-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
              AUSCERT External Security Bulletin Redistribution

                             
                     ESB-98.138 -- CERT Summary CS-98.07
		            Recent Activity
                             27 August 1998

===========================================================================

The CERT Coordination Centre has released the following advisory concerning
recent intruder activity.  Reports to AusCERT indicate that similar
activity is evident in Australia and New Zealand.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ----------------------------------------------------------------------------
CERT* Summary CS-98.07
August 26, 1998

The CERT Coordination Center periodically issues the CERT Summary to
draw attention to the types of attacks currently being reported to our
incident response team, as well as to other noteworthy incident and
vulnerability information. The summary includes pointers to sources of
information for dealing with the problems discussed here.

Past CERT Summaries are available from

       http://www.cert.org/summaries/
       ftp://ftp.cert.org/pub/cert_summaries/

- - ----------------------------------------------------------------------------


Recent Activity
- - ---------------

Since the last CERT Summary issued in June 1998 (CS-98.06), we have
seen these trends in incidents reported to us.

    1. New Tools Used For Widespread Scans

       It is nothing new for intruders to launch widespread scans to
       locate vulnerable machines. However, a new, publicly released
       intruder tool called "mscan" scans networks for many different
       vulnerabilities. The CERT/CC has received numerous reports
       indicating that this tool is in widespread use within the
       intruder community.

       We encourage you to review CERT Incident Note IN-98.02, which
       describes mscan and its recognizable signature in more
       detail. (A description of incident notes appears in a later
       section, New CERT Security Documents.) This incident note is
       available at

       http://www.cert.org/incident_notes/IN-98.02.html

       The tool uses DNS zone transfers and systematic scanning of IP
       addresses, either alone or in combination, to locate
       machines. Once machines are located, they are tested for a
       number of vulnerabilities.

       Additional useful information about mscan can be found at

       ftp://ftp.auscert.org.au/pub/auscert/advisory/AL-98.01.mscan

       courtesy of the Australian Computer Emergency Response Team
       (AUSCERT).

    2. Buffer Overflows in Some POP Servers

       The CERT/CC continues to receive reports that the buffer
       overflow vulnerability described in CA-98.08 is being exploited
       in some Post Office Protocol (POP) servers based on QUALCOMM's
       qpopper implementation of POP. Remote users can gain privileged
       access to systems running vulnerable POP servers.

       For more information about the vulnerability, please see the
       most recent version of the advisory at

       http://www.cert.org/advisories/CA-98.08.qpopper_vul.html
       ftp://ftp.cert.org/pub/cert_advisories/CA-98.08.qpopper_vul

       and take appropriate action.

    3. Multiple Vulnerabilities in BIND

       In two previous special edition CERT Summaries, CS-98.04 and
       CS-98.05, we discussed several attack methods being used to
       exploit vulnerabilities in BIND. CS-98.04 and CS-98.05 are
       available from

       http://www.cert.org/summaries/CS-98.04.html
       http://www.cert.org/summaries/CS-98.05.html

       Intruders are still exploiting vulnerabilities described in
       CERT Advisory CA-98.05. We encourage you to review CERT
       Advisory CA-98.05, which describes the BIND buffer overflow
       vulnerability, and to apply the appropriate patches if you have
       not done so already. This advisory is available from

       http://www.cert.org/advisories/CA-98.05.bind_problems.html
       ftp://ftp.cert.org/pub/cert_advisories/CA-98.05.bind_problems

       If you find you have been root compromised, this document
       suggests appropriate steps to take in response:

       http://www.cert.org/tech_tips/root_compromise.html
       ftp://ftp.cert.org/pub/tech_tips/root_compromise



Noteworthy Incident and Vulnerability Information
- - -------------------------------------------------

    Internet Explorer Vulnerability

    Some versions of Microsoft's Internet Explorer 4 have a
    vulnerability in the way they handle Javascript. This problem can
    permit a maliciously written script to run arbitrary code on a
    user's machine.

    There is a CERT Vulnerability Note describing this problem and
    defenses against it. The vulnerability note is available at

    http://www.cert.org/vul_notes/VN-98.06.ms_jscript.html


New CERT Security Documents
- - ---------------------------

The CERT/CC sometimes has incident and vulnerability information that
may not warrant CERT Summaries or Advisories, but that may have value
for the Internet community. To easily disseminate that information, we
have created two new document types: CERT Incident Notes and CERT
Vulnerability Notes.

