Hosting Provided By

SecurityFocus Linux Newsletter #124

From: John Boletta <jboletta(at)securityfocus.com>
Date: Mon Mar 24 2003 - 14:49:10 EST

I. FRONT AND CENTER

IDS Logs in Forensics Investigations: An Analysis of a...
The Promise and Peril of Palladium
Why the Dogs of Cyberwar Stay Leashed
SecurityFocus DPP Program II. LINUX VULNERABILITY SUMMARY
XChat Server Strings Buffer Overflow Vulnerability
Multiple Vendor Java Virtual Machine java.util.zip Null Value...
MyAbraCadaWeb Path Disclosure Vulnerability
MyAbraCadaWeb Search Engine Cross-Site Scripting Vulnerability
PXE Server Remote Buffer Overrun Vulnerability
Sun XDR Library xdrmem_getbytes() Integer Overflow Vulnerability
BitchX Remote Cluster() Heap Corruption Vulnerability
OpenSSL Timing Attack RSA Private Key Information Disclosure...
SIPS User Information Disclosure Vulnerability
Samba SMB/CIFS Packet Assembling Buffer Overflow Vulnerability
Multiple BitchX Remote Client-Side Buffer Overflow...
BitchX Remote BX_compress_modes() Buffer Overflow Vulnerability
TCPDump Malformed RADIUS Packet Denial Of Service Vulnerability
BitchX Remote Send_CTCP() Memory Corruption Vulnerability
ircII Status_Make_Printable Memory Corruption Vulnerability
BitchX Remote cannot_join_channel() Buffer Overflow Vulnerability
Samba REG File Writing Race Condition Vulnerability
Linux Kernel Privileged Process Hijacking Vulnerability
Kebi Academy 2001 Input Validation Vulnerability
Gnome-lokkit Iptables No Forward Chain Rule Vulnerability
Cyber-Cats Chitchat PHP Message Board/Guestbook Password File...
ircII Make_Status_One Memory Corruption Vulnerability
ircII Client-Side Private Message Handling Memory Corruption...
ircII Client-Side Cannot_Join_Channel Memory Corruption... III. LINUX FOCUS LIST SUMMARY
Seeing who has su-ed (Thread)
latest ptrace hole patch? (Thread)
How to custom sulog? (Thread)
Port 113 security (Thread)
Local security scanner (Thread) IV. NEW PRODUCTS FOR LINUX PLATFORMS
QualysGuard Intranet Scanner
Arkeia 5
QuickStart Data Rescue
NEW TOOLS FOR LINUX PLATFORMS
pppcost v0.2
NetMap network scanner v0.2.1
3cmstats v1.0
FRONT AND CENTER
IDS Logs in Forensics Investigations: An Analysis of a Compromised Honeypot By Alan Neville

This paper will deconstruct the steps taken to conduct a full analysis of a compromised machine. In particular, we will be examining the tool that was used to exploit a dtspcd buffer overflow vulnerability, which allows remote root access to the system. The objective of this paper is to show the value of IDS logs in conducting forensics investigations.

http://www.securityfocus.com/infocus/1676

2. The Promise and Peril of Palladium
By Tim Mullen

Whether Microsoft's ambitious project is a security solution or a Trojan horse depends much on the company's intentions.

http://www.securityfocus.com/columnists/148

Do you need help?

3. Why the Dogs of Cyberwar Stay Leashed By Mark Rasch

The United States could try out its much-hyped "cyberwarfare" capabilities in Iraq... but it would probably be illegal.

http://www.securityfocus.com/columnists/149

4. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only global early-warning system for cyber attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

II. BUGTRAQ SUMMARY

XChat Server Strings Buffer Overflow Vulnerability BugTraq ID: 7089 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7089 Summary:

XChat is a freely available, open source IRC client. It is available for the the Unix, Linux, and Microsoft Windows platforms.

Do you need more help?

XChat IRC client has been reported vulnerable, under certain circumstances, to a buffer overflow condition.

It has been reported that due to a lack of both, sufficient bounds checking and string termination, two malformed non-terminated server supplied strings may be stored contiguously in a fixed internal memory buffer.

