Security UPDATE, March 6, 2002

[InfoSec News <isn () c4i org>]

********************
Windows & .NET Magazine Security UPDATE--brought to you by Security 
Administrator, a print newsletter bringing you practical, how-to 
articles about securing your Windows .NET Server, Windows 2000, and 
Windows NT systems.
   http://www.secadministrator.com 
******************** 

~~~~ THIS ISSUE SPONSORED BY ~~~~ 

Protection from the Top 10 Security Threats
   http://list.winnetmag.com/cgi-bin3/flo?y=eK1X0CJgSH0CBw0rVA0AF

VeriSign--The Value of Trust
   http://list.winnetmag.com/cgi-bin3/flo?y=eK1X0CJgSH0CBw0p5N0Ar
   (below IN FOCUS)

~~~~~~~~~~~~~~~~~~~~ 

~~~~ SPONSOR: PROTECTION FROM THE TOP 10 SECURITY THREATS ~~~~
   Do you know the 10 most widely exploited vulnerabilities in the 
Windows environment? Better yet, do you know how to close them? What's 
the most common weakness found throughout today's IT environments? What 
can you do about it? Tune in to BindView's March 14 Webinar with Scott 
Blake, "Top 10 Security Threats for Windows 2000 and Active Directory," 
and find out what. If you do nothing else, closing these Top 10 holes 
will go a long way to securing your network! Register today at
   http://list.winnetmag.com/cgi-bin3/flo?y=eK1X0CJgSH0CBw0rVA0AF

~~~~~~~~~~~~~~~~~~~~ 

March 6, 2002--In this issue: 

1. IN FOCUS
     - Additional Information About Microsoft Baseline Security 
       Analyzer

2. SECURITY RISKS
     - Authentication Vulnerability in SMTP of Microsoft Windows 2000 
       and Exchange Server 5.5
     - Denial of Service in Microsoft's SMTP Service
     - Multiple Vulnerabilities in PHP Scripting Language

3. ANNOUNCEMENTS
     - Register for a Free NAS Webinar!
     - Register Now for Security Matters at Internet World Spring

4. SECURITY ROUNDUP
     - News: IETF Receives Proposal: Responsible Vulnerability 
       Disclosure Process
     - News: Microsoft Releases Patches for Several Critical Flaws

5. SECURITY TOOLKIT
     - Virus Center
     - FAQ: How Can I Enable the Microsoft Outlook Web Access (OWA) 
       Logoff Warning Page?

6. NEW AND IMPROVED
     - Firewall Products
     - Learn About Security Architecture

7. HOT THREADS
     - Windows & .NET Magazine Online Forums
         - Featured Thread: Automatically Log Off Users
     - HowTo Mailing List
          - Featured Thread: Locking Users Out of a Directory at 
            Specified Times 

