Department of Accounting & Law
State University of New York at Albany
Acc 661 Auditing of Advanced Accounting Information Systems (J Gangolly)
Spring, 2002
STUDENT PRESENTATIONS FOR March 11/13, 2002
Topics:

Network Address Translation (Presenter: Bradshaw)
http://www.howstuffworks.com/nat.htm

Carnovore (Presenter: Brennan)
http://www.howstuffworks.com/carnivore.htm

Viruses (Presenter: Chuang)
http://www.howstuffworks.com/virus.htm

Ethernet (Presenter: Kraycer)
http://www.howstuffworks.com/ethernet.htm

Workplace surveillance (Presenter: Lai)
http://www.howstuffworks.com/workplace-surveillance.htm

Vulnerability Process (Presenter: Liao)
http://www.ee.oulu.fi/research/ouspg/protos/sota/FIRST1999-process/paper.pdf

Date: Thu, 28 Feb 2002. From: CERT Advisory cert-advisory@cert.org
o
Buffer Overflow Vulnerability in Microsoft Windows UPnP Service (Presenter: Martin)
Vulnerabilities in software included by default on Microsoft Windows XP, and optionally on
Windows ME and Windows 98, may allow an intruder to execute arbitrary code on vulnerable
systems, to launch denial-of-service attacks against vulnerable systems, or to use vulnerable systems to
launch denial-of-service attacks against third-party systems. To date we have not received any
confirmed reports of UPnP exploitation; however, we urge Windows users to follow the advice
provided in CA-2001-37 to protect their systems.
CERT Advisory CA-2001-37:
Buffer Overflow in UPnP Service On Microsoft Windows
http://www.cert.org/advisories/CA-2001-37.html
Vulnerability Note #951555:
Microsoft Windows Universal Plug and Play (UPNP) vulnerable
to buffer overflow via malformed advertisement packets
http://www.kb.cert.org/vuls/id/951555
Vulnerability Note #411059:
Microsoft Windows Universal Plug and Play (UPNP) fails to
limit the data returned in response to a NOTIFY message
http://www.kb.cert.org/vuls/id/411059

Recent Activity Against Secure Shell Daemons (Presenter: Shen)
There are multiple vulnerabilities in several implementations of the Secure Shell (SSH)
protocol. The SSH protocol enables a secure communications channel from a client to a
server. We are still seeing a high amount of scanning for SSH daemons, and we are
receiving reports of exploitation. System administrators should review their configurations
to ensure that they have applied all relevant patches.
CERT Advisory CA-2001-35:
Recent Activity Against Secure Shell Daemons
http://www.cert.org/advisories/CA-2001-35.html
Vulnerability Note #945216:
SSH CRC32 attack detection code contains remote integer overflow
http://www.kb.cert.org/vuls/id/945216
CERT Incident Note IN-2001-12:
Exploitation of vulnerability in SSH1 CRC-32 compensation
attack detector
http://www.cert.org/incident_notes/IN-2001-12.html

W32/BadTrans Worm (Presenter: Wang)
We have seen a steady stream of reports related to W32/Badtrans since November
2001. W32/BadTrans is a malicious Windows program distributed as an email file
attachment. Because of a known vulnerability in Internet Explorer, some email programs,
such as Outlook Express and Outlook, may execute the malicious program as soon as the
email message is viewed. Windows users should apply appropriate patches and update
their antivirus programs as described in IN-2001-14.
CERT Incident Note IN-2001-14: W32/BadTrans Worm
http://www.cert.org/incident_notes/IN-2001-14.html

"Kaiten" Malicious Code (Presenter: Williamston)
The CERT/CC has received reports of a new variant of the "Kaiten" malicious code
being installed through exploitation of null default sa passwords in Microsoft SQL
Server and Microsoft Data Engine. (Microsoft SQL 2000 Server will allow a null sa
password to be used, but this is not default behavior.) Various sources have referred to
this malicious code as "W32/Voyager," "Voyager Alpha Force," and "W32/CBlade.worm."
CERT Incident Note IN-2001-13:
"Kaiten" Malicious Code Installed by Exploiting Null
Default Passwords in MS-SQL
http://www.cert.org/incident_notes/IN-2001-13.html

Vulnerability Note VU#297363. PHP contains vulnerability in "php_mime_split" function
allowing arbitrary code execution (Presenter: Yang)
http://www.kb.cert.org/vuls/id/297363