SecurityFocus Linux Newsletter #82

John Boletta <[email protected]> Tue, 28 May 2002 10:29:20 -0600 (MDT)

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #82
----------------------------------

This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. No Stone Unturned, Part Four
2. The Viral Mind: Understanding the Motives of Malicious Coders
3. Black Hat Briefings
II. LINUX VULNERABILITY SUMMARY
1. bzip2 Insecure Decompressed File Permissions Vulnerability
2. bzip2 Decompression File Overwrite Vulnerability
3. BannerWheel Remote Buffer Overflow Vulnerability
4. bzip2 Archive Inherited Symbolic Link Permissions Vulnerability
5. Ethereal DNS Dissector Infinite Loop Denial of Service...
6. Ethereal GIOP Dissector Memory Exhaustion Vulnerability
7. SSH Communications Secure Shell Server Allowed...
8. Ethereal Server Message Block Dissector Malformed Packet...
9. Debian GNU/Linux netstd Multiple Buffer Overflow Vulnerabilities
10. ViewCVS Cross-Site Scripting Vulnerability
11. OpenBB BBCode Cross Agent HTML Injection Vulnerability
12. Sendmail File Locking Denial Of Service Vulnerability
13. OpenBB Unauthorized Moderator Access Vulnerability
14. Ethereal X11 Dissector Buffer Overflow Vulnerability
15. OpenBB Cross-Site Scripting Vulnerability
16. GNU Mailman Admin Login Cross-Site Scripting Vulnerability
17. GNU Mailman Pipermail Index Summary HTML Injection Vulnerability
18. IBM DB2 db2ckpw Buffer Overflow Vulnerability
19. MIT PGP Public Key Server Search String Remote Buffer Overflow...
III. LINUX FOCUS LIST SUMMARY
1. How to get rid of spoofed IP-Address responses (Thread)
2. What Is hosts2-ns (Thread)
3. Linux Hardening (Thread)
4. How to get rid of spoofed IP-Address responses (Thread)
5. protecting DHCP servers (Thread)
6. protecting DHCP servers (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. InsideOut Firewall Reporter
2. SecureCom 8000 Family
3. Websense Enterprise
V. NEW TOOLS FOR LINUX PLATFORMS
1. IPWatch 1.1
2. Sophie v1.35
3. sysklogd-sql v1.4.1
4. COMU Privacy Guard 1.0
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. No Stone Unturned, Part Four
By H. Carvey

This is the fourth installment of a five-part series describing the
(mis)adventures of a sysadmin named Eliot and his haphazard journey in
discovering "the Way" of incident response.

http://online.securityfocus.com/infocus/1584

2. The Viral Mind: Understanding the Motives of Malicious Coders
by D. D. Shelby

Over the years I have seen many people offer opinions on why virus writers
do what they do. While I accept that many of these people have indeed
spoken to a small number of malware authors, it has become all too
apparent that much of their text has been based on opinion and not fact.
In this article, I will draw upon my own experiences as a virus writer and
as a member of the virus (and anti-virus) community to explore some of the
reasons that people would devote their time to developing viruses.

http://online.securityfocus.com/infocus/1583

3. Black Hat Briefings

Attend Black Hat Briefings & Training, July 29 - August 1, Las Vegas, the
world's premier technical security event! 8 tracks, 12 training sessions,
Richard Clarke keynote, 500 delegates from 30 nations, with a near cult
following of both CSOs and "underground" security experts. See for
yourself what the buzz is all about.

http://www.blackhat.com

II. BUGTRAQ SUMMARY
-------------------
1. bzip2 Insecure Decompressed File Permissions Vulnerability
BugTraq ID: 4775
Remote: No
Date Published: May 20 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4775
Summary:

bzip2 is an open-source file compression/decompression utility for Unix
and Linux variants.

bzip2 is prone to a race condition which may cause files to decompress
with world-readable permissions. The race condition exists between the
creation of files that are being decompressed and the setting of
permissions, potentially causing decompression files to be created with
inappropriate permissions.

This vulnerability may potentially expose sensitive files to other local
users.

2. bzip2 Decompression File Overwrite Vulnerability
BugTraq ID: 4774
Remote: Yes
Date Published: May 20 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4774
Summary:

bzip2 is an open-source file compression/decompression utility for Unix
and Linux variants.

bzip2 does not decompress files securely. When a file is decompressed,
the program does not sufficiently check to see if the file already exists,
potentially allowing files to be overwritten without warning during the
decompression.

The source of this problem is that the O_EXCL flag is not used when the
files are created during decompression. An attacker may potentially
create a malicious archive which exploits this vulnerability, causing
files owned by the user decompressing the archive to be overwritten.

3. BannerWheel Remote Buffer Overflow Vulnerability
BugTraq ID: 4782
Remote: Yes
Date Published: May 20 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4782
Summary:

BannerWheel is a freely available ad banner rotation program. It runs on
most Unix and Linux variants as well as Microsoft Windows operating
systems.

A condition has been reported in BannerWheel which may lead to arbitrary
code execution or a denial of service.