As a result of this, a malicious IRC server may be used to pass excessive data to the client and overwrite memory adjacent to the deficient buffer. If this memory contains crucial saved program state values the attacker may be able to influence the programs' flow and execute arbitrary code.

Any code successfully executed would be in the context of the user running the vulnerable IRC application.

This vulnerability was reported to affect XChat version 2.0.1 other versions may also be affected.

2. Multiple Vendor Java Virtual Machine java.util.zip Null Value Denial Of Service Vulnerability BugTraq ID: 7109
Remote: Yes
Date Published: Mar 15 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7109
Summary:

Several implementations of the Java Virtual Machine have been reported to be prone to a denial of service condition.

This vulnerability occurs in several methods in the java.util.zip class. The following native methods have been reported to be vulnerable to this issue:

java.util.zip.Adler32().update();
java.util.zip.Deflater().setDictionary();
java.util.zip.CRC32().update();
java.util.zip.Deflater().deflate();
java.util.zip.CheckedOutputStream().write();
java.util.zip.CheckedInputStream().read();

Can we help you?

The methods can be called with certain types of parameters however, there does not appear to be proper checks to see whether the parameters are NULL values. When these native methods are called with NULL values, this will cause the JVM to reach an undefined state which will cause it to behave in an unpredictable manner and possibly crash.

This BID will be separated into individual entries where appropriate.

3. MyAbraCadaWeb Path Disclosure Vulnerability BugTraq ID: 7126
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7126
Summary:

MyABraCaDaWeb is a web content management system. It is implemented in PHP and available for Unix and Linux variants and Microsoft Windows operating systems.

MyABraCaDaWeb is reported to disclose path information in error messages when handling some invalid requests. This may occur when an invalid administrative ID is requested or in some other cases. The full path to the web root directory will be included in the error output. This information could be useful in further attacks against a system hosting the software.

4. MyAbraCadaWeb Search Engine Cross-Site Scripting Vulnerability BugTraq ID: 7127
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7127
Summary:

MyABraCaDaWeb is a web content management system. It is implemented in PHP and available for Unix and Linux variants and Microsoft Windows operating systems.

MyABraCaDaWeb provides a facility that allows users to search for keywords. A cross-site scripting vulnerability has been reported in MyABraCaDaWeb's search engine. HTML and script code are not sufficiently sanitized when included in URI parameters of the vulnerable search facility.

Can't find what you're looking for?

This could allow creation of malicious links to the vulnerable script which include hostile HTML and script code. If such a link was visited by a web user, attacker-supplied HTML and script code could be interpreted by the user's browser. This would occur in the security context of the site hosting the software.

5. PXE Server Remote Buffer Overrun Vulnerability BugTraq ID: 7129
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7129
Summary:

Red Hat Linux includes a Preboot eXecution Environment (PXE) server. PXE can be used to boot a Linux based system from a remote disk image.

A vulnerability has been discovered in PXE which is included with Red Hat Linux. Specifically, it is possible for a remote attacker to overrun a buffer by passing 10000 bytes of data to the service. This may result in the corruption of sensitive process memory, such as a saved instruction pointer, and as such may allow an attacker to execute arbitrary commands.

Successful exploitation of this issue could allow an attacker to execute commands with root privileges.

This issue has been reported to exist in PXE 2.0 Beta-1 on Red Hat Linux. Other versions may also be affected by this vulnerability.

6. Sun XDR Library xdrmem_getbytes() Integer Overflow Vulnerability BugTraq ID: 7123
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7123
Summary:

The Sun XDR (External Data Representation) library is used to for various functions including interprocess communication (IPC) and is typically implemented by RPC services. XDR library code is implemented by a variety of system libraries including GNU libc, BSD libc, and Sun Microsystem's libnsl.

Don't know where to look next?

A vulnerability has been discovered in the xdrmem_getbytes() function defined by the XDR library. Due to an integer overflow in the function, multiple applications linking to the library may be prone to a variety of vulnerabilities.

By passing a malicious integer to the function, it may be possible for an attacker to trigger an unexpected allocation of process memory. This may cause implemented bounds checking to be insufficient. Furthermore, previously used memory may be allocated which could contain sensitive information.

Successful exploitation of this issue on a vulnerable application may allow an attacker to execute arbitrary commands with root privileges.