    CERT/CC Incident Notes

    Incident notes are an informal and current way to inform the
    Internet community about computer security incidents and changing
    intruder attacks that have been reported to us. There is no set
    schedule for publishing incident notes; they will be created as
    noteworthy incident information becomes available.

    Incident notes are available from

    http://www.cert.org/incident_notes/index.html


    CERT/CC Vulnerability Notes

    We created vulnerability notes as an informal mechanism for
    publishing current information about vulnerabilities.

    Vulnerability notes may contain a wide variety of
    information. Vulnerabilities that do not meet the criteria to
    become CERT advisories may be described in vulnerability notes,
    though some notes contain information similar to that in CERT
    advisories. Other notes contain more informal discussions about
    vulnerabilities.

    Vulnerability notes are available from

    http://www.cert.org/vul_notes/index.html

    We encourage you to periodically check the incident notes and
    vulnerability notes for new information.


What's New and Updated
- - ----------------------

Brief notices about new and updated CERT information, such as
advisories, vendor-initiated bulletins, and incident and vulnerability
notes, are available from the CERT web site at

http://www.cert.org/nav/whatsnew.html

- - ----------------------------------------------------------------------------
How to Contact the CERT Coordination Center

Email cert@cert.org

Phone +1 412-268-7090 (24-hour hotline)

CERT personnel answer 8:30-5:00 p.m. EST(GMT-5)/EDT(GMT-4), and are on
call for emergencies during other hours.

Fax +1 412-268-6989

Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
USA

To be added to our mailing list for CERT advisories and bulletins,
send your email address to

cert-advisory-request@cert.org

In the subject line, type

SUBSCRIBE your-email-address

CERT advisories and bulletins are posted on the USENET news group:
comp.security.announce

CERT publications, information about FIRST representatives, and other
security-related information are available for anonymous FTP from

http://www.cert.org/
ftp://ftp.cert.org/pub/

If you wish to send sensitive incident or vulnerability information to
CERT staff by electronic mail, we strongly advise you to encrypt your
message. We can support a shared DES key or PGP. Contact the CERT
staff for more information.

Location of CERT PGP key

ftp://ftp.cert.org/pub/CERT_PGP.key


Copyright 1998 Carnegie Mellon University. Conditions for use,
disclaimers, and sponsorship information can be found in

http://www.cert.org/legal_stuff/legal_stuff.html and
ftp://ftp.cert.org/pub/legal_stuff

If you do not have FTP or web access, send mail to cert@cert.org with
"copyright" in the subject line.

* CERT is registered in the U.S. Patent and Trademark Office.


NO WARRANTY
- - -----------

ANY MATERIAL FURNISHED BY CARNEGIE MELLON UNIVERSITY AND THE SOFTWARE
ENGINEERING INSTITUTE IS FURNISHED ON AN "AS IS" BASIS. CARNEGIE
MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR
IMPLIED AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF
FITNESS FOR A PARTICULAR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY OR
RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY
DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM
PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNeQNz3VP+x0t4w7BAQERdgP/d0TXJGVbXn3O+PRxEa53VpTqb6KoxRNV
aN/JE/DPUD7Tl3v+yg/HZ3HtwXVNVfrzwV7A8GK1+tKYsVH1gMD2rkoa9pM/x70I
3Q1rW29b7ocOYKij+bB+DCDfOUZL4ctzTmcYd2rp/GB+dsKesvzXUCluaZpX+I8W
Zf7VJUdUzew=
=ynSe
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It will
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBNeZ99Sh9+71yA2DNAQHXRQP/YeZwZp/FNNV2GpBaZG30Ir4E0VbwkMOV
L47dGCxsMZ8KVmdhYScj9bESu8fjtBHhYbTePawrSlSK97vzoONIzwdtok9rWYwe
lbLj09dwax9BERehQVEpHuNEz/qDp9klWh9Nk3ihfzfRoW4ARLWanCxDS94eBz2W
pP81QfVHADg=
=qWep
-----END PGP SIGNATURE-----