SecurityFocus Linux Newsletter #73

SecurityFocus Linux Newsletter #73
----------------------------------

This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml
-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Preventing and Detecting Insider Attacks Using IDS
     2. Behavior Blocking: The Next Step in Anti-Virus Protection
     3. From Joke to Alkahest
     4. Centralized Monitoring Software for Your Multi-vendor Security...
II. LINUX VULNERABILITY SUMMARY
     1. Qualcomm QPopper Remote Denial of Service Vulnerability
     2. PHPNetToolpack Insecure Search Path Vulnerability
     3. PHPNetToolpack Remote Command Execution Vulnerability
     4. Board-TNK Web Information Cross Site Scripting Vulnerability
     5. BG Guestbook Cross-Site Scripting Vulnerability
     6. Linux 2.4 UDP Constant IP Identification Field Fingerprinting...
     7. VBulletin Cross-Site Scripting Vulnerability
     8. Big Sam Web Root Disclosure Vulnerability
     9. Multiple Vendor Java Virtual Machine Bytecode Verifier...
III. LINUX FOCUS LIST SUMMARY
     1. SecurID and FreeS/WAN GW (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. SuperScout Web Filter
     2. SSP XBoard-1680
     3. BRICKServer
V. NEW TOOLS FOR LINUX PLATFORMS
     1. OpenRADIUS v0.9.3
     2. Bouncer v1.0.RC4
     3. Exiscan v4.01-2(For exim 4)
     4. Astaro Security Linux (ASL) v3.041 (beta)
VI. SPONSORSHIP INFORMATION



I. FRONT AND CENTER
-------------------
1. Preventing and Detecting Insider Attacks Using IDS
by Nathan Einwechter

Shortly after lunch break, an employee angrily strides out of his
supervisor’s office, down two rows of desks, and into a single cubicle. He
slumps down into his chair and releases an exasperated sigh, as he runs
his hands through his hair in disappointment.

http://online.securityfocus.com/infocus/1558

2. Behavior Blocking: The Next Step in Anti-Virus Protection
by Carey Nachenberg

Before the arrival of the fast-spreading worm/blended threat, the staple
technology of anti-virus software – fingerprinting - arguably provided
both preventative and proactive protection against the average computer
virus. That is, in the past, vendors were able to ship new fingerprints
for most viruses before they could achieve widespread distribution. This
is because traditional viruses spread slowly - only when humans exchange
infected files - on the order of days or weeks. Consequently, in the
majority of cases, anti-virus software blocked initial infection,
preventing corporate machines from being compromised and precluding the
need for costly manual cleanup and downtime.

http://online.securityfocus.com/infocus/1557

3. From Joke to Alkahest
by George Smith

Remember when we'd call someone who believes in magic computer viruses
with supernatural powers a fool? Today, we call him Senator.

http://online.securityfocus.com/columnists/68

4. Centralized Monitoring Software for Your Multi-vendor Security
Environment

GuardedNet's neuSECURE™ is advanced enterprise security management
software that provides centralized, correlated security event monitoring,
threat analysis and incident response for your existing multi-vendor
security environment. neuSECURE correlates log data from multiple,
disparate devices, reduces false positives and facilitates investigation
so that you can dramatically reduce your response time and exposure to
attacks.

For more information about this proactive, real time security monitoring
solution, sign-up to receive our product brief at

http://www.guarded.net/securityfocus/brief.html


II. BUGTRAQ SUMMARY
-------------------
1. Qualcomm QPopper Remote Denial of Service Vulnerability
BugTraq ID: 4295
Remote: Yes
Date Published: Mar 15 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4295
Summary:

Qualcomm's QPopper is a POP3 mail server for Linux and Unix based systems.
Recent versions of QPopper have been released as open source projects.

A vulnerability has been reported in some versions of qpopper. When a
connection is initiated, a client may send a long stream of arbitrary data
to the qpopper process. In some cases, a string of over 2048 characters
will cause a denial of service condition.

It has been reported that this will cause the qpopper process to cease
responding and consume all available CPU. The server may have to be
manually killed and restarted in order to regain normal functionality.

It may be possible to exploit this vulnerability to execute arbitrary
code. This has not, however, been confirmed.

2. PHPNetToolpack Insecure Search Path Vulnerability
BugTraq ID: 4304
Remote: No
Date Published: Mar 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4304
Summary:

PHPNetToolpack provides a web interface for finger, whois and traceroute.
It is written in PHP and will run on most Unix and Linux variants.

PHPNetToolpack is prone to an input validation error which may enable an
attacker to gain elevated privileges.

PHPNetToolpack does not use an absolute path when searching for the
traceroute program. If a local attacker creates their own program entitled
"traceroute" in a directory in the PHPNetToolpack search path, then that
program will be executed instead of the legitimate traceroute.

As a result, a local attacker may be able to trick PHPNetToolpack to
execute arbitrary attacker-supplied code with the privileges of the
webserver.