7. BitchX Remote Cluster() Heap Corruption Vulnerability BugTraq ID: 7096
Remote: Yes
Date Published: Mar 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7096
Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

BitchX has been reported prone to a heap based memory corruption vulnerability. Reportedly when an excessively long hostname is supplied to the BitchX 'cluster()' function an internal static memory buffer is overflowed.

It has been reported that 1500 bytes of data may be written past the buffer, potentially corrupting sensitive values located in the heap.

Although unconfirmed, due to the nature of heap corruption vulnerabilities, there is a potential that this issue could be exploited to corrupt memory management information. As a result, a hostile IRC server may be capable of executing arbitrary code on a target client.

Confused? Frustrated?

This vulnerability was reported to affect BitchX 1.0c19 earlier versions may also be affected.

This issue was originally described in BID 7086 "Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

8. OpenSSL Timing Attack RSA Private Key Information Disclosure Vulnerability BugTraq ID: 7101
Remote: Yes
Date Published: Mar 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7101
Summary:

OpenSSL is an open source implementation of the SSL protocol.

A side-channel attack in the OpenSSL implementation has been published in a recent paper that may ultimately result in an active adversary gaining the RSA private key of a target server. The attack involves analysis of the timing of certain operations during client-server session key negotiation.

Session negotiation occurs using the RSA PKCS 1 type public key cryptography standard. During the client-server negotiation, the client constructs a proto-session-key using PKCS 1 formatted random bytes and encrypts it with the RSA public key of the server. The client then transmits this value to the server, which uses it to compute the shared session key. The server will generate a session key on its own and send an alert message to the client if the client-supplied proto-key decrypted by the server using its RSA private key is not properly PKCS 1 formatted.

It is possible for an adversary, acting as a client, to obtain bits of information about the server RSA private key by observing the time elapsed between the transmission of an invalid proto-key value and reception of the alert message from the server that is sent in response. The information is leaked during the decryption process and may, through successive observations, reveal the factorization of the private key to the adversary. An attacker may perform this attack by repeatedly establishing sessions with invalid proto-key values.

Upon successful compromise of a RSA private key, it is possible for an attacker to monitor the establishing of all future sessions with the server. This may additionally allow an attacker to impersonate the server based on the compromised private key. This problem also affects other SSL implementations that do not implement RSA blinding by default.

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365

9. Qpopper Username Information Disclosure Weakness BugTraq ID: 7110
Remote: Yes
Date Published: Mar 15 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7110
Summary:

Qpopper is a POP3 mail server available for Linux and Unix based systems.

An information disclosure weakness has been reported for Qpopper when authenticating. The weakness is due to the fact that if a valid username is sent with a bad password, Qpopper will wait a small amount of time prior to disconnecting the client. If the username that is sent is invalid, Qpopper immediately disconnects the client.

A determined attacker can exploit this weakness to gather a list of valid usernames on a vulnerable system using Qpopper.

Any information obtained in this manner may be used by the attacker to launch other attacks against a victim user or system.

This weakness was reported for Qpopper 3.1 and 4.0.4. It is not known whether other versions are affected.

SIPS User Information Disclosure Vulnerability BugTraq ID: 7134 Remote: Yes Date Published: Mar 18 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7134 Summary:

SIPS is a weblog and link indexing system. It is available for Unix and Linux variants in addition to Microsoft Windows operating systems.

It has been reported that SIPS fails to authenticate users before granting users to user account information. As a result, it may be possible for an attacker to access sensitive data by making a request to a specific location, including the first letter of a username, followed by the full username.

Do you need help?

By gaining access to sensitive user account data it may be possible for an attacker to launch further attacks.

It should be noted that this vulnerability was reported in SIPS v0.2.2 however, other versions may also be affected.

Samba SMB/CIFS Packet Assembling Buffer Overflow Vulnerability BugTraq ID: 7106 Remote: Yes Date Published: Mar 15 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7106 Summary:

Samba is a freely available file and printer sharing application maintained and developed by the Samba Development Team. Samba allows file and printer sharing between operating systems on the Unix and Microsoft platforms. The Samba daemon is typically run with super user privileges.