8. CONTACT US 
   See this section for a list of ways to contact us. 
~~~~~~~~~~~~~~~~~~~~ 

1. ==== IN FOCUS ==== 

* ADDITIONAL INFORMATION ABOUT MICROSOFT BASELINE SECURITY ANALYZER
   Last week, I reported that Microsoft plans to release a new 
security-analysis tool, Microsoft Baseline Security Analyzer (MBSA), 
which Microsoft is codeveloping with Shavlik Technologies. Since then, 
I've spoken about the new tool with Lara Sosnosky, product manager at 
Microsoft, and Mark Shavlik, founder of Shavlik Technologies.

Sosnosky said that MBSA is essentially a superset of Microsoft Personal 
Security Advisor (MPSA), Microsoft's Web-based security scanner. (See 
the URLs at the end of the column.) MBSA will scan servers and remote 
systems and will also contain the functionality in Microsoft's existing 
security-analysis tool, HFNetChk, which scans for installed or missing 
hotfixes. (MBSA contains HFNetChk's compiled code.) The tool will ship 
as an executable that runs on local systems instead of from a 
Microsoft-hosted Web site.

Because MBSA is a superset of MPSA, you'll likely see MPSA's 
functionality in the MBSA tool. MPSA scans a workstation and reports on 
a wealth of security aspects, such as missing security patches and 
settings for a variety of system components. MPSA's list of checks (to 
be seen in MBSA) includes scans that relate to password strength and 
length parameters, Microsoft Internet Explorer (IE) and Microsoft 
Outlook Express security (including security zones), Microsoft Office 
macro protection, RAS Manager security, system auditing, file-system 
security, anonymous connections, automated logons, shares, 
Administrator group membership, and service parameters. 

When scanning servers, MBSA will be able to inspect various services to 
some degree. For example, when inspecting a Microsoft SQL Server 
installation, MBSA will check whether the systems administrator account 
has a blank password, which users the SysAdmin group includes, and 
whether the default installation directory has properly set the ACLs. 
In another example, when MBSA scans a Microsoft IIS server, MBSA will 
check for installed sample applications. The list of checks performed 
against a server is more extensive, but these examples give you a basic 
idea of what to expect. 

The first version of MBSA will ship as both a GUI-based and command-
line-based tool, so you'll be able to run MBSA from batch files and use 
task schedulers to launch the tool. The initial MBSA release will have 
its various checks hard-coded, so the only control users will have over 
which checks MBSA performs will be to tell the tool whether to scan 
services and which services to scan. Users will define the services to 
scan through a text-based script file.  

MBSA will run on Windows XP Professional, XP Home, Windows 2000 Server, 
and Win2K Workstation. The tool will scan all OSs (whether server or 
workstation versions) from Windows NT 4.0 through XP. The tool's 
reporting subsystem will produce XML-based output, and the GUI will 
render the XML into readable HTML for the user.

Shavlik said that after Microsoft releases MBSA, his company will 
release an updated version of its current EnterpriseInspector security 
scanner product. The updated EnterpriseInspector will have a look and 
feel similar to MBSA and will be compatible with MBSA's scanning 
ability. Shavlik said that EnterpriseInspector will become a superset 
of Microsoft's MBSA much as Shavlik's commercially available 
HFNetChkPro is a superset of Microsoft's free HFNetChk tool. Expect to 
see even more scanning functionality with EnterpriseInspector once 
Shavlik releases the updated version. 

One advantage of the updated EnterpriseInspector product will be its 
use of a SQL Server 2000 back end, which Shavlik already includes in 
the current EnterpriseInspector version. By using a database server to 
store collected security information, EnterpriseInspector will let 
users perform more tailored scanning features and obtain better 
reporting styles. For example, EnterpriseInspector will be able to use 
the stored data to perform cross scans, such as listing the top-10 
least-secured IIS or SQL servers. Advanced users will be able to define 
additional scanning parameters that will permit other types of 
customized scanning.

Microsoft and Shavlik have tentatively scheduled the release of both 
MBSA and the MBSA-compatible EnterpriseInspector for late March, but 
that time frame could slip. Release depends on debugging the code and 
coordinating the date-driven and version-dependent aspects of the tools 
as they relate to the various renditions of Microsoft products. I'll 
notify you when the tools become available. 
   http://www.microsoft.com/technet/mpsa/info.asp
   http://www.microsoft.com/technet/security/tools/mpsa.asp
   http://www.shavlik.com

Until next time, have a great week. 

Sincerely, 
Mark Joseph Edwards, News Editor 
mark () ntsecurity net 

~~~~~~~~~~~~~~~~~~~~ 

~~~~ SPONSOR: VERISIGN--THE VALUE OF TRUST ~~~~
   Is your e-business secure enough? Learn why it's vital to encrypt 
your business transactions, secure your intranets, and authenticate 
your Web site with the strongest encryption available--128-bit SSL. To 
learn more, get VeriSign's FREE Guide, "Securing Your Web Site for 
Business," now: 
   http://list.winnetmag.com/cgi-bin3/flo?y=eK1X0CJgSH0CBw0p5N0Ar

~~~~~~~~~~~~~~~~~~~~ 

2. ==== SECURITY RISKS ==== 
   (contributed by Ken Pfeil, ken () winnetmag com) 

* AUTHENTICATION VULNERABILITY IN SMTP OF MICROSOFT WINDOWS 2000 AND 
EXCHANGE SERVER 5.5
   BindView's RAZOR Team discovered a vulnerability in the way that the 
SMTP service handles a valid response from the underlying OS's NT LAN 
Manager (NTLM) authentication layer. An attacker can use this 
vulnerability to gain user-level privileges on the SMTP service. 
Microsoft released Security Bulletin MS02-011, which addresses this 
vulnerability, and recommends that affected users immediately apply the 
appropriate patch as listed in Security Bulletin MS02-011.
   http://www.secadministrator.com/articles/index.cfm?articleid=24330

