|
|
| Applications |
| Mailing Lists |
| Miscellaneous |
| Operating Systems |
| Programming |
SecurityFocus Linux Newsletter #142
Date: Mon Jul 28 2003 - 16:49:07 EDT
('binary' encoding is not supported, stored as-is)
SecurityFocus Linux Newsletter #142
This Issue is Sponsored by: SPI Dynamics
ALERT:
"How a Hacker Launches a LDAP Injection Attack Step-by-Step" - White Paper
It's as simple as placing additional LDAP query commands into a Web form
input box giving hackers complete access to all your backend systems!
Firewalls and IDS will not stop such attacks because LDAP Injections are
seen as valid data.
Download this *FREE* white paper from SPI Dynamics for a complete guide to
protection!
http://www.securityfocus.com/SPIDynamics-linux-secnews7
I. FRONT AND CENTER
- "Copying is Theft ..."
- Demonstrating ROI for Penetration Testing (Part One)
- Detecting SQL Injection in Oracle II. LINUX VULNERABILITY SUMMARY
- SimpNews PATH_SIMPNEWS Remote File Include Vulnerability
- Drupal Cross-Site Scripting Vulnerability
- Top Home Environment Variable Local Buffer Overflow Vulnerability
- MoreGroupWare WEBMAIL2_INC_DIR Remote File Include Vulnerability
- WebCalendar Local File Include Information Disclosure...
- GnuPG Group Root File Corruption Vulnerability
- GNU GNATS Queue-PR Database Command Line Option Buffer Overflow...
- Multiple Linux 2.4 Kernel Vulnerabilities
- FDClone Local Insecure Temporary Directory Creation Vulnerability III. LINUX FOCUS LIST SUMMARY
- NO NEW POSTS FOR THE WEEK ENDING 07.25.03 IV. NEW PRODUCTS FOR LINUX PLATFORMS
- ipANGEL
- NetMAX VPN Server Suite
- PENS
- NEW TOOLS FOR LINUX PLATFORMS
- Rate v0.81
- CalcChecksum v1.4
- OpenVPN v1.4.2 VI. SPONSOR INFORMATION
- FRONT AND CENTER
- "Copying is Theft ..." By Mark Rasch
And other legal myths in the looming battle over peer-to-peer.
http://www.securityfocus.com/columnists/175
2. Demonstrating ROI for Penetration Testing (Part One) By Marcia Wilson
This is the first in a series of articles demonstrating ROI (return on investment) for a penetration test. You will have to step into the world of budgeting, cost justification, resource allocation, and learn a few unfamiliar terms.
http://www.securityfocus.com/infocus/1715
3. Detecting SQL Injection in Oracle
By Pete Finnigan
This paper takes the subject of SQL injection further and investigates the possibilities for the Oracle Database Administrator to detect SQL injection in the wild.
http://www.securityfocus.com/infocus/1714
II. BUGTRAQ SUMMARY
- SimpNews PATH_SIMPNEWS Remote File Include Vulnerability BugTraq ID: 8227 Remote: Yes Date Published: Jul 18 2003 12:00AM Relevant URL: http://www.securityfocus.com/bid/8227 Summary:
SimpNews is a web news system implemented in PHP. It is available for Unix/Linux variants and Microsoft Windows operating systems.
SimpNews is prone to a vulnerability that may permit remote attackers to include and execute malicious PHP scripts. Remote users, under some PHP configurations, may influence the $path_simpnews URI variable. This variable is used in the include path for the 'config.php', 'functions.php' and 'includes/has_entries.inc' scripts. By influencing the include path so that it points to a malicious PHP script on a remote system, it is possible to cause arbitrary PHP code to be executed. This would occur in the context of the web server. This issue exists in both the 'eventcal2.php' and 'eventscroller.php' scripts.
This could be exploited to execute malicious PHP commands in the context of the web server process.
It should be noted that although SimpNews versions 2.01 through 2.13 have been reported vulnerable, other versions might also be affected.