A buffer overflow vulnerability has been reported for Samba. The vulnerability occurs when the smbd service attempts to re-assemble specially crafted SMB/CIFS packets.

An attacker can exploit this vulnerability by creating a specially formatted SMB/CIFS packet and sending it to a vulnerable Samba server. The overflow condition will be triggered when smbd attempts to re-assemble the malformed packet fragments. smbd will overwrite sensitive areas of memory with attacker-supplied values resulting in the execution of malicious code.

This vulnerability is further exacerbated by the fact that the smbd service runs with root privileges.

This vulnerability affects Samba 2.0.0 to 2.2.7a. Additionally, HP CIFS/9000 server versions up to A.01.09.01 on HP-UX 11.0, 11.11(11i), and 11.22 are vulnerable.

Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities BugTraq ID: 7086 Remote: Yes Date Published: Mar 13 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7086 Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

Do you need more help?

Multiple vulnerabilities have been reported to exist in the BitchX IRC client. The problems occur due to a variety of client-side functions failing to carry out sufficient bounds checking. Specifically, a malicious IRC server may be capable of passing malicious data to an affected BitchX client, which could trigger a number of buffer overrun conditions.

Successful exploitation of these issues may allow a malicious server to execute arbitrary commands on the client system with the privileges of the user running the vulnerable client.

This vulnerability has been reported to affect BitchX 1.0c19. Other versions may also be affected.

The issues in this BID have been assigned individual BugtraqIDs. The new BIDs are 7096, 7097, 7099 and 7100.

This BID will be subsequently retired.

BitchX Remote BX_compress_modes() Buffer Overflow Vulnerability BugTraq ID: 7100 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7100 Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

BitchX has been reported prone to a buffer overflow vulnerability.

Reportedly, when the BitchX option 'compress_modes' is activated a potential circumstance for a buffer overflow condition may be created. If an excessive amount of data is supplied to the BitchX 'BX_Compress_modes()' function an internal memory buffer, 'nmodes[16]', will be overflowed. This action may cause adjacent memory to be corrupted with attacker-supplied values.

There is a potential that this issue could be exploited to corrupt crucial program management variables on the stack and thus seize control of program flow. As a result, a hostile IRC server may be capable of executing arbitrary code on a target client.

Can we help you?

Any arbitrary code executed would be in the context of the user running the vulnerable software.

This vulnerability was reported to affect BitchX 1.0c19 earlier versions may also be affected.

This issue was originally described in BID 7086 "Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

TCPDump Malformed RADIUS Packet Denial Of Service Vulnerability BugTraq ID: 7090 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7090 Summary:

tcpdump is a freely available, open source network monitoring tool. It is available for the Unix, Linux, and Microsoft Windows operating systems.

A vulnerability in the processing of some packet types may result in an inability to further use the tcpdump application.

It has been reported that tcpdump is vulnerable to a denial of service when some packet types are received. By sending a maliciously formatted packet to a system using a vulnerable version of tcpdump, it is possible for a remote user to cause tcpdump to ignore network traffic from the time the packet is received until the application is terminated and restarted.

The problem is in the handling of RADIUS packets. When tcpdump receives a maliciously crafted RADIUS packet, the application enters an infinite loop and ceases to further monitor network traffic. This could allow the passing of undetected network traffic that would typically be seen by tcpdump.

BitchX Remote Send_CTCP() Memory Corruption Vulnerability BugTraq ID: 7097 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7097 Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

Can't find what you're looking for?

A memory corruption vulnerability has been reported in the send_ctcp() function which is used when handling server-supplied data. The function takes the length of an argument, char *to, and uses it to allocate a buffer on the stack. This occurs by calling the alloca() function with an argument of 512 - (12 + strlen(to)). Delimiter characters are later appended to the buffer returned by alloca().

If a hostile IRC server were to supply a 'to' argument containing a length, -12, which is larger then 512 bytes, it would be possible to supply a negative value as the argument to alloca(). If this were to occur the negative value would be interpreted and a stack address used by a previous frame will be returned. This may allow for delimiter characters and a NULL value to be written to arbitrary stack memory.

Successful exploitation of this issue may allow a malicious server to execute arbitrary commands on the client system with the privileges of the user running the vulnerable client.

