From security-bulletins@us-cert.gov Wed Mar 17 21:03:38 2004
From: US-CERT Security Bulletins <security-bulletins@us-cert.gov>
To: security-bulletins@us-cert.gov
Date: Wed, 17 Mar 2004 19:48:51 -0500
Subject: US-CERT Cyber Security Bulletin SB04-077 -- Summary of Security
    Items from March 3 through March 16, 2004 


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Summary of Security Items from March 3 through March 16, 2004

   US-CERT will begin to incorporate some of the information from
   CyberNotes into Cyber Security Bulletins. CyberNotes were previously
   compiled for the Department of Homeland Security and posted to the
   NIPC web site. During the transition of the information into the Cyber
   Security Bulletin, we are offering a PDF version of the most recent
   version of CyberNotes on the US-CERT web site.

	   <http://www.us-cert.gov/cas/body/bulletins/SB04-077.pdf>


Publications by US-CERT

  Microsoft Outlook mailto URL Handling Vulnerability

     A vulnerability in the way Outlook 2002 interprets a "mailto:" URL
     could allow an attacker to execute arbitrary code of their choosing
     on the system running the vulnerable version of Outlook.

     * TA04-070A: Microsoft Outlook mailto URL Handling Vulnerability

       <http://www.us-cert.gov/cas/techalerts/TA04-070A.html>

     * VU#305206: Microsoft Outlook fails to properly filter parameters
       passed via "mailto:" URL

       <https://www.kb.cert.org/vuls/id/305206>

  US-CERT Vulnerability Notes

     VU#114070: NetScreen Instant Virtual Extranet (IVE) platform
     contains cross-site scripting vulnerability in delhomepage.cgi

	      <https://www.kb.cert.org/vuls/id/114070>

     NetScreen Instant Virtual Extranet (IVE) platform contains a
     cross-site scripting vulnerability in the row parameter of
     delhomepage.cgi, which could allow an attacker to mount a
     cross-site scripting attack.

     VU#197318: IBM Net.Data db2www CGI interpreter fails to properly
     validate requested macro filenames

	      <https://www.kb.cert.org/vuls/id/197318>

     IBM Net.Data fails to properly validate user input passed to the
     db2www CGI interpreter which could allow an attacker to mount a
     cross-site scripting attack against a vulnerable system.

     VU#363374: Cisco CSS 11000 Series Content Services Switch
     vulnerable to DoS via malformed UDP packets

             <https://www.kb.cert.org/vuls/id/363374>

     Several models of the Cisco Content Services Switch contain a
     vulnerability in their management interface that allows an attacker
     to restart the switch, resulting in a denial of service attack.

     VU#395670: FreeBSD fails to limit number of TCP segments held in
     reassembly queue

	     <https://www.kb.cert.org/vuls/id/395670>

     FreeBSD fails to limit the number of TCP segments held in a
     reassembly queue which could allow an attacker to exhaust all
     available memory buffers (mbufs) on the destination system
     resulting in a denial-of-service condition.

     VU#412566: Solaris conv_fix insecure file handling vulnerability

	     <https://www.kb.cert.org/vuls/id/412566>

     A vulnerability in a program supplied with the Solaris printing
     system could allow a local attacker to gain elevated privileges on
     the system.

     VU#490620: Linux kernel do_mremap() call creates virtual memory
     area of 0 bytes in length

	     <https://www.kb.cert.org/vuls/id/490620>

     There is a vulnerability in the Linux kernel memory management
     routines that allows local users to gain superuser privileges.

     VU#493966: Libxml2 URI parsing errors in nanohttp and nanoftp

	     <https://www.kb.cert.org/vuls/id/493966>

     Libxml is the XML parser for Gnome, a desktop suite and development
     platform for Linux systems. Libxml2, the latest version of the
     library as of this writing, has a buffer overflow vulnerability
     which may allow execution of arbitrary code.

     VU#584606: NTP service vulnerable to internal overflow if date /
     time offset is greater than 34 years

	     <https://www.kb.cert.org/vuls/id/584606>

     NTP (Network TIme Protocol) contains an integer overflow
     vulnerability that may lead to clients receiving an incorrect
     date/time offset.

     VU#688094: Microsoft MSN Messenger fails to properly validate file
     requests

	     <https://www.kb.cert.org/vuls/id/688094>

     Microsoft MSN Messenger fails to properly validate file requests
     which could allow an attacker to view the contents of files on the
     victim's system.

     VU#694782: Sun Solaris passwd command allows for privilege
     escalation

	     <https://www.kb.cert.org/vuls/id/694782>

     Sun Solaris contains a vulnerability in the passwd(1) command which
     could allow for privilege escalation.

     VU#831534: cPanel fails to verify input passed to the "user"
     parameter

	     <https://www.kb.cert.org/vuls/id/831534>

     A remotely exploitable vulnerability in CPanel's password reset and
     login scripts may allow a remote attacker to gain control of the
     vulnerable system.

     VU#878526: Apple Mac OS X "cd9660.util" buffer overflow

	     <https://www.kb.cert.org/vuls/id/878526>

     A component utility in Apple's Mac OS X operating system suffers
     from a buffer overflow vulnerability in its handling of
     command-line arguments. This vulnerability could allow a local
     attacker to gain elevated privileges on the vulnerable system.

     VU#902374: Apple Mac OS X TruBlueEnvironment vulnerable to buffer
     overflow

	     <https://www.kb.cert.org/vuls/id/902374>

     Apple Mac OS X contains a buffer overflow in TruBlueEnvironment
     which could allow a local, authenticated attacker to execute
     arbitrary code with root privileges.

     VU#981222: Linux kernel mremap(2) system call does not properly
     check return value from do_munmap() function

	     <https://www.kb.cert.org/vuls/id/981222>

     A vulnerability in the Linux mremap(2) system call could allow an
     authenticated, local attacker to execute arbitrary code with root
     privileges.

     VU#982630: Microsoft Windows Media Services fails to properly
     validate TCP requests

	     <https://www.kb.cert.org/vuls/id/982630>

     Microsoft Windows Media Services fails to properly validate TCP
     requests which could allow a remote, unauthenticated attacker to
     cause the services to refuse new TCP connections.