* DENIAL OF SERVICE IN MICROSOFT'S SMTP SERVICE
   HD Moore discovered a Denial of Service (DoS) condition in the SMTP 
service of Windows XP Professional, Windows 2000, and Microsoft 
Exchange 2000 Server. A vulnerability exists in how the service handles 
a particular type of SMTP command used to transfer incoming mail data. 
By issuing a malformed version of the SMTP command, an attacker can 
cause the SMTP service to fail. Microsoft released Security Bulletin 
MS02-012, which addresses this vulnerability, and recommends that 
affected users immediately apply the appropriate patch as listed in 
Security Bulletin MS02-012.
   http://www.secadministrator.com/articles/index.cfm?articleid=24331

* MULTIPLE VULNERABILITIES IN PHP SCRIPTING LANGUAGE
   Steffan Esser discovered multiple vulnerabilities in the PHP 
scripting language's file-upload code that let an attacker remotely 
compromise a vulnerable server. Several problems exist in the way PHP 
handles multipart/form-data POST requests. An attacker can use each of 
these problems to execute arbitrary code on the vulnerable system. 
Affected users should immediately upgrade to PHP 4.1.2 or download the 
appropriate security fix from the PHP Web site
   http://www.secadministrator.com/articles/index.cfm?articleid=24324

3. ==== ANNOUNCEMENTS ==== 

* REGISTER FOR A FREE NAS WEBINAR!
   Join our free Webinar, "NAS Emerges as a Prime Storage Solution" 
(sponsored by Dell and Microsoft), and discover how Network Attached 
Storage (NAS) can meet your enterprise's demands for high-availability, 
manageability, scalability, and performance. Also, learn more about how 
Windows 2000 is optimized for developing specialized NAS applications 
and hear about real-world solutions for NAS and emerging NAS 
applications. Register today!
   http://list.winnetmag.com/cgi-bin3/flo?y=eK1X0CJgSH0CBw0rHs0Ap

* REGISTER NOW FOR SECURITY MATTERS AT INTERNET WORLD SPRING
   The Security Matters conference and exhibit will bring you up-to-
date on the latest products and services that can help you keep your 
network, your data, and your company secure. Security Matters is co-
located with Internet World Spring, April 24 through 26, in Los 
Angeles. For registration and information, visit the following URL.
   http://list.winnetmag.com/cgi-bin3/flo?y=eK1X0CJgSH0CBw0rVB0AG 

4. ==== SECURITY ROUNDUP ==== 

* NEWS: IETF RECEIVES PROPOSAL: RESPONSIBLE VULNERABILITY DISCLOSURE 
PROCESS 
   The Internet Engineering Task Force (IETF) received a draft proposal 
called "Responsible Vulnerability Disclosure Process" (RVDP), which the 
writers hope will become a published Request for Comments (RFC) 
standard. 
   http://www.secadministrator.com/articles/index.cfm?articleid=24321

* NEWS: MICROSOFT RELEASES PATCHES FOR SEVERAL CRITICAL FLAWS 
   Microsoft's security jihad continued this week as the company issued 
a set of patches that address "critical flaws" in Microsoft Internet 
Explorer (IE), Commerce Server 2000, and SQL Server. The IE patches, 
which the company issued through Windows Update and Auto Update late 
last week, address a previously unannounced VBScript-related 
vulnerability that affects all newer IE versions. The patches also deal 
with an IE 6.0 bug first revealed late last year.
    http://www.secadministrator.com/articles/index.cfm?articleid=24288

5. ==== SECURITY TOOLKIT ==== 

* VIRUS CENTER 
   Panda Software and the Windows & .NET Magazine Network have teamed to 
bring you the Center for Virus Control. Visit the site often to remain 
informed about the latest threats to your system security. 
   http://www.secadministrator.com/panda 

* FAQ: HOW CAN I ENABLE THE MICROSOFT OUTLOOK WEB ACCESS (OWA) LOGOFF 
WARNING PAGE?
 ( contributed by John Savill, http://www.windows2000faq.com ) 