3. PHPNetToolpack Remote Command Execution Vulnerability
BugTraq ID: 4303
Remote: Yes
Date Published: Mar 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4303
Summary:

PHPNetToolpack provides a web interface for finger, whois and traceroute.
It is written in PHP and will run on most Unix and Linux variants.

PHPNetToolpack is prone to an issue which may enable a remote attacker to
execute arbitrary commands on the underlying shell of the host running the
vulnerable software.

PHPNetToolpack does not adequately filter shell metacharacters (such as ;,
|, etc.) from user-supplied input. As a result, it is possible for a
remote attacker to execute arbitrary commands with the privileges of the
webserver process.

Successful exploitation of this vulnerability will enable the attacker to
gain local, interactive access on the host running the vulnerable
software.

4. Board-TNK Web Information Cross Site Scripting Vulnerability
BugTraq ID: 4305
Remote: Yes
Date Published: Mar 16 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4305
Summary:

Linux-Sottises Board-TNK is a PHP based discussion board. Originally
developed for Linux, it may run on any platform supporting PHP and MySQL.

A cross site scripting vulnerability has been reported in some versions of
Board-TNK. User supplied input is not properly escaped when used as the
Web information associated with a post. As a result, a malicious user may
include JavaScript statements. This code will then execute within the
context of the Board-TNK page, possibly resulting in the theft of cookie
data.

5. BG Guestbook Cross-Site Scripting Vulnerability
BugTraq ID: 4308
Remote: Yes
Date Published: Mar 16 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4308
Summary:

BG Guestbook is a freely available web application written in PHP, which
is back-ended by a MySQL database. It can display content using either
HTML or Flash. It will run on most Unix and Linux variants as well as
Microsoft Windows operating systems.

BG Guestbook does not perform sufficient validation of user-supplied
input, especially with regards to HTML tags. As a result, BG Guestbook is
prone to cross-site scripting attacks.

An attacker may inject encoded variants of HTML tags/script code into
various fields. This may enable a remote attacker to cause arbitrary
script code to be executed in the browser of a legitimate web user, in the
context of the site running the vulnerable software.

This issue is present in both the HTML and Flash versions of the
vulnerable guestbook software.

Successful exploitation may enable an attacker to steal cookie-based
authentication credentials or cause malicious content to be displayed in
the browser of a web user who views the website running the vulnerable
software.

6. Linux 2.4 UDP Constant IP Identification Field Fingerprinting Vulnerability
BugTraq ID: 4314
Remote: Yes
Date Published: Mar 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4314
Summary:

A fingerprinting threat has been reported in some versions of the 2.4
Linux kernel IP stack implementation. UDP packets are transmitted with a
constant IP Identification field of 0. Normally, the IP Identification
field is intended to be a reasonably unique value, and is used to
reconstruct fragmented packets.

An attacker may be able to exploit this weakness to discover the operating
system and approximate kernel version of the vulnerable system. This
information may be of value in launching further attacks against the
system.

The ability to fingerprint operating systems based on minor differences in
network implementations is well known, and not limited to Linux based
systems.

7. VBulletin Cross-Site Scripting Vulnerability
BugTraq ID: 4315
Remote: Yes
Date Published: Mar 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4315
Summary:

vBulletin is commercial web forum software written in PHP and back-ended
by a MySQL database. It will run on most Linux and Unix variants, as well
as Microsoft operating systems.

vBulletin includes functionality to allow forum users to post images in
messages. To post an image, a user simply includes a link to the image
inside of [img] tags. However, vBulletin does not adequately filter
encoded script code in image tags. As a result, it is possible for an
attacker to post a maliciously constructed forum message which contains
arbitrary script code. When the message is viewed by legitimate users of
the website, the script code will be executed in their web browser, in the
context of the website running the vulnerable software.

This may enable an attacker to steal cookie-based authentication
credentials from a legitimate user of the website running the vulnerable
software.

It is not known whether vBulletin Lite is also affected by this
vulnerability.

8. Big Sam Web Root Disclosure Vulnerability
BugTraq ID: 4312
Remote: Yes
Date Published: Mar 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4312
Summary:

Big Sam is a stand along guestbook application written in PHP. It was
originally developed for Linux, but may operate under a wide range of Unix
and Windows platforms.

A vulnerability has been reported in some versions of Big Sam. If an
extremely large parameter is passed to the script as the displayBegin
parameter, execution may result in excessive resource consumption or in an
error message. The error message will contain the full path to the web
root. The outcome of exploitation has been reported to depend on the
server configuration.

More specifically, when executed under PHP's "safe_mode", the script will
return an error message after a timeout period passes.

9. Multiple Vendor Java Virtual Machine Bytecode Verifier Vulnerability
BugTraq ID: 4313
Remote: Yes
Date Published: Mar 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4313
Summary:

Java virtual machine implementations contain a vulnerability that may
allow for malicious Java applets to escape the security sandbox.