Due to insufficient bounds checking of externally supplied data,
BannerWheel may be prone to a buffer overflow condition. It may be
possible for an attacker to overwrite stack variables (including the
return address) with attacker-supplied instructions.

If exploitable, this condition may allow a remote attacker to execute
arbitrary instructions with the privileges of the webserver process.

4. bzip2 Archive Inherited Symbolic Link Permissions Vulnerability
BugTraq ID: 4776
Remote: No
Date Published: May 20 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4776
Summary:

bzip2 is an open-source file compression/decompression utility for Unix
and Linux variants.

bzip2 inherits the permissions of symbolic links when a file is
compressed, instead of the permissions of the actual file being
compressed. Therefore, if a symbolic link is attached to a file that is
compressed using the software, then the permissions for the symbolic link
are stored in the archive as the permissions for the file.

The source of the problem is a failure to derefence the symbolic links
when creating the archive.

This may result in decompressed files being created with insecure
permissions (such as world-readable), potentially causing sensitive
information to contained in the decompressed files to be disclosed to
local users.

5. Ethereal DNS Dissector Infinite Loop Denial of Service Vulnerability
BugTraq ID: 4807
Remote: Yes
Date Published: May 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4807
Summary:

Ethereal is a freely available, open source network traffic analysis tool.
It is maintained by the Ethereal Project and is available for most Unix
and Linux variants as well as Microsoft Windows operating systems.

The Ethereal DNS dissector is a mechanism for decoding the DNS protocol.
A condition exists where the DNS dissector routine may enter an infinite
loop while processing a request. This may be triggered by a maliciously
constructed DNS query transmitted across the network. A remote attacker
may exploit this vulnerability to prevent Ethereal from functioning.

Successful exploitation may result in data loss and evasion of detection
by Ethereal.

6. Ethereal GIOP Dissector Memory Exhaustion Vulnerability
BugTraq ID: 4808
Remote: Yes
Date Published: May 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4808
Summary:

The Ethereal GIOP dissector is a mechanism for decoding the General
Inter-ORB Protocol (GIOP). A condition exists that may result in
exhaustion of available memory. A specially constructed packet may cause
allocation of a large amount of memory. Attackers may exploit this
vulnerability to cause an exhaustion of available memory.

Successful exploitation may result in Ethereal failing or crashing.

7. SSH Communications Secure Shell Server AllowedAuthentications Configuration Overriding Vulnerability
BugTraq ID: 4810
Remote: Yes
Date Published: May 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4810
Summary:

Secure Shell is the commercial SSH implementation distributed and
maintained by SSH Communications. It is available for the Unix, Linux,
and Microsoft Windows platforms.

A problem with some SSH servers may allow remote users to authentication
using arbitrary methods. The problem is in the handling of authentication
types specified via configuration.

SSH Servers allow an administrator to specify modes of authentication via
the server configuration file. Through the "AllowedAuthentications"
parameter, an administrator may limit the means of authentication used by
remote users.

Under some circumstances, it may be possible for a remote user to bypass
the "AllowedAuthentications" specified in the server configuration. This
could allow a user to authenticate using a different or weaker means, such
as a password. In such a situation where stronger authentication
protocols are in place, and system user accounts have been secured with
weak passwords, an attacker may be able to gain access to the system using
the weak password, rather than the strong authentcation scheme.

This problem makes it possible for remote users to circumvent
authentication mechanisms and, potentially, use a weaker method of
authentication.

8. Ethereal Server Message Block Dissector Malformed Packet Denial Of Service Vulnerability
BugTraq ID: 4806
Remote: Yes
Date Published: May 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4806
Summary:

The Ethereal Server Message Block (SMB) dissector is a mechanism for
decoding the Microsoft SMB protocol. A problem with this portion of
Ethereal could make it possible for a remote attacker to deny service to
an Ethereal user.

Two conditions exists that may result in attempts to dereference NULL
pointers. The conditions may be triggered by a specially constructed SMB
packet transmitted across the network by the attacker. By transmitting
such a packet while a session of Ethereal is running, Ethereal could be
made to dereference a NULL pointer, resulting in a crash of the
application.

Successful exploitation may result in Ethereal crashing due to an access
violation, resulting in a denial of service.

9. Debian GNU/Linux netstd Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 4816
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4816
Summary:

The netstd package, included with the Debian GNU/Linux distribution is a
collection of networking utilities and daemons. Reportedly, version
3.07-17 of netstd included with Debian is vulnerable to a buffer overflow
attack. The vulnerability affects multiple utilities included with
netstd. The affected utilities are:

- linux-ftpd
- pcnfsd
- tftp
- traceroute
- from/to

The condition occurs when an FQDN (Fully Qualified Domain Name) response,
generated by the target DNS (Domain Name System) server is copied into a
small buffer without any checks. It may be possible for a malicious
attacker to overflow the buffer and execute code as the owner of the
vulnerable processes.

10. ViewCVS Cross-Site Scripting Vulnerability
BugTraq ID: 4818
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4818
Summary:

ViewCVS is an open-source web interface for CVS. It is available for most
Unix and Linux variants as well as Microsoft Windows operating systems.

