[ISN] Subject: Security UPDATE, July 17, 2002

From: InfoSec News (isnat_private)
Date: Thu Jul 18 2002 - 05:04:47 PDT

  • Next message: InfoSec News: "[ISN] Delaware college student charged with hacking university system to give herself A's"

    ********************
    Windows & .NET Magazine Security UPDATE--brought to you by Security
    Administrator, a print newsletter bringing you practical, how-to
    articles about securing your Windows .NET Server, Windows 2000, and
    Windows NT systems.
       http://www.secadministrator.com
    ********************
    
    ~~~~ THIS ISSUE SPONSORED BY ~~~~
    
    Security Auditing and Configuration Analysis!
       http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw03C30A2
    
    VeriSign - The Value of Trust
       http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw01bI0As
       (below IN FOCUS)
    
    ~~~~~~~~~~~~~~~~~~~~
    
    ~~~~ SPONSOR: SECURITY AUDITING AND CONFIGURATION ANALYSIS! ~~~~
       How many people have administrative rights in your network? How
     many unused user accounts are in your domains? What changes were made to
    your directories during the last week? Security vulnerabilities occur
    when you can't answer these questions. Don't be vulnerable to attacks
    from inside and outside your network. Aelita Enterprise Directory
    Reporter offers a comprehensive directory reporting and security
    assessment solution for Windows NT/2000, Active Directory, and
    Exchange. Improve security with network configuration, Group Policy,
    and user information that lets you locate and correct problems and
    implement enterprise-wide policies. Download a FREE evaluation copy.
    Put Aelita in the lab!
       http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw03C30A2
    
    ~~~~~~~~~~~~~~~~~~~~
    
    July 17, 2002--In this issue:
    
    1. IN FOCUS
         - Unwise Connectivity; Microsoft Obtains Third-Party Protection;
           and Camera/Shy
    
    2. SECURITY RISKS
         - Multiple Vulnerabilities in Microsoft SQL Server 2000 and MSDE
           2000
         - DoS in WatchGuard Firebox VPN Appliance
         - DoS in BEA WebLogic for Win2K and NT
    
    3. ANNOUNCEMENTS
         - Register Today for Our Win2K Migration Web Seminar!
         - Enter the Windows & .NET Magazine/Transcender Sweepstakes!
    
    4. SECURITY ROUNDUP
         - News: Survey Says Web Is More Vulnerable Than Ever
         - Feature: Security Holes Pop Up in Unexpected Places
         - Feature: Best Practices for Secure Administrator Accounts
    
    5. HOT RELEASES
         - Sprint IP VPN Services: Special Offer
         - IBM E-Business Integration White Paper
    
    6. SECURITY TOOLKIT
         - Virus Center
         - FAQ: How Can I Force a User to Use a Machine-Specific Group
           Policy Rather Than a User-Specific Group Policy?
    
    7. NEW AND IMPROVED
         - Submit Top Product Ideas
         - Protect Your Valuable Notebook from Theft
         - Invisible Means Invulnerable
    
    8. HOT THREADS
         - Windows & .NET Magazine Online Forums
             - Featured Thread: Blocking IRC Scripts
    
    9. CONTACT US
       See this section for a list of ways to contact us.
    
    ~~~~~~~~~~~~~~~~~~~~
    
    1. ==== IN FOCUS ====
       (contributed by Mark Joseph Edwards, News Editor,
    markat_private)
    
    * UNWISE CONNECTIVITY; MICROSOFT OBTAINS THIRD-PARTY PROTECTION; AND
    CAMERA/SHY
    
    According to a provocative article from the Associated Press (AP) wire
    last week (which draws information from a Los Angeles Times report),
    US power and energy companies "have become targets for computer
    hackers who have managed to penetrate energy control networks as well
    as administrative systems."
       http://www.cbsnews.com/stories/2002/07/08/tech/main514426.shtml
    
    The article reports that the online power and energy companies
    surveyed have experienced an average of 1280 attacks in the past 6
    months alone. Riptech, which performed the study, said that the number
    of attacks represents a 77 percent increase over the number of attacks
    experienced last year. According to the article, FBI Cybercrime
    Director Ronald Dick said, "The event that I fear most is a physical
    attack in conjunction with the success of a cyber attack on an
    infrastructure such as electric power or 911."
    
    The report points out the weakest link in the energy and power
    companies' infrastructure: control systems that monitor power grids
    and govern the flow of oil and water through pipelines. Formerly,
    these systems weren't connected to public networks such as the
    Internet, but now they are--and, as a result, they're vulnerable to
    attack.
    