Publications by Vendors

Apache Software Foundation

     * mod_ssl memory leak (03-08-04)
       <http://www.apacheweek.com/features/security-20

Apple

     * Mac OS X Update 10.3.3 (03-15-04)
       <http://docs.info.apple.com/article.html?artnum=25711>

Cisco

     * Cisco Security Advisory: Cisco CSS 11000 Series Content Services
       Switches Malformed UDP Packet Vulnerability (03-04-04)
       <http://www.cisco.com/warp/public/707/cisco-sa-20040304-css.shtml>

Debian

     * DSA-464 gdk-pixbuf (03-16-04)
       <http://www.debian.org/security/2004/dsa-464>

     * DSA-463 samba - privilege escalation (03-12-04)
       <http://www.debian.org/security/2004/dsa-463>

     * DSA-462 xitalk - missing privilege release (03-12-04)
       <http://www.debian.org/security/2004/dsa-462>

     * DSA-461 calife - buffer overflow (03-11-04)
       <http://www.debian.org/security/2004/dsa-461>

     * DSA-460 sysstat - insecure temporary file (03-10-04)
       <http://www.debian.org/security/2004/dsa-460>

     * DSA-459 kdelibs - cookie path traversal (03-10-04)
       <http://www.debian.org/security/2004/dsa-459>

     * DSA-458 python2.2 - buffer overflow (03-09-04)
       <http://www.debian.org/security/2004/dsa-458>

     * DSA-457 wu-ftpd - several vulnerabilities (03-08-04)
       <http://www.debian.org/security/2004/dsa-457>

     * DSA-456 linux-kernel-2.2.19-arm - failing function and TLB flush
       (03-06-04)
       <http://www.debian.org/security/2004/dsa-456>

     * DSA-455 libxml - buffer overflows (03-03-04)
       <http://www.debian.org/security/2004/dsa-455>

Fedora

     * Fedora Core 1 Update: coreutils-5.0-34.1 (03-10-04)
       <http://www.redhat.com/archives/fedora-announce-list/2004-March/msg
       00014.html>

     * Fedora Core 1 Update: less-382-1.1 (03-09-04)
       <http://www.redhat.com/archives/fedora-announce-list/2004-March/msg
       00013.html>

     * mailman 2.1.4 available, also resolves security CAN-2003-0992
       (03-05-04)
       <http://www.redhat.com/archives/fedora-announce-list/2004-March/msg
       00010.html>

     * Fedora Core 1 Update: tcpdump-3.7.2-8.fc1.1 (03-04-04)
       <http://www.redhat.com/archives/fedora-announce-list/2004-March/msg
       00009.html>

Gentoo

     * Linux kernel do_mremap local privilege escalation (03-06-04)
       <http://forums.gentoo.org/viewtopic.php?t=145828>

     * Libxml2 URI Parsing Buffer Overflow Vulnerabilities (03-06-04)
       <http://forums.gentoo.org/viewtopic.php?t=145827>

Hewlett Packard

     * HPSBUX0310-290 SSRT3622 rev.2 Bind v920 (03-15-04)
       <http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0310
       -290>

     * HPSBMA01003 SSRT4679 - HP Web-enabled Management Software
       certificate compromise using HP HTTP Server (03-11-04)
       <http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBMA0100
       3>

     * HPSBTU01000 SSRT3674 Tru64 UNIX IPsec/IKE Potential Remote
       Unauthorized Access (03-03-04)
       <http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTU0100
       0>

Macromedia

     * MPSB04-04 Security Patch available for ColdFusion MX and JRun 4.0
       Web Services DoS (03-15-04)
       <http://www.macromedia.com/devnet/security/security_zone/mpsb04-04.
       html>

     * MPSB04-03 Potential Security Risk with Macromedia E-Licensing
       Client Activation Code (03-12-04)
       <http://www.macromedia.com/devnet/security/security_zone/mpsb04-03.
       html>

Mandrake

     * MDKSA-2004:022 - kdelibs (03-10-04)
       <http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKS
       A-2004:022>

     * MDKSA-2004:021 - mozilla (03-10-04)
       <http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKS
       A-2004:021>

     * MDKSA-2004:020 - gdk-pixbuf (03-10-04)
       <http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKS
       A-2004:020>

     * MDKSA-2004:019 - python (03-09-04)
       <http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKS
       A-2004:019>

     * MDKSA-2004:018 - libxml2 (03-03-04)
       <http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKS
       A-2004:018>

     * MDKSA-2004:017 - pwlib (03-03-04)
       <http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKS
       A-2004:017>

Microsoft

     * MS04-010: Security Update for MSN Messenger (03-09-04)
       <http://www.microsoft.com/technet/security/bulletin/ms04-010.mspx>

     * MS04-009: Security Update for Microsoft Office (03-09-04)
       <http://www.microsoft.com/technet/security/bulletin/ms04-009.mspx>

     * MS04-008 Vulnerability in Windows Media Services Could Allow a
       Denial of Service (03-09-04)
       <http://www.microsoft.com/technet/security/bulletin/ms04-008.mspx>

OpenBSD

     * Bug in the parsing of Allow/Deny rules for httpd(8)'s access
       module (03-13-04)
       <http://www.openbsd.org/errata.html#httpd2>

Oracle

     * Security Vulnerabilities in Oracle Application Server Web Cache
       (03-12-04)
       <http://otn.oracle.com/deploy/security/pdf/2004alert66.pdf>

     * Security Vulnerability in Oracle9i Application and Database
       Servers (03-12-04)
       <http://otn.oracle.com/deploy/security/pdf/2004alert65.pdf>

Red Hat

     * Updated kdelibs packages resolve cookie security issue (03-10-04)
       <https://rhn.redhat.com/errata/RHSA-2004-075.html>

     * Updated sysstat packages fix security vulnerabilities (03-10-04)
       <https://rhn.redhat.com/errata/RHSA-2004-093.html>