A. The OWA logoff warning page is for OWA users who regularly use 
public kiosks to access their email. The Log Off icon on the main 
Outlook bar points to a customizable Active Server Pages (ASP) page 
that tells the user how to log off of his or her mailbox.
   You can enable OWA's logoff warning page if the user redirects the 
browser window away from OWA (either by closing a Web browser window or 
by typing a different URL into the address bar). To enable the warning 
page, follow these steps: 

   1. Start a registry editor (e.g., regedit.exe). 
   2. Navigate to the 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeWEB\OWA 
subkey. 
   3. From the Edit menu, select New, DWORD Value. 
   4. Enter a name of EnableLogoffWarning and press Enter. 
   5. Double-click the new value, set it to 1, and click OK. 
   6. Close the registry editor.

6. ==== NEW AND IMPROVED ==== 
   (contributed by Scott Firestone, IV, products () winnetmag com) 

* FIREWALL PRODUCTS
   SonicWALL released the SonicWALL PRO family of high-performance, 
business-class firewall appliances. The SonicWALL PRO 100 features 
unlimited network nodes and an integrated demilitarized zone (DMZ) port 
to support public servers. The SonicWALL PRO 200 features an IP 
Security (IPSec) VPN, support for as many as 500 VPN tunnels, an 
integrated DMZ port, and unlimited node support. The SonicWALL PRO 300 
features an IPSec VPN with 50 VPN clients for remote workers, SonicWALL 
ViewPoint reporting software, support for as many as 1000 VPN tunnels, 
an integrated DMZ port, and unlimited node support. Prices start at 
$1795. Contact SonicWALL at 408-745-9600.
   http://www.sonicwall.com

* LEARN ABOUT SECURITY ARCHITECTURE
   Osborne/McGraw-Hill released "Security Architecture: Design, 
Deployment, and Operations," a book by Christopher King, Curtis Dalton, 
and T. Osmanoglu, that teaches you how to design a secure solution and 
the principles for developing a solid network architecture. You'll 
learn how to develop an information classification and access control 
plan; how to use appropriate security technology; and how to ensure 
complete network security across multiple systems, applications, hosts, 
and devices. The 481-page book costs $49.99. Contact Osborne at 800-
227-0900.
   http://www.osborne.com

7. ==== HOT THREADS ==== 

* WINDOWS & .NET MAGAZINE ONLINE FORUMS 
   http://www.winnetmag.net/forums 

Featured Thread: Automatically Log Off Users
   (One message in this thread)

Dave wants to know how to set up a Windows NT 4.0 network to 
automatically log off users after a period of inactivity. Can you help? 
Read more about the problem at the following URL.
   http://www.secadministrator.com/forums/thread.cfm?thread_id=96983

* HOWTO MAILING LIST 
   http://www.secadministrator.com/listserv/page_listserv.asp?s=howto 

Featured Thread: Locking Users Out of a Directory at Specified Times
   (One message in this thread)

A user wants to know how to configure Windows 2000 to automatically 
prevent a group of users from accessing a particular directory during 
specified times of the day. Can you help? Read the responses or lend a 
hand at the following URL.
   
http://63.88.172.96/listserv/page_listserv.asp?a2=ind0202d&l=howto&p=1296

8. ==== CONTACT US ==== 
   Here's how to reach us with your comments and questions: 

* ABOUT IN FOCUS -- mark () ntsecurity net 

* ABOUT THE NEWSLETTER IN GENERAL -- mlibbey () winnetmag com (please 
mention the newsletter name in the subject line) 

* TECHNICAL QUESTIONS -- http://www.winnetmag.net/forums 

* PRODUCT NEWS -- products () winnetmag com 

* QUESTIONS ABOUT YOUR SECURITY UPDATE SUBSCRIPTION? Customer 
Support -- securityupdate () winnetmag com 

* WANT TO SPONSOR SECURITY UPDATE? emedia_opps () winnetmag com 

******************** 

   Receive the latest information about the Windows and .NET topics of 
your choice. Subscribe to our other FREE email newsletters. 
   http://www.winnetmag.net/email 

|-+-+-+-+-+-+-+-+-+-| 

Thank you for reading Security UPDATE.

SUBSCRIBE
To subscribe, send a blank email to mailto:Security-UPDATE_Sub () list winnetmag com.




-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY
of the mail.