    The story begs the obvious question: Why would any entity connect
    extremely critical infrastructures (e.g., power companies, national
    911 services) to the Internet? By doing so, they ask for serious
    trouble. Is that wise in times such as these? I don't think so.
    
    In other recent and interesting news, PC World reported that Microsoft
    has adopted NetScreen-500 to help protect its corporate network (see
    the first URL below). NetScreen Technologies (see the second URL
    below) issued a press release regarding the adoption. NetScreen-500 is
    a firewall/VPN combination appliance that, among other things, helps
    stop viruses and worms from propagating into a network. What makes
    this news strange is that Microsoft touts its Internet Security and
    Acceleration (ISA) Server 2000 (see the third URL below) as a product
    that "protects the enterprise network from hacker intrusion and
    malicious worms through application-level filtering."
       http://www.pcworld.com/news/article/0,aid,102626,tk,dn071202X,00.asp
       http://www.netscreen.com/products/index.html
       http://www.microsoft.com/isaserver/howtobuy/upgrade.asp
    
    Are you looking for a way to transmit sensitive information? A group
    that calls itself Hacktivismo has released a new tool called
    Camera/Shy at the Hackers On Planet Earth (HOPE) Conference in New
    York. Camera/Shy is a steganography tool that encrypts and stores data
    in graphical image files. Steganography adds extra data to a typical
    image file so that when someone views the file, it seems to contain an
    ordinary image. After data is stored in an image file, you can
    transmit the file, and the recipient can recover the data stored
    therein. According to Hacktivismo, the tool is easy to use. Camera/Shy
    targets users who work behind network border devices that filter or
    censor Internet content. You can find a temporary download site for
    Camera/Shy and its documentation at the first URL below. Let's hope
    nobody uses Camera/Shy to attack power and energy companies. For
    additional information about steganography, go to the second URL
    below.
       http://members.cox.net/osioniusx/CameraShy.exe
       http://www.secadministrator.com/articles/index.cfm?articleid=20057
     
    ~~~~~~~~~~~~~~~~~~~~
    
    ~~~~ SPONSOR: VERISIGN - THE VALUE OF TRUST ~~~~
       FREE E-COMMERCE SECURITY GUIDE
       Is your e-business built on a strong, secure foundation? Find out
    with VeriSign's FREE White Paper, "Building an E-Commerce Trust
    Infrastructure." Learn how to authenticate your site to customers,
    secure your web servers with 128-Bit SSL encryption, and accept secure
    payments online. Click here:
       http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw01bI0As
    
    ~~~~~~~~~~~~~~~~~~~~
    
    2. ==== SECURITY RISKS ====
       (contributed by Ken Pfeil, kenat_private)
    
    * MULTIPLE VULNERABILITIES IN SQL SERVER 2000 AND MSDE 2000
       Cesar Cerrudo and Mark Litchfield of Next Generation Security
    Software discovered multiple vulnerabilities in Microsoft SQL Server
    2000 and Microsoft SQL Server Desktop Engine (MSDE) 2000, the most
    severe of which can lead to remote compromise of the vulnerable
    server. Microsoft has released Security Bulletin MS02-034 (Cumulative
    Patch for SQL Server) to address this vulnerability and recommends
    that affected users download and apply the appropriate patch mentioned
    in the bulletin. These patches are cumulative and address all
    previously discovered vulnerabilities in the affected product.
       http://www.secadministrator.com/articles/index.cfm?articleid=25868
    
    * DoS IN WATCHGUARD FIREBOX VPN APPLIANCE
       Andreas Sandor and Peter Grundl discovered a Denial of Service
    (DoS) condition in WatchGuard Technologies' Firebox with firmware
    5.x.x. By sending a malformed packet to the listener service on TCP
    port 4110, an attacker can cause the Dynamic VPN Configuration
    Protocol (DVCP) service to fail. The vendor, WatchGuard, recommends
    that affected users upgrade their firmware to version 6.x.x, available
    through the company's LiveSecurity Service.
       http://www.secadministrator.com/articles/index.cfm?articleid=25812
    
    * DoS IN BEA WEBLOGIC FOR WIN2K AND NT
       Peter Grundl discovered a Denial of Service (DoS) condition in BEA
    Systems' WebLogic Server when used with the performance pack, which
    installs by default. By data or connection flooding, an attacker can
    crash the Web service with a report of an error in ntdll.dll. The
    vendor, BEA Systems, has released a security advisory to address this
    problem and recommends that affected users apply the appropriate patch
    listed in this bulletin.
       http://www.secadministrator.com/articles/index.cfm?articleid=25811
    