     * Updated gdk-pixbuf packages fix denial of service vulnerability
       (03-10-04)
       <https://rhn.redhat.com/errata/RHSA-2004-102.html>

     * Updated libxml2 packages fix security vulnerability (03-03-04)
       <https://rhn.redhat.com/errata/RHSA-2004-091.html>

SCO

     * OpenLinux: cups denial of service vulnerability (03-03-04)
       <ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2004-012.0.txt>

SGI

     * SGI Advanced Linux Environment security update #14 (03-12-04)
       <ftp://patches.sgi.com/support/free/security/advisories/20040302-01
       -U.asc>

     * SGI Advanced Linux Environment security update #13 (03-03-04)
       <ftp://patches.sgi.com/support/free/security/advisories/20040301-01
       -U.asc>

Sun Microsystems

     * Potential SSL Vulnerabilities in Sun Products (03-16-04)
       <http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57524>

     * Sun Java System Application Server Denial-of-Service Vulnerability
       (03-15-04)
       <http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57517>

     * ASN.1 Parsing Issue May Lead to Denial-of-Service Condition in Sun
       Java System Web Server and Sun Java System Application Server
       (03-15-04)
       <http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57498>

     * Sun ONE Web Server Buffer Overflow Vulnerability May Result in
       "Denial of Service" (DoS) (03-15-04)
       <http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57464>

     * Security Vulnerability With Loading Arbitrary Kernel Modules in
       Solaris Kernel (03-15-04)
       <http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57479>

     * SunPlex (Sun Cluster) Multiple Security Vulnerabilities in OpenSSL
       Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
       Protocols (03-15-04)
       <http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57475>

     * Solaris 9 patches 114332-08 and 114929-06 are WITHDRAWN - Patches
       Disable the Auditing Functionality on Basic Security Module (BSM)
       Enabled Systems (03-11-04)
       <http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57478>

     * Security Vulnerability Involving the passwd(1) Command (03-08-04)
       <http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57454>

     * Multiple Buffer Overflows in "/usr/bin/uucp" May Allow
       Unauthorized uucp(1C) User ID Access (03-03-04)
       <http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57508>

   Back to top

Publications by Third Parties

AusCERT

     * Macromedia Security Bulletin -- Security Patch available for
       ColdFusion MX and JRun 4.0 Web Services DoS (03-16-04)
       <http://www.auscert.org.au/render.html?it=3947&cid=1>

     * iDEFENSE Security Advisory 03.09.04 *UPDATE* -- Microsoft Outlook
       "mailto:" Parameter Passing Vulnerability (03-16-04)
       <http://www.auscert.org.au/render.html?it=3945&cid=1>

     * Macromedia Security Bulletin -- Potential Security Risk with
       Macromedia E-Licensing Client Activation Code (03-16-04)
       <http://www.auscert.org.au/render.html?it=3944&cid=1>

     * NGSSoftware Insight Security Research Advisory -- IBM DB2 Remote
       Command Execution Privilege Upgrade (03-16-04)
       <http://www.auscert.org.au/render.html?it=3943&cid=1>

     * RHSA-2004:053-01 -- Updated sysstat packages fix security
       vulnerabilities (03-15-04)
       <http://www.auscert.org.au/render.html?it=3942&cid=1>

     * RHSA-2004:102-01 -- Updated gdk-pixbuf packages fix denial of
       service vulnerability (03-15-04)
       <http://www.auscert.org.au/render.html?it=3941&cid=1>

     * Debian Security Advisory DSA 463-1 -- New samba packages fix
       privilege escalation in smbmnt (03-15-04)
       <http://www.auscert.org.au/render.html?it=3940&cid=1>

     * Debian Security Advisory DSA 462-1 -- New xitalk packages fix
       local group utmp exploit (03-15-04)
       <http://www.auscert.org.au/render.html?it=3939&cid=1>

     * HP SECURITY BULLETIN HPSBMA01003 -- SSRT4679 - HP Web-enabled
       Management Software certificate compromise using HP HTTP Server
       (03-15-04)
       <http://www.auscert.org.au/render.html?it=3938&cid=1>

     * Debian Security Advisory DSA 461-1 -- New calife packages fix
       buffer overflow (03-12-04)
       <http://www.auscert.org.au/render.html?it=3937&cid=1>

     * US-CERT Technical Cyber Security Alert TA04-070A -- Microsoft
       Outlook mailto URL Handling Vulnerability (03-11-04)
       <http://www.auscert.org.au/render.html?it=3936&cid=1>

     * Sun(sm) Alert Notification - Sun Alert ID: 57508 -- Multiple
       Buffer Overflows in "/usr/bin/uucp" May Allow Unauthorized
       uucp(1C) User ID Access (03-11-04)
       <http://www.auscert.org.au/render.html?it=3935&cid=1>

     * Sun(sm) Alert Notification - Sun Alert ID: 57498 -- ASN.1 Parsing
       Issue May Lead to Denial-of-Service Condition in Sun Java System
       Web Server and Sun Java System Application Server (03-11-04)
       <http://www.auscert.org.au/render.html?it=3934&cid=1>

     * RHSA-2004:103-01 -- Updated gdk-pixbuf packages fix crash
       (03-11-04)
       <http://www.auscert.org.au/render.html?it=3933&cid=1>

     * RHSA-2004:093-01 -- Updated sysstat packages fix security
       vulnerabilities (03-11-04)
       <http://www.auscert.org.au/render.html?it=3932&cid=1>

     * RHSA-2004:075-01 -- Updated kdelibs packages resolve cookie
       security issue (03-11-04)
       <http://www.auscert.org.au/render.html?it=3931&cid=1>

     * Debian Security Advisory DSA 460-1 -- New sysstat packages fix
       insecure temporary file creation (03-11-04)
       <http://www.auscert.org.au/render.html?it=3930&cid=1>

     * Debian Security Advisory DSA 459-1 -- New kdelibs, kdelibs-crypto
       packages fix cookie traversal bug (03-11-04)
       <http://www.auscert.org.au/render.html?it=3929&cid=1>