2. Drupal Cross-Site Scripting Vulnerability
BugTraq ID: 8235
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8235
Summary:
Drupal is an open-source content management system. Drupal is available for a number of platforms including Microsoft Windows operating systems and Unix/Linux variants.
The Drupal content management system is prone to a cross-site scripting vulnerability. This issue is exposed through the main page and through other sub-pages. An attacker may exploit this issue by including hostile HTML and script code in a malicious link to Drupal. This code may be rendered in the web browser of a user who visits the link. This would occur in the security context of the site hosting Drupal.
The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user.
3. Top Home Environment Variable Local Buffer Overflow Vulnerability
BugTraq ID: 8239
Remote: No
Date Published: Jul 22 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8239
Summary:
top is a freely available, open source process monitoring utility. It is available for various Unix and Linux platforms.
A buffer overflow condition has been reported in top when handling environment variables of excessive length. This may result in an attacker potentially executing arbitrary code.
The problem is in the checking of bounds on the HOME environment variable. top does not properly handle input of excessive length in the HOME environment variable. By placing a string of excessive length (1100 bytes) in this environment variable, an attacker may be able to corrupt sensitive process memory, and potentially execute arbitrary code with the privileges of the top program.
It should be noted that top is typically installed with the setuid root bit set.
Additionally, although top versions less than or equal to version 2.0.11 have been reported vulnerable, it should be noted that other versions might also be vulnerable.
4. MoreGroupWare WEBMAIL2_INC_DIR Remote File Include Vulnerability
BugTraq ID: 8249
Remote: Yes
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8249
Summary:
moregroupware is a tool to facilitate office communications. It includes, among other features, webmail, calendaring and project management functionality. It is implemented in PHP and is available for a variety of platforms including Microsoft Windows and Linux and Unix variant operating environments.
moregroupware is prone to a vulnerability that may permit remote attackers to include and execute malicious PHP scripts. Remote users, under some PHP configurations, may influence the $webmail2_inc_dir URI variable or in some cases the $appconf URI variable. This variable is used in the include path for the 'mimepart.php', 'pear.php' and 'mime_types.php' scripts. By influencing the include path so that it points to a malicious PHP script on a remote system, it is possible to cause arbitrary PHP code to be executed. This would occur in the context of the web server. This issue exists in 'class.html.mime.mail.inc', 'rfc822.php' and 'webmail2_func.inc' scripts.
This could be exploited to execute malicious PHP commands in the context of the web server process.
It should be noted that although moregroupware version 0.6.8 has been reported vulnerable, other versions might also be affected.
5. WebCalendar Local File Include Information Disclosure Vulnerability
BugTraq ID: 8237
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8237
Summary:
WebCalendar is a freely available, open source web calendar software package. It is available for the Unix and Linux operating systems.
It has been reported that an information disclosure issue exists in WebCalendar. This may allow an attacker to gain unauthorized read access to potentially sensitive information with the privileges of the web server process.
The problem is in the handling of directory traversal strings when passed to a specific variable. When a request for any PHP script is made and directory traversal strings are passed to the user_inc variable, it is possible to view a file at the end of the directory traversal string.
6. GnuPG Group Root File Corruption Vulnerability
BugTraq ID: 8228
Remote: No
Date Published: Jul 19 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8228
Summary:
gnupg is an encryption utility that is available for a number of platforms, including Unix/Linux variants.
gnupg is reported to be prone to an issue that could permit a malicious local user to corrupt files owned by the root group. This issue is reportedly the result of gnupg having setgid root privileges. The issue was reported for Gentoo Linux, though other distributions may have a similar default installation and be prone to this issue.
This vulnerability may potentially be exploited to corrupt critical or sensitive files for a denial of service. The possibility of privilege escalation also exists.
