidstrom discovered a vulnerability in Pi-Soft's SpoonFTP that can result in an attacker being able to bounce a connection through the vulnerable server and attack a third-party host. An intruder can also launch this FTP bounce attack from ports lower than 1024, to which the attacker typically doesn't have user access. The vendor, Pi-Soft Consulting, has released version 1.2, which fixes this vulnerability. http://www.secadministrator.com/articles/index.cfm?articleid=23886 * ARBITRARY EXECUTION VULNERABILITY IN PHP 4.0 Paul Brereton discovered a vulnerability in PHP 4.0 for Windows using Apache Web Server 2.0. By exploiting PHP's ability to view files residing outside the normal HTML root directory, an attacker can execute arbitrary code by inserting a malicious PHP-based command into the Apache log file. PHP has been notified, but no fix is currently available. http://www.secadministrator.com/articles/index.cfm?articleid=23887 3. ==== ANNOUNCEMENTS ==== * MICROSOFT TECHED 2002: THE DEFINITIVE MICROSOFT CONFERENCE FOR BUILDING INTEGRATED SOLUTIONS Come to New Orleans April 9 through 13 for the 10th anniversary of TechEd. Immerse yourself in .NET Enterprise Server, Windows .NET Server, and Visual Studio .NET. Register by February 8, 2002, and you'll also save $400. For details, go to the following URL: http://msdn.microsoft.com/events/teched/go/2002learn * NEW! ADO.NET WEBINAR SERIES! Don't miss "ADO.NET for the Developer," a new series of three separate Webinars brought to you by SQL Server Magazine. Each information-packed session is taught by noted SQL Server expert William Vaughn. Don't delay--the first session, "Introduction to ADO.NET for ADO Classic Developers" is February 5! For more information or to register, go to the following URL: http://list.winnetmag.com/cgi-bin3/flo?y=eKWS0CJgSH0CBw0qX50Ab 4. ==== SECURITY ROUNDUP ==== * NEWS: KAVADO OFFERS WEB APPLICATION SECURITY SCANNER AND PROTECTION KaVaDo announced a new Web application security scanner, ScanDo, that mimics the actions of an attacker to help identify security weaknesses. ScanDo analyzes Web site content for potential vulnerabilities in forms, Web code, and scripts. http://www.secadministrator.com/articles/index.cfm?articleid=23869 * NEWS: CENTRAL COMMAND OFFERS DISCOUNT ANTIVIRUS SOFTWARE TO SCHOOLS Central Command is offering its Vexira Antivirus software to accredited colleges, high schools, junior high schools, and grade schools for $1.79 per 1- year license. http://www.secadministrator.com/articles/index.cfm?articleid=23874 * NEWS: SECOND ANNUAL BNA SECURITY SUMMIT, FEBRUARY 27-28, IN WASHINGTON, D.C. Pike & Fischer and parent company BNA announced the second annual BNA Summit to be held February 27 and 28 at the Omni Shoreham in Washington, D.C. http://www.secadministrator.com/articles/index.cfm?articleid=23876 * NEWS: RAPIDSTREAM ANNOUNCES HIGH-PERFORMANCE SECURITY APPLIANCES RapidStream announced a new line of high-performance security appliances that it has built around Check Point Software Technologies' Check Point VPN-1 and Check Point Firewall software. http://www.secadministrator.com/articles/index.cfm?articleid=23866 * NEWS: HALIFAX PROVIDES SECURITY TO VETERAN'S AFFAIRS AND IRS Halifax announced that the US Department of Veteran's Affairs and the Internal Revenue Service (IRS) have selected the company to provide their network security. http://www.secadministrator.com/articles/index.cfm?articleid=23871 * NEWS: TOP STORIES OF 2001, #8: .NET AND OPEN ALTERNATIVES FIGHT FOR THE FUTURE After Microsoft made it clear throughout 2000 that it was moving toward a future of Web services originally called Next Generation Windows Services (NGWS), Microsoft revamped its strategy, renamed it .NET, and entered 2001 ready to deliver on some of its promises http://www.secadministrator.com/articles/index.cfm?articleid=23824 * FEATURE: EXCHANGE SERVER ANTIVIRUS SOFTWARE BUYER'S GUIDE Gauging how serious a threat email viruses pose is difficult because of the many hoaxes and relatively benign viruses that exist. But a viral infection is never a good thing, and email viruses are especially nefarious because they usually spread infection as soon as you open the attachment. Although your end users should maintain an antivirus solution on their desktops, ensuring that users' virus scanners are regularly updated--or are even running--is difficult. The most seamless and transparent way to maintain a virus-free Microsoft Exchange Server environment is to use a server-side virus scanner. This buyer's guide helps you learn about several great server-side scanners. http://www.secadministrator.com/articles/index.cfm?articleid=23564 * NEWS CORRECTION: REFLEX MAGNETICS SCREENMAIL FOR OUTLOOK Last week SECURITY ROUNDUP announced that UK-based Reflex Magnetics is offering its new ScreenMail plugin for Outlook free of charge. It should have been "free of charge to charitable organizations." We regret any inconvenience this might have caused you. 5. ==== INSTANT POLL ==== * RESULTS OF PREVIOUS POLL: PERFORMING FULL SECURITY AUDITS The voting has closed in Windows & .NET Magazine's Security Administrator Channel nonscientific Instant Poll for the question, "How often does your organization perform full security audits?" Here are the results (+/-2percent) from the 177 votes: 10% 1) Every 3 months or more often 10% 2) Every 3 to 6 months 18% 3) Every 6 months to a year 63% 4) Rarely or after a significant breach * INSTANT POLL: SINGLE OR MULTIPLE FORESTS? The current Instant Poll question is, "Do you use a single-forest or multiple-forest design with Active Directory, and if you use a single-forest design, will you change to