     * Debian Security Advisory DSA 458-1 -- New python2.2 packages fix
       buffer overflow (03-11-04)
       <http://www.auscert.org.au/render.html?it=3928&cid=1>

     * Microsoft Security Bulletin MS04-010 -- Vulnerability in MSN
       Messenger Could Allow Information Disclosure (838512) (03-10-04)
       <http://www.auscert.org.au/render.html?it=3927&cid=1>

     * Microsoft Security Bulletin MS03-022 -- Vulnerability in ISAPI
       Extension for Windows Media Services Could Cause Code Execution
       (822343) (03-10-04)
       <http://www.auscert.org.au/render.html?it=3926&cid=1>

     * Microsoft Security Bulletin MS04-009 -- Vulnerability in Microsoft
       Outlook Could Allow Code Execution (828040) (03-10-04)
       <http://www.auscert.org.au/render.html?it=3925&cid=1>

     * Microsoft Security Bulletin MS04-008 -- Vulnerability in Windows
       Media Services Could Allow a Denial of Service (03-10-04)
       <http://www.auscert.org.au/render.html?it=3924&cid=1>

     * RHSA-2004:096-01 -- Updated wu-ftpd package fixes security issues
       (03-10-04)
       <http://www.auscert.org.au/render.html?it=3923&cid=1>

     * Debian Security Advisory DSA 457-1 -- New wu-ftpd packages fix
       multiple vulnerabilities (03-10-04)
       <http://www.auscert.org.au/render.html?it=3922&cid=1>

     * CIAC BULLETIN O-093 -- Oracle9i Database Buffer Overflow
       Vulnerabilities (03-09-04)
       <http://www.auscert.org.au/render.html?it=3921&cid=1>

     * NGSSoftware Insight Security Research Advisories -- Buffer
       Overflow Vulnerabilities in SLWebMail and SLMail Pro Supervisor
       Report Center (03-09-04)
       <http://www.auscert.org.au/render.html?it=3920&cid=1>

     * CIAC BULLETIN O-090 -- Vulnerability in Novell Client Firewall
       Tray Icon (03-08-04)
       <http://www.auscert.org.au/render.html?it=3919&cid=1>

     * NetBSD Security Note 20040304-1 -- NetBSD not vulnerable to TCP
       reassembly mbuf DoS (03-08-04)
       <http://www.auscert.org.au/render.html?it=3918&cid=1>

     * Debian Security Advisory DSA 456-1 -- New Linux 2.2.19 packages
       fix local root exploit (arm) (03-08-04)
       <http://www.auscert.org.au/render.html?it=3917&cid=1>

     * Debian Security Advisory DSA 455-1 -- New libxml packages fix
       arbitrary code execution (03-05-04)
       <http://www.auscert.org.au/render.html?it=3916&cid=1>

     * HEWLETT-PACKARD SECURITY BULLETIN HPSBTU00030 -- SSRT3674 Tru64
       UNIX IPsec/IKE Potential Remote Unauthorized Access (03-05-04)
       <http://www.auscert.org.au/render.html?it=3915&cid=1>

     * Cisco Security Advisory -- Cisco CSS 11000 Series Content Services
       Switches Malformed UDP Packet Vulnerability (03-05-04)
       <http://www.auscert.org.au/render.html?it=3914&cid=1>

     * NGSSoftware Insight Security Research Advisory NISR03022004 --
       Adobe Acrobat Reader XML Forms Data Format Buffer Overflow
       (03-04-04)
       <http://www.auscert.org.au/render.html?it=3913&cid=1>

     * RHSA-2004:091-02 -- Updated libxml2 packages fix security
       vulnerability (03-04-04)
       <http://www.auscert.org.au/render.html?it=3912&cid=1>

     * Debian Security Advisory DSA 454-1 and DSA 453-1 -- New Linux
       2.2.22 and 2.2.20 packages fix local root exploit (03-03-04)
       <http://www.auscert.org.au/render.html?it=3911&cid=1>

     * FreeBSD-SA-04:04.tcp -- many out-of-sequence TCP packets
       denial-of-service (03-03-04)
       <http://www.auscert.org.au/render.html?it=3910&cid=1>

F-Secure

     * Bagle.C (03-16-04)
       <http://www.f-secure.com/v-descs/bagle_c.shtml>

     * NetSky.N (03-16-04)
       <http://www.f-secure.com/v-descs/netsky_n.shtml>

     * Bagle.N (03-15-04)
       <http://www.f-secure.com/v-descs/bagle_n.shtml>

     * Bagle.P (03-15-04)
       <http://www.f-secure.com/v-descs/bagle_p.shtml>

     * Agobot.FO (03-15-04)
       <http://www.f-secure.com/v-descs/agobot_fo.shtml>

     * Bagle.M (03-11-04)
       <http://www.f-secure.com/v-descs/bagle_m.shtml>

     * Java.Classloader (03-11-04)
       <http://www.f-secure.com/v-descs/classloader.shtml>