7. GNU GNATS Queue-PR Database Command Line Option Buffer Overflow
Vulnerability
BugTraq ID: 8232
Remote: No
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8232
Summary:
GNU GNATS is a freely available bug tracking system. It is available for a variety of Linux and Unix variant operating environments.
The queue-pr utility is shipped as part of GNATS and is intended as a tool, used to manage the GNATS queue. The queue-pr utility is a setuid utility typically with UID 'gnats' privileges.
A stack overflow vulnerability has been reported for the queue-pr utility. The vulnerability occurs due to insufficient bounds checks performed on the database name passed to the '-d' commandline option.
An attacker may invoke the queue-pr utility passing a malicious database name (>=1148 bytes of data), in a manner sufficient to trigger the vulnerability.
Successful exploitation may result in the execution of attacker-supplied code with potentially elevated privileges.
It should be noted that on some systems, the queue-pr utility might be installed with setuid 'root' privileges.
It should be noted that although this vulnerability has been reported to affect GNATS version 3.113.1_6, other versions might be affected.
8. Multiple Linux 2.4 Kernel Vulnerabilities
BugTraq ID: 8233
Remote: Yes
Date Published: Jul 21 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8233
Summary:
Red Hat has released an advisory reporting the existence of multiple vulnerabilities in the Linux 2.4 kernel. The following issues were reported:
/proc/tty/driver/serial may expose sensitive information to local attackers by revealing the exact character count for serial links. This information could permit a malicious local user to infer password lengths and the timing between keystrokes when entering passwords. This might aid in brute-force attacks that attempt to compromise another user's password.
A race condition in the implementation of the execve() system was reported. This issue is described in BID 8042.
The kernel RPC code was reported to have recently changed, causing the reuse flag on newly created sockets to be set. This introduced a vulnerability that could permit unprivileged users to bind to UDP ports used for related services, such as nfsd.
A vulnerability in the implementation of the execve() system could permit malicious local users to gain read access to restricted file descriptors. This occurs because the file descriptor of the executable process is stored in the file table of the calling process. This could be exploited to gain access to sensitive information. This is related to the race condition in execve() and is also discussed in BID 8042.
A flaw in the /proc filesystem could be exploited to gain access to sensitive information. If /proc/self entries are opened before executed a setuid program, the program may fail to change the ownership and permissions of entries that are already open.
The STP protocol on Red Hat was disabled due to lack of security. This could be an issue on other distributions. An additional issue with STP was reported in the kernel that may permit denial of service attacks, due to insufficient length checking.
It was reported that the kernel Forwarding table may be spoofed if forged packets are received that have the same source IP address as the host.
These issues will be divided into separate BIDs when further analysis is complete.
9. FDClone Local Insecure Temporary Directory Creation Vulnerability
BugTraq ID: 8247
Remote: No
Date Published: Jul 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/8247
Summary:
fdclone is a freely available, open source file management tool. It is available for the Linux platform.
A problem has been reported in the creation of temporary directories by fdclone. Because of this, an attacker may be able to gain access to potentially sensitive information.
The problem is in the creation of directories by the fdclone program in the /tmp directory. fdclone does not properly check for the existence of temporary directories prior to execution, and does not validate permissions on already existing directories. Because of this, an attacker may be able to gain access to the contents of temporary files created by fdclone. It may also be possible to launch symbolic link attacks with this vulnerability.
Iii. LINUX FOCUS LIST SUMMARY
- NO NEW POSTS FOR THE WEEK ENDING 07.25.03
- ipANGEL by Lucid Security Platforms: Os Independent Relevant URL: http://www.lucidsecurity.com/products.php Summary:
Lucid Security's ipANGEL, coupled with Check Point FireWall-1, provides complete protection against all network and application attacks. ipANGEL marks a departure from the traditional thinking of what an intrusion prevention product should do. It detects and shields vulnerable applications without duplicating the capabilities of the firewall. Lucid Security purposefully limited ipANGEL's scope: - Operates exclusively with FireWall-1 - Does not duplicate FireWall-1's capabilities - Ignores traffic that is not an attack against vulnerable applications and systems This approach has enabled Lucid Security to focus on building the intelligence and automation that make ipANGEL easy to deploy and maintain. Together, ipANGEL and FireWall-1 actively defend against attacks in real time.