This vulnerability has been reported to affect BitchX 1.0c19. Other versions may also be affected.

This issue was originally described in BID 7086 "Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

ircII Status_Make_Printable Memory Corruption Vulnerability BugTraq ID: 7098 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7098 Summary:

ircII is an IRC and ICB client for Unix and Linux platforms.

A buffer overflow vulnerability has been reported in ircII. The vulnerability is related to the way ircII refreshes its status bar. Specifically, the status_make_printable() function in the status.c source file does not properly account for some control characters when attempting to refresh the status bar.

This issue is exploitable by a malicious IRC server that sends an overly long response to the vulnerable ircII client. As the client does not make proper checks for control characters when updating the status bar, it will result in the corruption of sensitive memory with attacker-supplied values.

Don't know where to look next?

This will cause the client to behave in an unpredictable manner and possibly execute attacker-supplied code.

This issue was reported in ircII build 20020912. Other versions may also be affected.

This issue was originally described in BID 7087 "Multiple IrcII Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

BitchX Remote cannot_join_channel() Buffer Overflow Vulnerability BugTraq ID: 7099 Remote: Yes Date Published: Mar 14 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7099 Summary:

BitchX is a freely available, open source IRC client. It is available for Unix, Linux, and Microsoft operating systems.

A memory corruption vulnerability has been discovered in BitchX 1.0c19. This issue occurs when calling the cannot_join_channel() function. If a channel of excessive length is supplied a buffer overflow could occur which may result in predefined strings being written over sensitive stack memory.

As a result, it may be possible for a malicious IRC server to crash a vulnerable client. Although unconfirmed this vulnerability could potentially be leveraged to execute arbitrary commands within a target client.

This vulnerability has been reported to affect BitchX 1.0c19. Other versions may also be affected.

This issue was originally described in BID 7086 "Multiple BitchX Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

Samba REG File Writing Race Condition Vulnerability BugTraq ID: 7107 Remote: No Date Published: Mar 15 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7107 Summary:

Confused? Frustrated?

A race condition vulnerability has been reported for Samba. The vulnerability occurs when Samba attempts to write reg files. However, it may be possible to create a symbolic link in a crucial point of program execution that would result in the overwriting of files pointed to by the link. This will only occur if the files are writeable by the Samba process.

Successful exploitation may cause local files to be corrupted. If files can be corrupted with custom data, this may result in privilege elevation.

Full details of this vulnerability are not currently known. The BID will be updated as further details are disclosed.

This vulnerability is reported to exist for Samba 2.0.0 to 2.2.7a.

Linux Kernel Privileged Process Hijacking Vulnerability BugTraq ID: 7112 Remote: No Date Published: Mar 17 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/7112 Summary:

The Linux Kernel is the core of the Linux operating system and is distributed by various Linux distributions.

A vulnerability has been discovered related to the automatic loading of kernel modules via kmod. This feature allows for modules to be loaded at run-time when required by certain system calls. When such a module is required, the kernel will create a privileged process and exec the modprobe executable. It should be noted that, although the process loading the module is owned by the root user its parent process is the process calling the function requiring the module.

The vulnerability presents itself because the kernel fails to restrict tracing permissions on the privileged process. As a result, by anticipating the PID of the process probing the module and making a ptrace() call at the correct time interval, an attacker may be able to attach to the privileged process. This may give an attacker the ability to inject arbitrary instructions into memory and thus execute arbitrary commands.

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365

Successful exploitation of this vulnerability could allow a local attacker, on a Linux system running a 2.2 or 2.4 kernel tree, to gain root privileges.

20. Kebi Academy 2001 Input Validation Vulnerability BugTraq ID: 7125
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7125
Summary:

Kebi Academy 2001 is web-based mail/community software. It is available for Unix and Linux variants.

Kebi Academy 2001 does not sufficiently validate input supplied via URI parameters. As a result, it has been reported that it is possible to retrieve arbitrary files which are readable by the web server. This is due to insufficient sanitization of directory traversal sequences from requests.

It has also been reported that it is possible to upload malicious files to the server. This could result in disclosure of sensitive information which may be useful in mounting further attacks against the system. Execution of arbitrary commands in the context of the web server is also possible if a malicious file can be uploaded and then requested by the remote attacker.