     * NetSky.M (03-11-04)
       <http://www.f-secure.com/v-descs/netsky_m.shtml>

     * NetSky.L (03-10-04)
       <http://www.f-secure.com/v-descs/netsky_l.shtml>

     * Cidra.D (03-10-04)
       <http://www.f-secure.com/v-descs/cidra_d.shtml>

     * Bagle.L (03-10-04)
       <http://www.f-secure.com/v-descs/bagle_l.shtml>

     * PSW-Worm (03-10-04)
       <http://www.f-secure.com/v-descs/psw-worm.shtml>

     * NetSky.K (03-08-04)
       <http://www.f-secure.com/v-descs/netsky_k.shtml>

     * NetSky.J (03-08-04)
       <http://www.f-secure.com/v-descs/netsky_j.shtml>

     * Sober.D (03-08-04)
       <http://www.f-secure.com/v-descs/sober_d.shtml>

     * NetSky.I (03-08-04)
       <http://www.f-secure.com/v-descs/netsky_i.shtml>

     * NetSky.H (03-05-04)
       <http://www.f-secure.com/v-descs/netsky_h.shtml>

     * Bagle.G (03-04-04)
       <http://www.f-secure.com/v-descs/bagle_g.shtml>

     * NetSky.G (03-04-04)
       <http://www.f-secure.com/v-descs/netsky_g.shtml>

     * NetSky.D (03-04-04)
       <http://www.f-secure.com/v-descs/netsky_d.shtml>

     * NetSky.E (03-04-04)
       <http://www.f-secure.com/v-descs/netsky_e.shtml>

     * NetSky.F (03-04-04)
       <http://www.f-secure.com/v-descs/netsky_f.shtml>

     * Bagle.H (03-04-04)
       <http://www.f-secure.com/v-descs/bagle_h.shtml>

     * MyDoom.H (03-03-04)
       <http://www.f-secure.com/v-descs/mydoom_h.shtml>

     * MyDoom.G (03-03-04)
       <http://www.f-secure.com/v-descs/mydoom_g.shtml>

     * Bagle.K (03-03-04)
       <http://www.f-secure.com/v-descs/bagle_k.shtml>

     * Bagle.J (03-03-04)
       <http://www.f-secure.com/v-descs/bagle_j.shtml>

ISS

     * AS04-11 (03-15-04)
       <http://xforce.iss.net/xforce/alerts/id/AS04-11>

     * AS04-10 (03-08-04)
       <http://xforce.iss.net/xforce/alerts/id/AS04-10>

Network Associates

     * Spy-Idwi (03-16-04)
       <http://vil.nai.com/vil/content/v_101101.htm>

     * W32/Netsky.n@MM (03-15-04)
       <http://vil.nai.com/vil/content/v_101099.htm>

     * W32/Bagle.p@MM (03-15-04)
       <http://vil.nai.com/vil/content/v_101098.htm>

     * W32/Polybot.l!irc (03-14-04)
       <http://vil.nai.com/vil/content/v_101100.htm>

     * W32/Bagle.n@MM (03-13-04)
       <http://vil.nai.com/vil/content/v_101095.htm>

     * Adware-Findemnow (03-12-04)
       <http://vil.nai.com/vil/content/v_101094.htm>

     * W32/Netsky.m@MM (03-11-04)
       <http://vil.nai.com/vil/content/v_101092.htm>

     * W32/Netsky.l@MM (03-10-04)
       <http://vil.nai.com/vil/content/v_101091.htm>

     * W32/Bagle.l (03-09-04)
       <http://vil.nai.com/vil/content/v_101086.htm>

     * W32/Netsky.k@MM (03-08-04)
       <http://vil.nai.com/vil/content/v_101084.htm>

     * W32/Netsky.j@MM (03-08-04)
       <http://vil.nai.com/vil/content/v_101083.htm>

     * VBS/Lasku (03-07-04)
       <http://vil.nai.com/vil/content/v_101093.htm>

     * W32/Sober.d@MM (03-07-04)
       <http://vil.nai.com/vil/content/v_101081.htm>

     * W32/Netsky.i@MM (03-07-04)
       <http://vil.nai.com/vil/content/v_101080.htm>

     * W32/NetSky.h@MM (03-05-04)
       <http://vil.nai.com/vil/content/v_101077.htm>

     * W32/Netsky.g@MM (03-04-04)
       <http://vil.nai.com/vil/content/v_101076.htm>

     * W32/Mydoom.h@MM (03-03-04)
       <http://vil.nai.com/vil/content/v_101075.htm>

     * W32/Bagle.k@MM (03-03-04)
       <http://vil.nai.com/vil/content/v_101074.htm>

     * W32/Netsky.f@MM (03-03-04)
       <http://vil.nai.com/vil/content/v_101073.htm>

SANS

     * SANS NewsBites #9 (03-03-04)
       <http://www.sans.org/newsletters/newsbites/newsbites.php?vol=6&issu
       e=9>

     * SANS NewsBites #10 (03-10-04)
       <http://www.sans.org/newsletters/newsbites/newsbites.php?vol=6&issu
       e=10>

     * @RISK: The Consensus Security Vulnerability Alert #9 (03-03-04)
       <http://www.sans.org/newsletters/risk/vol3_9.php>

     * @RISK: The Consensus Security Vulnerability Alert #10 (03-10-04)
       <http://www.sans.org/newsletters/risk/vol3_10.php>

Sophos

     * Troj/Prorat-D (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojproratd.html>

     * W32/Francette-H (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/w32francetteh.html>

     * Troj/Delf-CB (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojdelfcb.html>

     * Troj/Flood-EF (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojfloodef.html>

     * Troj/Coldrage-A (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojcoldragea.html>

     * Troj/DownLdr-FA (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojdownldrfa.html>

     * W32/Floppy-B (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/w32floppyb.html>

     * Troj/DownLdr-FC (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojdownldrfc.html>

     * W32/Protoride-F (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/w32protoridef.html>

     * W32/Nachi-G (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/w32nachig.html>

     * W32/Agobot-DZ (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdz.html>

     * Troj/LDPinch-K (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojldpinchk.html>

     * Troj/Psyme-M (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojpsymem.html>

     * W32/Agobot-EC (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotec.html>

     * W32/SdBot-BB (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/w32sdbotbb.html>

     * Troj/Apher-M (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojapherm.html>

     * Troj/Sdbot-GQ (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/trojsdbotgq.html>

     * W32/Agobot-EA (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotea.html>

     * W32/Bagle-N (03-16-04)
       <http://www.sophos.com/virusinfo/analyses/w32baglen.html>

     * Troj/Bdoor-CCK (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/trojbdoorcck.html>

     * W32/Aidid-A (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32aidida.html>

     * Dial/Ras-B (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/dialrasb.html>

     * W32/Nackbot-A (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32nackbota.html>

     * W32/Nackbot-B (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32nackbotb.html>

     * W32/Cone-C (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32conec.html>

     * W32/Marjor-A (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32marjora.html>

     * W32/Randon-AD (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32randonad.html>

     * Dial/RASDial-B (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/dialrasdialb.html>

     * W32/Randon-AE (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32randonae.html>

     * W32/Sdbot-GO (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32sdbotgo.html>