    3. ==== ANNOUNCEMENTS ====
       (brought to you by Windows & .NET Magazine and its partners)
    
    * REGISTER TODAY FOR OUR WIN2K MIGRATION WEB SEMINAR!
       You can make the Windows 2000 road less bumpy--if you know how.
    Hear Jeremy Moskowitz talk about what to do before your Win2K
    migration actually begins, and what to be on the lookout for during
    the migration process. This special online event is scheduled for
    Thursday, July 18, so sign up today!
       http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw022F0A3
    
    * ENTER THE WINDOWS & .NET MAGAZINE/TRANSCENDER SWEEPSTAKES!
       Nothing can help you prepare for certification like Transcender
    products, and no one can help you master your job like Windows & .NET
    Magazine. Enter our combined sweepstakes contest, and you could win a
    Transcender Deluxe MCSE Core Pak (a $569 value) or one of several
    other great prizes. Sign up today!
       http://list.winnetmag.com/cgi-bin3/flo?y=eMgt0CJgSH0CBw028j0Ak
    
    4. ==== SECURITY ROUNDUP ====
    
    * NEWS: SURVEY SAYS WEB IS MORE VULNERABLE THAN EVER
       A June 2002 Netcraft survey shows that Web sites are more
    vulnerable than ever because of several recently reported security
    problems with Microsoft IIS and Apache Web server. Netcraft polled
    38,807,788 Web servers and found that 59.67 percent (more than 23
    million sites) run Apache Web server and 28.96 percent run IIS.
       http://www.secadministrator.com/articles/index.cfm?articleid=25846
    
    * FEATURE: SECURITY HOLES POP UP IN UNEXPECTED PLACES
       With so many obvious security holes that systems administrators
    must watch for, keeping up with all the potential problem areas that
    the Windows OSs present is tough. It's even worse when the security
    problems occur in a little-used but ubiquitous application such as the
    Windows Media Player (WMP).
       http://www.secadministrator.com/articles/index.cfm?articleid=25840
    
    * FEATURE: BEST PRACTICES FOR SECURE ADMINISTRATOR ACCOUNTS
       Creating unique passwords for your Administrator accounts is one
    important step you can take to keep your systems secure. Dick Lewis
    offers best practices that can help you protect the powerful
    Administrator account from intruders. Be sure to read the article on
    our Web site!
       http://www.secadministrator.com/articles/index.cfm?articleid=25721
    
    5. ==== HOT RELEASES ====
    
    * SPRINT IP VPN SERVICES: SPECIAL OFFER
       For secure, global network access and great savings, visit
      
      http://ad.doubleclick.net/clk;4366192;7296505;q?http://www.sprintbiz.com/apps/tag/sprintbizQ2Growth/,16,27,S3,199/bsgpromo/ip1.html
    
    * IBM E-BUSINESS INTEGRATION WHITE PAPER
       Learn to remain competitive as e-business technologies evolve. The
    IBM white paper, "Managing e-business integration challenges," will
    help you understand how to identify key integration components. Get
    your complimentary copy at
       http://www.ibm.com/e-business/playtowin/n122
    
    6. ==== SECURITY TOOLKIT ====
    
    * VIRUS CENTER
       Panda Software and the Windows & .NET Magazine Network have teamed
    to bring you the Center for Virus Control. Visit the site often to
    remain informed about the latest threats to your system security.
       http://www.secadministrator.com/panda
    
    * FAQ: HOW CAN I FORCE A USER TO USE A MACHINE-SPECIFIC GROUP POLICY
    RATHER THAN A USER-SPECIFIC GROUP POLICY?
       ( contributed by John Savill, http://www.windows2000faq.com )
    