multiple?" The choices are 1) Single forest and won't change, 2) Single forest but changing to multiple, or 3) Multiple forests. Go to the Security Administrator Channel home page and submit your vote. http://www.secadministrator.com 6. ==== SECURITY TOOLKIT ==== * VIRUS CENTER Panda Software and the Windows & .NET Magazine Network have teamed to bring you the Center for Virus Control. Visit the site often to remain informed about the latest threats to your system security. http://www.secadministrator.com/panda VIRUS ALERT: MYPARTY The MyParty worm (also known as W32/Myparty@MM) is written in Visual C++ and compressed with Ultimate Packer for Executables (UPX). The worm spreads in email by sending copies of itself to everyone listed in a user's address book. The worm propagates as a file attachment called www.myparty.yahoo.com. The worm arrives with a message subject of "New photos from my party!" with a message body that reads, "Hello, My party... It was absolutely amazing! I have attached my Web page with new photos! If you can please make color prints of my photos. Thanks!" When the recipient opens the attachment, the worm executes and copies itself to the C:\Recycled folder with a filename of regctrl.exe. The worm also copies a file called msstask.exe to the Startup directory and uses this file to spread itself. http://www.secadministrator.com/panda/index.cfm?fuseaction=virus&virusid=1137 * FAQ: HOW CAN I EXECUTE MICROSOFT SNAP-IN CONSOLE FILES WITHOUT TYPING THE .MSC EXTENSION? ( contributed by John Savill, http://www.windows2000faq.com ) A. By default, you don't have to type the extension to run certain file types (e.g., .exe, .bat). To add the Microsoft Snap-in Console to this list, you need to add .msc to your PATHEXT variable. To change this setting for one command session, type set pathext=%pathext%;.msc To change this setting for all of Windows, you need to modify the system environment variable by performing the following steps (click OK when prompted to close each dialog box): 1. Start the Control Panel System applet (go to Start, Settings, Control Panel, System). 2. Select the Advanced tab. 3. Click Environment Variables. 4. Under "System variables," double-click PATHEXT. 5. Click Edit and add ;.msc to the end of the string, then click OK. You can now start the Microsoft Snap-in Console without typing the .msc file extension after the snap-in filename (e.g., devmgmt). 8. ==== NEW AND IMPROVED ==== (contributed by Scott Firestone, IV, productsat_private) * TEST EMAIL VULNERABILITIES GFI's Email Security Testing Zone launched two email tests that let Outlook XP users check whether their system is vulnerable to email threats. Both tests consist of an email message carrying an executable attachment in disguise. One test contains a Class ID (CLSID) file extension; the other test has a malformed HTML Application (HTA) file extension as its basis. You can sign up for the tests by submitting your name and email address at GFI's Email Security Testing Zone. You will then receive harmless tests by email that let you check for vulnerabilities. Contact GFI at 919-388-3373 or 888-243-4329. http://www.gfi.com * UNDERSTAND INTERNET SECURITY CONCEPTS Apress released "Developing Trust: Online Privacy and Security," a book by Matt Curtin that provides an analysis of Internet security concepts. The book also teaches you how to catch, identify, and repair flawed security design techniques before you incorporate the design into the final product. The three sections of the book are Understanding Security and Privacy, Prevention, and The Cure. The 282-page book costs $39.95. Contact Apress at 510-549-5930. http://www.apress.com 8. ==== HOT THREADS ==== * WINDOWS & .NET MAGAZINE ONLINE FORUMS http://www.winnetmag.net/forums Featured Thread: WFV Folders in the System Root Folder (Ten messages in this thread) A user writes that his system has numerous folders with the prefix WFV in the system root folder, and the folders seem to be modified daily. He isn't sure what the folders are and wonders whether anyone can help him determine what creates and modifies them. Can you help? http://www.secadministrator.com/forums/thread.cfm?thread_id=83610 * HOWTO MAILING LIST http://www.secadministrator.com/listserv/page_listserv.asp?s=howto Featured Thread: VPN Clients Not Connecting (Eight messages in this thread) Jorgen has a Windows NT and RAS-based VPN established for remote workers. His VPN in Sweden works fine, but his VPNs established in remote offices in other countries don't work. He receives error messages that indicate the remote computer isn't responding, or that the remote port isn't negotiating. Read the responses or lend a hand at the following URL: http://184.108.40.206/listserv/page_listserv.asp?a2=ind0201d&l=howto&p=2233 9. ==== CONTACT US ==== Here's how to reach us with your comments and questions: * ABOUT IN FOCUS -- markat_private * ABOUT THE NEWSLETTER IN GENERAL -- mlibbeyat_private (please mention the newsletter name in the subject line) * TECHNICAL QUESTIONS -- http://www.winnetmag.net/forums * PRODUCT NEWS -- productsat_private * QUESTIONS ABOUT YOUR SECURITY UPDATE SUBSCRIPTION? Customer Support -- securityupdateat_private * WANT TO SPONSOR SECURITY UPDATE? emedia_oppsat_private ******************** Receive the latest information about the Windows and .NET topics of your choice. Subscribe to our other FREE email newsletters. http://www.winnetmag.net/email |-+-+-+-+-+-+-+-+-+-| Thank you for reading Security UPDATE. SUBSCRIBE To subscribe, send a blank email to mailto:Security-UPDATE_Subat_private - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Thu Jan 31 2002 - 06:46:29 PST