     * W32/Sdbot-GP (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32sdbotgp.html>

     * Troj/Lohav-E (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/trojlohave.html>

     * W32/Agobot-EB (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32agoboteb.html>

     * W32/Bagle-Zip (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32baglezip.html>

     * W32/Bagle-O (03-15-04)
       <http://www.sophos.com/virusinfo/analyses/w32bagleo.html>

     * W32/Bagle-J (03-14-04)
       <http://www.sophos.com/virusinfo/analyses/w32baglej.html>

     * Troj/LDPinch-H (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/trojldpinchh.html>

     * Troj/SdAgent-A (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/trojsdagenta.html>

     * JS/Seeker-G (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/jsseekerg.html>

     * W32/Agobot-DY (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdy.html>

     * W32/KWBot-G (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/w32kwbotg.html>

     * Troj/CBase-A (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/trojcbasea.html>

     * Troj/LdPinch-I (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/trojldpinchi.html>

     * Troj/LDPinch-G (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/trojldpinchg.html>

     * Troj/LdPinchFam (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/trojldpinchfam.html>

     * Troj/PAdmin-C (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/trojpadminc.html>

     * W32/Agobot-DV (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdv.html>

     * W32/Sdbot-GL (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/w32sdbotgl.html>

     * Troj/Inor-G (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/trojinorg.html>

     * W32/Agobot-DU (03-12-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdu.html>

     * W32/Bereb-B (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/w32berebb.html>

     * W32/Sdbot-AJ (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/w32sdbotaj.html>

     * Troj/Ositdoor-A (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/trojositdoora.html>

     * W32/Sdbot-AK (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/w32sdbotak.html>

     * Troj/Ovedil-A (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/trojovedila.html>

     * W32/Cone-A (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/w32conea.html>

     * W32/Sdbot-AL (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/w32sdbotal.html>

     * Troj/Eyeveg-C (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/trojeyevegc.html>

     * Troj/Sdbot-GN (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/trojsdbotgn.html>

     * Troj/Multidr-S (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/trojmultidrs.html>

     * W32/Agobot-DW (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdw.html>

     * Troj/Imiserv-C (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/trojimiservc.html>

     * W32/Agobot-DX (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdx.html>

     * Troj/Agent-R (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/trojagentr.html>

     * W32/SdBot-MY (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/w32sdbotmy.html>

     * W32/Netsky-M (03-11-04)
       <http://www.sophos.com/virusinfo/analyses/w32netskym.html>

     * W32/Netsky-D (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/w32netskyd.html>

     * W32/Netsky-L (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/w32netskyl.html>

     * Troj/Domwis-A (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/trojdomwisa.html>

     * Troj/Sdbot-GM (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/trojsdbotgm.html>

     * W32/Lamecada-D (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/w32lamecadad.html>

     * Troj/Small-AI (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/trojsmallai.html>

     * W32/Cissi-C (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/w32cissic.html>

     * Troj/Tofger-P (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/trojtofgerp.html>

     * Troj/Killproc-C (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/trojkillprocc.html>

     * W32/Bar-1236 (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/w32bar1236.html>

     * Troj/Cidra-D (03-10-04)
       <http://www.sophos.com/virusinfo/analyses/trojcidrad.html>

     * W32/Agobot-DQ (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdq.html>

     * XM97/Kbase-A (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/xm97kbasea.html>

     * W32/Keco-A (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/w32kecoa.html>

     * W32/Nachi-F (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/w32nachif.html>

     * W32/Sdbot-GK (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/w32sdbotgk.html>

     * Troj/Stawin-D (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/trojstawind.html>

     * Troj/StartPa-Y (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/trojstartpay.html>

     * W32/Bagle-K (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/w32baglek.html>

     * W32/Netsky-F (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/w32netskyf.html>

     * W32/MyDoom-H (03-09-04)
       <http://www.sophos.com/virusinfo/analyses/w32mydoomh.html>

     * W32/Netsky-J (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/w32netskyj.html>

     * W32/Netsky-K (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/w32netskyk.html>

     * W32/Randex-AA (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/w32randexaa.html>

     * W32/Agobot-DT (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdt.html>

     * Troj/LDPinch-F (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/trojldpinchf.html>

     * Troj/Clickslt-A (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/trojclickslta.html>

     * W32/Agobot-DR (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdr.html>

     * Troj/Small-DW (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/trojsmalldw.html>

     * Troj/Mitglied-N (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/trojmitgliedn.html>

     * Dial/Freese-B (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/dialfreeseb.html>

     * W32/Roca-A (03-08-04)
       <http://www.sophos.com/virusinfo/analyses/w32rocaa.html>

     * W32/Netsky-I (03-07-04)
       <http://www.sophos.com/virusinfo/analyses/w32netskyi.html>

     * W32/Cissi-B (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/w32cissib.html>

     * W32/Agobot-DS (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotds.html>

     * W32/Dumaru-AE (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/w32dumaruae.html>

     * VBS/Sling-A (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/vbsslinga.html>

     * Troj/HacDef-100 (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/trojhacdef100.html>

     * W32/Doomjuice-C (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/w32doomjuicec.html>

     * Troj/SdBot-GG (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/trojsdbotgg.html>

     * W32/Francette-G (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/w32francetteg.html>

     * Troj/Romanat-A (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/trojromanata.html>

     * Troj/LegMir-J (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/trojlegmirj.html>

     * Troj/WindFind-B (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/trojwindfindb.html>

     * W32/Netsky-H (03-05-04)
       <http://www.sophos.com/virusinfo/analyses/w32netskyh.html>

     * W32/Hiton-A (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/w32hitona.html>

     * W32/Netsky-G (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/w32netskyg.html>

     * Troj/Ranck-K (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/trojranckk.html>

     * Troj/AdClick-Q (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/trojadclickq.html>

     * Troj/Spybot-AW (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/trojspybotaw.html>

     * W32/Spybot-BR (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/w32spybotbr.html>

     * W32/Agobot-DN (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdn.html>

     * W32/Reur-L (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/w32reurl.html>

     * Troj/Reur-L (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/trojreurl.html>