2. NetMAX VPN Server Suite
by Cybernet Systems
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Relevant URL:
http://www.netmax.com/products/vpn_prods.html
Summary:
The NetMAX VPN Server Suite simplifies Linux servers by installing a ready-to-configure network security solution consisting of a Virtual Private Network (VPN) server, firewall, router, and proxy/cache server, along with the Linux operating system. NetMAX Internet Appliance Software provides small/medium sized businesses and enterprise workgroups easy use of a browser-based administration and pre-configured suite of applications, along with the strength and reliability of Linux.
3. PENS
by Portcullis Computer Security
Platforms: Linux, Netware, Windows 2000, Windows 95/98, Windows NT
Relevant URL:
http://www.securitynet.kirion.net/encryption-software/
Summary:
PENS is an on-the-fly encryption software system with either 56-bit DES or, new for Version 1.5, 128-bit IDEA and Triple DES algorithms for data encryption and 1024-bit RSA for key exchange and authentication. Users are given their own encrypted domains with which they can protect their files. They can also let other users enter these domains - should the administrator allow that - making worksharing easier. All they have to do is send their keys to the person who requires them.
V. NEW TOOLS FOR LINUX PLATFORMS
- Rate v0.81 by mteg Relevant URL: http://s-tech.elsat.net.pl/ Platforms: FreeBSD, Linux, OpenBSD, Solaris, SunOS Summary:
Rate is a Swiss-Army-knife bandwidth measurement tool. Its primary application is calculating the bandwidth used by packets matching a given BPF packet filter expression, which can really help a network administrator see what is happening at a software-based router at the moment. Administrators can measure the traffic generated by a single host or by a whole subnet, and measure HTTP traffic, broadcast traffic, quake traffic, etc. It can also be used for generating per-IP statistics and for determining nodes that generate highest traffic; it has a special operation mode for it. Additionally, it is able to extract strings from packets based on a POSIX regular expression.
2. CalcChecksum v1.4
by Michael Buesch
Relevant URL:
http://www.8ung.at/tuxsoft/
Platforms: POSIX
Summary:
CalcChecksum is a simple utility for calculating various checksums easily with a graphical user interface.
3. OpenVPN v1.4.2
by James Yonan
Relevant URL:
http://openvpn.sourceforge.net/
Platforms: Linux, POSIX
Summary:
OpenVPN is a robust and highly configurable VPN (Virtual Private Network) daemon which can be used to securely link two or more private networks using an encrypted tunnel over the Internet. You can tunnel any IP subnetwork or virtual ethernet adapter over a single UDP port, use all of the encryption, authentication, and certification features of the OpenSSL library to protect your private network traffic, use any cipher, key size, or HMAC digest (for packet authentication) supported by the OpenSSL library, choose between static-key based conventional encryption or certificate-based public key encryption, use static or TLS-based dynamic key exchange, and tunnel networks whose public endpoints are dynamic such as DHCP clients or dial-in users.
VI. SPONSOR INFORMATION
This Issue is Sponsored by: SPI Dynamics
ALERT:
"How a Hacker Launches a LDAP Injection Attack Step-by-Step" - White Paper
It's as simple as placing additional LDAP query commands into a Web form
input box giving hackers complete access to all your backend systems!
Firewalls and IDS will not stop such attacks because LDAP Injections are
seen as valid data.
Download this *FREE* white paper from SPI Dynamics for a complete guide to
protection!
http://www.securityfocus.com/SPIDynamics-linux-secnews7
Received on Mon Jul 28 17:30:59 2003
This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:02:27 EDT
|
Contact Us Legal Notices Order Services Online Pantek Home Privacy Policy IT news Site Map Pantek Library |