The vulnerability is due to a data casting error.  It is possible for an
applet constructed at the bytecode-level to perform an illegal casting
operation.  By doing so, the security sandbox intended to limit the
operations that can be performed by an applet may be escaped.  This can
result in the unrestricted execution of system-level code with the
privileges of the user running the virtual machine (possibly through a
browser).

It should be noted that this is a variant of a previously discovered
vulnerability BID 740.


III. LINUX FOCUS LIST SUMMARY
----------------------------
1. SecurID and FreeS/WAN GW (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]


IV.NEW PRODUCTS FOR LINUX PLATFORMS
-----------------------------------
1. SuperScout Web Filter
by SurfControl
Platforms: Linux, UNIX, Solaris, Windows NT, Windows 2000, Netware
Relevant URL:
http://www.surfcontrol.com/business/products/superscout_web/
Sumary:

SuperScout Web Filter 4.0 from SurfControl is the most flexible and
powerful tool for managing corporate Internet access. Enhance your ROI by
focusing employees on business use, maximizing network resources and
reducing the risks involved in providing Internet access at work.

2. SSP XBoard-1680
by SSP Solutions
Platforms: Linux, Windows NT, Windows 2000, Windows XP
Relevant URL:
http://www.sspsolutions.com/products/sspxboard1680/
Sumary:

Adding new servers to expand processing capacity is a costly solution -
placing a burden on administrator resources and IT budgets. With the SSP
XBoard-1680 organizations increase the efficiency of a server, allowing up
to 1680 SSL authentications to be processed per second, at a fraction of
the cost of adding new servers. By adding a SSP XBoard-1680 to a server,
significantly less CPU capacity is utilized for processing SSL connections
- freeing the CPU to respond to more customer requests and interact with
other Web site resources, such as customer databases, directories and
content servers. This next generation SSP XBoard provides increased
performance, load-balancing to multiple servers across a network, and
clustering support allowing multiple Web servers to share a single
CipherServer. Administrators can direct network traffic to a single or
multiple boards, in multiple systems - optimizing server usage.
Installation and configuration of the SSP XBoard-1680 can be completed in
minutes, providing one of the fastest SSL transaction performance
available in a single unit.

3. BRICKServer
by SAGE
Platforms: Linux
Relevant URL:
http://www.thirdpig.com/brickserver.htm
Sumary:

BRICKServer is a secure Web appliance featuring Process-Based security,
created for the sole purpose of protecting a website from Hackers.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. OpenRADIUS v0.9.3
by Emile van Bergen / E-Advies
Relevant URL:
http://www.xs4all.nl/~evbergen/openradius-index.html
Platforms: FreeBSD, Linux, OpenBSD, Solaris, SunOS
Summary:

OpenRADIUS is a RADIUS server that allows you to use external data sources
for anything: shared secrets, accounts and passwords, profiles, session
database, NAS- or called/calling nr. ACLs, accounting storage, and much
more. It has a powerful external module interface that uses pre-spawned
subprocesses and pipes for communication, allowing you to implement
modules in any language that supports Unix pipe I/O. Its behaviour is
fully configurable using built-in business rule language, which gives you
full control over the request- and reply list. The language is
strongly-typed, but has both automatic and explicit type conversion.

2. Bouncer v1.0.RC4
by Chris Mason [email protected]
Relevant URL:
http://www.r00t3d.org.uk/bin/
Platforms: FreeBSD, Linux, OpenBSD, Solaris, Windows 2000, Windows NT
Summary:

Bouncer is a network tool which allows you to bypass proxy restrictions
and obtain outside connections from an internal LAN. It uses SSL
tunneling, which allows you to obtain a constant streaming connection out
of a proxy. If you are restricted behind a proxy and can access secure
online ordering sites, then you can get out to whatever host on whatever
port you want. It also supports a lot of other features including socks 5,
basic authentication, access control lists, and Web-based administration,
and will run on Windows, Linux, and FreeBSD.

3. Exiscan v4.01-2(For exim 4)
by Tom Kistner, [email protected]
Relevant URL:
http://duncanthrax.net/exiscan/
Platforms: Linux, Solaris, UNIX
Summary:

Exiscan is an email virus scanner which works together with the Exim MTA.
It is written in Perl and designed to be as subtle and lightweight as
possible. Exiscan supports McAfee's UVSCAN, Sophos Sweep, Trend Micro's
FileScan and AVP virus scanning engines. Exiscan can scan inside MS-TNEF
and SMIME (signed) wrapped messages.

4. Astaro Security Linux (ASL) v3.041 (beta)
by Astaro AG, [email protected]
http://www.astaro.com/products/download.html
Platforms: Linux
Summary:

Astaro Security Linux is a new firewall solution. It does stateful
inspection, packet filtering, content filtering, virus scanning, VPN with
IPSec, and much more. With its Web-based management tool and the ability
to pull updates over the Internet, it it is pretty easy to manage. It is
based on a special hardened Linux 2.4 distribution where most daemons are
running in change-roots and are protected by capabilities.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml
-------------------------------------------------------------------------------