     * W32/Reur-M (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/w32reurm.html>

     * Troj/Reur-M (03-04-04)
       <http://www.sophos.com/virusinfo/analyses/trojreurm.html>

     * W32/Agobot-DG (03-03-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdg.html>

     * W32/Agobot-DH (03-03-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdh.html>

     * W32/Agobot-DI (03-03-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdi.html>

     * W32/Agobot-DJ (03-03-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdj.html>

     * W32/Agobot-DK (03-03-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdk.html>

     * W32/Agobot-DL (03-03-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdl.html>

     * W32/Agobot-DM (03-03-04)
       <http://www.sophos.com/virusinfo/analyses/w32agobotdm.html>

     * W32/MyDoom-G (03-03-04)
       <http://www.sophos.com/virusinfo/analyses/w32mydoomg.html>

Symantec

     * W32.Netsky.N@mm (03-16-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky
       .n@mm.html>

     * W32.HLLW.RedDw@mm (03-15-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.r
       eddw@mm.html>

     * W32.Beagle.N@mm (03-15-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle
       .n@mm.html>

     * W32.Tuoba.Trojan (03-15-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.tuoba.
       trojan.html>

     * W32.Cone.F@mm (03-14-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.cone.f
       @mm.html>

     * Trojan.Mitglieder.E (03-13-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/trojan.mit
       glieder.e.html>

     * Trojan.Mitglieder.D (03-13-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/trojan.mit
       glieder.d.html>

     * W32.Beagle.M@mm (03-13-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle
       .m@mm.html>

     * W32.HLLW.Citor (03-13-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.c
       itor.html>

     * W32.HLLW.Annil@mm (03-12-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.a
       nnil@mm.html>

     * W32.Cone.E@mm (03-12-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.cone.e
       @mm.html>

     * PWSteal.Irftp (03-12-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/pwsteal.ir
       ftp.html>

     * Trojan.Etsur (03-12-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/trojan.ets
       ur.html>

     * Trojan.Noupdate (03-11-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/trojan.nou
       pdate.html>

     * Trojan.Gipma (03-10-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/trojan.gip
       ma.html>

     * W32.Cone.D@mm (03-10-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.cone.d
       @mm.html>

     * W32.Netsky.M@mm (03-10-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky
       .m@mm.html>

     * Trojan.Simcss.B (03-10-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/trojan.sim
       css.b.html>

     * W97M.Trug.B (03-09-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w97m.trug.
       b.html>

     * W32.Netsky.L@mm (03-09-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky
       .l@mm.html>

     * W32.Cone.C@mm (03-09-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.cone.c
       @mm.html>

     * W32.Netsky.K@mm (03-08-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky
       .k@mm.html>

     * W32.Keco@mm (03-08-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.keco@m
       m.html>

     * W32.Netsky.J@mm (03-08-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky
       .j@mm.html>

     * W32.Sober.D@mm (03-07-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.sober.
       d@mm.html>

     * W32.Netsky.I@mm (03-07-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky
       .i@mm.html>

     * Trojan.Reur.B (03-05-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/trojan.reu
       r.b.html>

     * W32.HLLW.Reur.B (03-05-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.r
       eur.b.html>

     * W32.HLLW.Heycheck (03-05-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.h
       eycheck.html>

     * PWSteal.Banpaes.C (03-05-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/pwsteal.ba
       npaes.c.html>

     * W32.Netsky.H@mm (03-05-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky
       .h@mm.html>

     * W32.Netsky.G@mm (03-04-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky
       .g@mm.html>

     * X97M.Kbase (03-03-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/x97m.kbase
       .html>

     * W32.Mydoom.H@mm (03-03-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom
       .h@mm.html>

     * W32.Beagle.K@mm (03-03-04)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle
       .k@mm.html>

     * W32.Netsky.F@mm (03-03-03)
       <http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky
       .f@mm.html>

Trend Micro

     * WORM_NETSKY.N (03-16-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NETSKY.N>

     * PE_BAGLE.P (03-15-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=PE
       _BAGLE.P>

     * WORM_AGOBOT.JP (03-14-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_AGOBOT.JP>

     * WORM_AGOBOT.DU (03-14-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_AGOBOT.DU>

     * PE_BAGLE.N (03-13-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=PE
       _BAGLE.N>

     * WORM_NACHI.E (03-13-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NACHI.E>

     * WORM_CONE.B (03-12-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_CONE.B>

     * WORM_CONE.C (03-12-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_CONE.C>

     * WORM_AGOBOT.VP (03-12-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_AGOBOT.VP>

     * WORM_CONE.D (03-11-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_CONE.D>

     * WORM_NETSKY.M (03-10-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NETSKY.M>

     * WORM_NETSKY.L (03-10-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NETSKY.L>

     * WORM_BAGLE.L (03-10-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_BAGLE.L>

     * WORM_AGOBOT.PY (03-09-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_AGOBOT.PY>

     * MS04-010_MICROSOFT_MSN_MESSENGER (03-09-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=MS
       04-010_MICROSOFT_MSN_MESSENGER>

     * MS04-009_MICROSOFT_OUTLOOK_2002 (03-09-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=MS
       04-009_MICROSOFT_OUTLOOK_2002>

     * MS04-008_WINDOWS_MEDIA_SERVICES (03-09-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=MS
       04-008_WINDOWS_MEDIA_SERVICES>

     * WORM_NETSKY.K (03-08-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NETSKY.K>

     * WORM_SOBER.D (03-08-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_SOBER.D>

     * WORM_NACHI.F (03-08-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NACHI.F>

     * WORM_NETSKY.J (03-08-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NETSKY.J>

     * WORM_AGOBOT.GA (03-08-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_AGOBOT.GA>

     * WORM_NETSKY.I (03-07-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NETSKY.I>

     * WORM_KECO.A (03-07-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_KECO.A>

     * WORM_CISSI.B (03-06-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_CISSI.B>

     * WORM_NETSKY.H (03-05-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NETSKY.H>

     * WORM_NETSKY.G (03-04-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NETSKY.G>