21. Gnome-lokkit Iptables No Forward Chain Rule Vulnerability BugTraq ID: 7128
Remote: Yes
Date Published: Mar 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7128
Summary:

Gnome-lokkit is a utility that provides firewalling for the average Linux end user based on responses to a small number of simple questions.

Gnome-lokkit for Red Hat 8.0 was modified to configure iptables instead of ipchains based firewalls. Gnome-lokkit has been reported prone to a condition where FORWARD chains in iptables rulesets are not configured by default. This situation may result in a variety of security vulnerabilities depending on system configuration.

Do you need help?

It should be noted that a vulnerability might only present itself if an administrator were to enable packet forwarding, without adding rules to the FORWARD chain.

The vulnerability was reported to affect Gnome-lokkit for Red Hat Linux 8.0. Previous versions of Gnome-lokkit are not reported to be affected.

22. Cyber-Cats Chitchat PHP Message Board/Guestbook Password File Viewing Vulnerability BugTraq ID: 7136
Remote: Yes
Date Published: Mar 19 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7136
Summary:

Cyber-Cats Chitchat PHP Message Board/Guestbook permits users to interact and communicate via a virtual community. It is available for Unix, Linux, and Microsoft Operating Systems.

A problem with the software may allow a remote user unauthorized access to the board.

Cyber-Cats Chitchat PHP Message Board/Guestbook does not sufficiently limit access to files on the local system. Because of this, an attacker could potentially gain access to sensitive files.

The problem is in the limiting of access to the password file. User names and passwords for the board are stored in the $guest_board_directory/files/passwd.txt file. An attacker could gain access to this file and launch a brute force attack against the encrypted password hashes contained in the file, gaining unauthorized access to user accounts.

23. ircII Make_Status_One Memory Corruption Vulnerability BugTraq ID: 7093
Remote: Yes
Date Published: Mar 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7093
Summary:

Do you need more help?

ircII is an IRC and ICB client for Unix and Linux platforms.

A buffer overflow vulnerability has been reported in ircII. The vulnerability is related to the way ircII refreshes its status bar. Specifically, the make_status_one() function in the status.c source file does not properly account for some control characters when attempting to refresh the status bar.

This will cause the client to crash thus resulting in a denial of service condition.

This issue was reported in ircII build 20020912. Other versions may also be affected.

This issue was originally described in BID 7087 "Multiple IrcII Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

24. ircII Client-Side Private Message Handling Memory Corruption Vulnerability BugTraq ID: 7094
Remote: Yes
Date Published: Mar 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7094
Summary:

ircII is an IRC and ICB client for Unix and Linux platforms.

Can we help you?

A buffer overflow vulnerability has been reported for ircII. This issue is due to insufficient bounds checking of server-supplied data and may potentially result in denial of service in the IRC client. This overflow occurs during client handling of private message data supplied by an IRC server, allowing for the 'ctcp_buffer' to be overrun. Though unconfirmed, exploitation may also allow for execution of arbitrary code in the context of the client.

This could result in corruption of sensitive regions of memory with attacker-supplied data. It may be possible for another client to trigger this condition, though this is also unconfirmed.

This issue was originally described in BID 7087 "Multiple IrcII Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

This issue was reported in ircII build 20020912. Other versions may also be affected.

25. ircII Client-Side Cannot_Join_Channel Memory Corruption Vulnerability BugTraq ID: 7095
Remote: Yes
Date Published: Mar 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7095
Summary:

ircII is an IRC and ICB client for Unix and Linux platforms.

A buffer overflow vulnerability has been reported in ircII. This issue is due to insufficient bounds checking of server-supplied data and may potentially result in denial of service in the IRC client. This issue exists in the cannot_join_channel() function and could be triggered by a channel length of excessive length.

This could result in corruption of memory (including stack variables) with attacker-supplied data.

Can't find what you're looking for?

This issue was originally described in BID 7087 "Multiple IrcII Remote Client-Side Buffer Overflow Vulnerabilities" and is now being assigned a separate BID.