    A. Typically, the settings that the OS applies when a user logs on are
    based on the user's account container (e.g., a domain, a site, an
    organizational unit--OU), regardless of which container the user's
    machine belongs to. In some instances, you might want to forgo using
    this default behavior and instead associate a user's settings with the
    location of the user's computer within Active Directory (AD). For
    example, you might want to set a strict, defined set of policies for a
    publicly accessible computer, regardless of who logs on to that
    computer.
       To establish machine-specific settings, use Group Policy to set the
    computer's container to "loopback" mode--so that the computer's client
    settings take precedence--by performing the following steps:
       1. Start Group Policy Editor (GPE) and load the policy that affects
    the computer whose behavior you want to modify (alternatively, you can
    start the Microsoft Management Console--MMC--Active Directory Users
    and Computers snap-in, right-click the container, select Properties,
    then select the Group Policy tab).
       2. Expand the Computer Configuration, Administrative Templates,
    System, Group Policy branches.
       3. Double-click the "Loopback Policy" option (or "User Group Policy
    loopback processing mode" in Windows .NET Server--Win.NET Server).
       4. Select the Enabled option, then select the Mode:
       - Merge Mode--loads a user's normal settings first, then loads any
    settings based on the computer's location, thus overwriting any
    conflicting user settings
       - Replace Mode--loads only settings based on the computer's
     location
       5. Click OK.
    
    7. ==== NEW AND IMPROVED ====
       (contributed by Judy Drennen, productsat_private)
    
    * SUBMIT TOP PRODUCT IDEAS
       Have you used a product that changed your IT experience by saving
    you time or easing your daily burden? Do you know of a terrific
    product that others should know about? Tell us! We want to write about
    the product in a future What's Hot column. Send your product
    suggestions to whatshotat_private
    
    * PROTECT YOUR VALUABLE NOTEBOOK FROM THEFT
       Belkin released SafeTech, a line of security products for notebook
    computers, dock stations, flat-screen monitors, and other expensive
    computer devices. The SafeTech line features two locks: a keyless
    version, the SafeTech C100 Combo Security Lock at $24.95 and a keyed
    version, the SafeTech K100 Security Lock at $29.95. For more
    information, go to the Belkin Web site.
       http://www.belkin.com
    
    *  INVISIBLE MEANS INVULNERABLE
       Gianus Technologies introduced Phantom Total Security (PTS),
    security software that can protect any type of computer data by making
    it invisible to attackers, unauthorized users, and even viruses. PTS
    splits a computer hard disk into two parts, then makes one part
    disappear with the simple click of an icon. PTS costs $190 and runs on
    multiple OSs on the same computer, each OS transparent to the other.
    Contact Gianus Technologies at 212-838-7070.
       http://www.phantomts.com
    
    8. ==== HOT THREADS ====
    
    * WINDOWS & .NET MAGAZINE ONLINE FORUMS
       http://www.winnetmag.com/forums
    
    Featured Thread: Blocking IRC Scripts
       (Two messages in this thread)
    
    Brett writes that one of his clients found that someone has gained
    access to the client's Windows 2000 server and installed an Internet
    Relay Chat (IRC) script that lets a remote user control the server.
    The script uses two programs, firedeamon.exe and srchost.exe. Brett
    wants to know the best way to prevent the installation of such
    scripts.
       http://www.secadministrator.com/forums/thread.cfm?thread_id=108852
    
    9. ==== CONTACT US ====
       Here's how to reach us with your comments and questions:
    
    * ABOUT IN FOCUS -- markat_private
    
    * ABOUT THE NEWSLETTER IN GENERAL -- vpattersonat_private (please
    mention the newsletter name in the subject line)
    
    * TECHNICAL QUESTIONS -- http://www.winnetmag.com/forums
    
    * PRODUCT NEWS -- productsat_private
    
    * QUESTIONS ABOUT YOUR SECURITY UPDATE SUBSCRIPTION? Customer
    Support -- securityupdateat_private
    
    * WANT TO SPONSOR SECURITY UPDATE? emedia_oppsat_private
    
    ********************
    
       This email newsletter is brought to you by Security Administrator,
    the print newsletter with independent, impartial advice for IT
    administrators securing a Windows 2000/Windows NT enterprise.
    Subscribe today!
       http://www.secadministrator.com/sub.cfm?code=saei25xxup
    
       Receive the latest information about the Windows and .NET topics of
    your choice. Subscribe to our other FREE email newsletters.
       http://www.winnetmag.com/email
    
    |-+-|-+-|-+-|-+-|-+-|
    
    Thank you for reading Security UPDATE.
    
    MANAGE YOUR ACCOUNT
    You can manage your entire Windows & .NET Magazine Network email
    newsletter account on our Web site. Simply log on and you can change
    your email address, update your profile information, and subscribe or
    unsubscribe to any of our email newsletters all in one place.
       http://www.winnetmag.com/email
    
    Thank you!
    
    
    
    -
    ISN is currently hosted by Attrition.org
    
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.
    



    This archive was generated by hypermail 2b30 : Thu Jul 18 2002 - 08:03:01 PDT