     * WORM_MYDOOM.H (03-03-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_MYDOOM.H>

     * WORM_BAGLE.K (03-03-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_BAGLE.K>

     * WORM_NETSKY.F (03-03-04)
       <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WO
       RM_NETSKY.F>

UNIRAS

     * NGSSoftware Security Bulletin: IBM DB2 Remote Command Execution
       Privilege Upgrade (03-16-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-12504.txt>

     * iDEFENSE Security Bulletin: Microsoft Outlook mailto Parameter
       Passing Vulnerability (03-16-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-12404.txt>

     * Macromedia Security Bulletins:
       1. Security Patch available for
       ColdFusion MX and JRun 4.0 Web Services DoS.
       2. Potential Security
       Risk with Macromedia E-Licensing Client Activation Code (03-16-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-12304.txt>

     * HP Web-enabled Management Software certificate compromise using HP
       HTTP Server (03-15-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-12204.txt>

     * HP Web-enabled Management Software certificate compromise using HP
       HTTP Server (03-15-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-12204.txt>

     * Two Debian Security Advisories:
       1. New xitalk packages fix local group utmp exploit
       2. New samba packages fix privilege escalation in smbmnt
       (03-15-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-12104.txt>

     * Two Red Hat Security Advisories:
       1. Updated gdk-pixbuf packages fix denial of service vulnerability
       2. Updated sysstat packages fix security vulnerabilities
       (03-15-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-12004.txt>

     * Debian Security Advisory DSA 461-1:New calife packages fix buffer
       overflow (03-12-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11904.txt>

     * Two Sun Microsystems Security Advisories:
       1. ASN.1 Parsing Issue May Lead to Denial-of-Service Condition in
       Sun Java System Web Server and Sun Java System Application Server
       2. Multiple Buffer Overflows in /usr/bin/uucp May Allow
       Unauthorized uucp(1C) User ID Access (03-12-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11804.txt>

     * Microsoft Outlook mailto URL Handling Vulnerability (03-11-04)
       <http://www.uniras.gov.uk/l1/l2/l3/alerts2004/alert-1104.txt>

     * Three Red Hat Security Briefings:
       1. Updated kdelibs packages resolve cookie security issue
       2. Updated sysstat packages that fix various bugs and a minor
       security issue are now available
       3. Updated gdk-pixbuf packages fix denial of service vulnerability
       (03-11-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11704.txt>

     * Three Debian Security Advisories:
       1. New python2.2 packages fix buffer overflow
       2. New kdelibs, kdelibs-crypto packages fix cookie traversal bug
       3. New sysstat packages fix insecure temporary file creation
       (03-11-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11604.txt>

     * Four Mandrake Security Advisories:
       1. Buffer overflow in python 2.2's getaddrinfo()
       2. Updated gdk-pixbuf packages fix BMP-handling vulnerability
       3. Updated mozilla packages fix multiple vulnerabilities
       4. Updated kdelibs packages fix cookie theft vulnerability
       (03-11-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11504.txt>

     * Multiple vendor HTTP user agent cookie path traversal issue
       (03-10-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11404.txt>

     * Microsoft Security Bulletins:
       1. Vulnerability in Windows Media Services Could Allow a Denial of
       Service
       2. Vulnerability in Microsoft Outlook Could Allow Code Execution
       (828040)
       3. Vulnerability in ISAPI Extension for Windows Media Services
       Could Cause Code Execution (822343)
       4. Vulnerability in MSN Messenger Could Allow Information
       Disclosure (838512) (03-10-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11304.txt>

     * Red Hat Security Bulletin: Updated wu-ftpd package fixes security
       issues (03-10-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11204.txt>

     * Debian Security Bulletin: New wu-ftpd packages fix multiple
       vulnerabilities (03-10-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11104.txt>

     * CIAC Security Bulletin: Oracle9i Database Buffer Overflow
       Vulnerabilities (03-09-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-11004.txt>

     * NGSSoftware Security Bulletin: Buffer Overflow Vulnerabilities in
       SLWebMail and SLMail Pro Supervisor Report Center (03-09-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10904.txt>

     * Malicious Software Report: NetSky variant and W32/Sober.D
       (03-08-04)
       <http://www.uniras.gov.uk/l1/l2/l3/alerts2004/alert-1004.txt>

     * New libxml packages fix arbitrary code execution (03-05-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10804.txt>

     * Tru64 UNIX IPsec/IKE Potential Remote Unauthorized Access
       (03-05-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10704.txt>

     * Cisco CSS 11000 Series Content Services Switches Malformed UDP
       Packet Vulnerability (03-05-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10604.txt>

     * Malicious Software Report concerning variants of Bagle and Netsky
       (03-04-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10504.txt>

     * NGSSoftware Insight Security Research Advisory NISR03022004
       (03-04-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10404.txt>

     * Updated libxml2 packages fix security vulnerability (03-04-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10304.txt>

     * FreeBSD-SA-04:04.tcp many out-of-sequence TCP packets
       denial-of-service (03-04-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10204.txt>

     * Squid-2.5.STABLE5 fixes and features for URL encoding tricks
       (03-03-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10104.txt>

     * DSA 451-1: New xboing packages fix buffer overflows. DSA 452-1:
       New libapache-mod-python packages fix denial of service (03-03-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-10004.txt>

     * New Linux 2.2.22 and 2.2.20 packages fix local root exploit
       (03-03-04)
       <http://www.uniras.gov.uk/l1/l2/l3/brief2004/brief-9904.txt>
     _________________________________________________________________

   Copyright 2004 Carnegie Mellon University.

   This document is available at

	<http://www.us-cert.gov/cas/bulletins/SB04-077.html>

   and in PDF format at

	<http://www.us-cert.gov/cas/body/bulletins/SB04-077.pdf>

   Terms of use, see <http://www.us-cert.gov/legal.html>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAWPDsXlvNRxAkFWARAm1tAJ9BErJpsDvD1xqlXtJf/EMCTmla+ACdGBcX
nA3mXY1h1bWCo2LmcewQ1rw=
=E9+j
-----END PGP SIGNATURE-----