III. LINUX FOCUS LIST SUMMARY

Seeing who has su-ed (Thread) Relevant URL:

http://online.securityfocus.com/archive/91/315842

2. latest ptrace hole patch? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/315841

3. How to custom sulog? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/315732

4. Port 113 security (Thread)
Relevant URL:

Don't know where to look next?

http://online.securityfocus.com/archive/91/315489

5. Local security scanner (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/315306

IV. NEW PRODUCTS FOR LINUX PLATFORMS

QualysGuard Intranet Scanner by Qualys Platforms: N/A Relevant URL: http://www.qualys.com/?page=services/intranet/overview Summary:

With QualysGuard Intranet Scanner, Qualys also protects enterprises when the threat comes from within the internal network. QualysGuard Intranet Scanner is the first network appliance that provides security audits and vulnerability management inside the firewall. Combined with QualysGuard, the Intranet Scanner provides network administrators with an integrated, centralized service for managing both internal and external network vulnerabilities.

2. Arkeia 5
by Arkeia
Platforms: AIX, DG-UX, Digital UNIX/Alpha, HP-UX, IRIX, Linux, MacOS, SCO, Solaris, SunOS, True64 UNIX, Unixware, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL:
http://arkeia.com/a5technical.html
Summary:

Safeguarding a company's priceless data can create a multitude of questions for system administrators. Arkeia provides proven answers: speedy, automated backup and recovery that is a reliable industry standard for heterogeneous network backup. Arkeia is quick on its feet, easy to use and smoothly compatible with almost all combinations of computers, operating systems and storage devices. It's simple to install, configured in minutes and readily adaptable to anything from a small business network to a complex enterprise. Arkeia automatically detects SCSI hardware and recognizes tape drive types. Administrators can easily choose full or incremental backups that preserve directory structure, registry, symbolic links and special attributes. Arkeia makes it easy to program "exceptions" to your backup schedule with a convenient calendar interface.

3. QuickStart Data Rescue
by TOLIS Group
Platforms: FreeBSD, Linux, Netware, OpenBSD, OS/2, SCO, Solaris, Unixware, Windows 2000, Windows 95/98, Windows NT, Windows XP Relevant URL:
http://www.tolisgroup.com/qsdr3.html
Summary:

Confused? Frustrated?

QuickStart Data RescueTM is a PC crash and disaster recovery utility that recovers damaged systems while virtually eliminating the human error associated with the process. And, you can even recover to a larger hard disk! QuickStart Data RescueTM is a self-contained product. Other disaster recovery products rely on interaction with some other utility or application, or require a base OS reinstall, in order to do their job. QuickStart can write an image backup of the disk to the target device, and verify the backup for accuracy as well as manage the disaster recovery process. Used independently, or in conjunction with your normal backup procedure, QuickStart gets you up and running simply and effectively.

V. NEW TOOLS FOR LINUX PLATFORMS

pppcost v0.2 by Tóth András Relevant URL: http://pppcost.sourceforge.net/ Platforms: Linux, POSIX Summary:

pppcost is a graphical displaying tool for pppcounter.

2. NetMap network scanner v0.2.1
by Joshua Corbin
Relevant URL:
http://members.jdweb.com/~jcorbin/netmap/ Platforms: Perl (any system supporting perl) Summary:

NetMap is a network scanner written in Perl/GTK. It is not just another nmap frontend. It is a modularized network prober/scanner that just happens to have an nmap module. Incidentally, NetMap has nothing to do with the network weather mapper.

3. 3cmstats v1.0
by João Seabra - CI-AAC
Relevant URL:
http://online.securityfocus.com/tools/3113 Platforms: Linux, POSIX
Summary:

3cmstats retrieves information from your 3com HomeConnect (tailfin) cable modem (that sometimes is password protected in the Web page modem config) such as Downstream, Upstream, and Registration information and outputs to stdout in Valid XHTML 1.1. Amongst the data are Rx power level, Tx Power Level, and Frequency. It doesn't use SNMP, so it will probably work on 3Com cable modems that have SNMP disabled. Received on Mon Mar 24 15:54:00 2003

This message: [ Message body ]
Next message: John Boletta: "SecurityFocus Linux Newsletter #125"
Previous message: John Boletta: "SecurityFocus Linux Newsletter #123"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:27 EDT

Call Pantek today for Open Source Technical Support at 1-877-546-8934 - 24/7/365