ViewCVS does not filter HTML tags from certain URL parameters, making it
prone to cross-site scripting attacks.

An attacker may exploit this by constructing a malicious link with script
code to a site running ViewCVS and sending it to a legitimate user of the
site. When the legitimate user follows the link, the attacker's script
code is executed in their web client in the security context of the
website running ViewCVS.

The attacker may be able to steal cookie-based authentication credentials
or hijack web content as a result of this vulnerability.

11. OpenBB BBCode Cross Agent HTML Injection Vulnerability
BugTraq ID: 4819
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4819
Summary:

OpenBB is web forum software written in PHP. It will run on most Linux and
Unix variants, in addition to Microsoft Windows operating systems.

This vulnerability is similar to the issue discussed in BugTraq ID 4171.
The vulnerability discussed in BugTraq ID 4171 was fixed in OpenBB 1.0.0
RC3, however this issue bypasses the fix provided in 1.0.0 RC3.

OpenBB version 1.0.0 RC3 is reportedly vulnerable to HTML injection
attacks. The vulnerability occurs in the file lib/codeparse.php which
replaces HTML code with BBCodes.

OpenBB uses 'BBCodes' in the place of HTML code to include images, links
etc. This is meant for HTML functionality without being suceptible to
malicious users. However, HTML tags are not adequately replaced with
BBCodes. It is possible to inject arbitrary HTML code into forum messages.
As a result, OpenBB is prone to cross-agent scripting attacks. Script code
will be executed in the browser of the user viewing the forum message and
may allow an attacker to steal cookie-based authentication credentials.

12. Sendmail File Locking Denial Of Service Vulnerability
BugTraq ID: 4822
Remote: No
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4822
Summary:

Sendmail is a MTA (Mail Transport Agent) for Unix and Linux variants.

There is a vulnerability in Sendmail that will lead to a denial of service
condition. The vulnerability occurs when a malicious user acquires an
exclusive lock on files that Sendmail requires for operation.

Sendmail uses file locking for a variety of files including aliases, maps,
statistics, and the pid file. If a user has access to these files, the
user may be able to obtain exclusive locks on these files. If Sendmail,
or its associated programs, is unable to obtain access to any critical
files, it will cease to function properly.

A malicious user may exploit this vulnerability to cause Sendmail to stop
functioning.

13. OpenBB Unauthorized Moderator Access Vulnerability
BugTraq ID: 4823
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4823
Summary:

OpenBB is web forum software written in PHP. It will run on most Linux and
Unix variants, in addition to Microsoft Windows operating systems.

OpenBB is reported to be vulnerable to a condition that will allow an
unauthorized user to gain moderator or administrative access to forums.

The attacker can only change a few options as follows:

- Open or close a forum
- To toggle sticky mode status of a forum
- To toggle significant mode status of a forum

This will allow an attacker to effectively cause significant, if not all,
parts of the forum to be closed.

14. Ethereal X11 Dissector Buffer Overflow Vulnerability
BugTraq ID: 4805
Remote: Yes
Date Published: May 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4805
Summary:

The Ethereal X11 dissector is a mechanism for decoding the X11 protocol. A
buffer overflow exists when processing X11 key symbols, or 'keysyms'. It
is possible for an attacker to construct a packet that will, when decoded
by Ethereal, trigger the overflow condition.

Successful exploitation of this vulnerability may result in the attacker
gaining access to the ethereal host.

15. OpenBB Cross-Site Scripting Vulnerability
BugTraq ID: 4824
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4824
Summary:

OpenBB is web forum software written in PHP. It will run on most Linux and
Unix variants, in addition to Microsoft Windows operating systems.

It has been reported that OpenBB is vulnerable to a cross-site scripting
attack.

The vulnerability is present in the 'myhome.php' script. OpenBB does not
properly santize client-supplied value of certain parameters prior to
output. Attackers are able to circumvent existing measures to protect
against cross- site scripting attacks with the use of '<form>' tags
followed by arbitrary HTML.

Attackers may exploit this vulnerability by constructing a link to one of
these scripts containing malicious script code. If the link is sent to an
OpenBB user and clicked on, the attacker-supplied script code will run in
the context of the user's OpenBB session. The script code may obtain
cookie values or perform unauthorized actions as the victim user.

16. GNU Mailman Admin Login Cross-Site Scripting Vulnerability
BugTraq ID: 4825
Remote: Yes
Date Published: May 20 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4825
Summary:

GNU Mailman is a freely available, open-source mailing list manager
written in Python and C. It runs on Linux and other Unix-based systems.

GNU Mailman is prone to a cross-site scripting vulnerability. An attacker
may construct a malicious link to the administrative login page, which
contains arbitrary HTML and script code.

A user visiting the link will have the attacker's script code executed in
their web browser in the context of the site running the vulnerable
software.

The attacker may potentially exploit this condition to steal cookie-based
authentication credentials.

17. GNU Mailman Pipermail Index Summary HTML Injection Vulnerability
BugTraq ID: 4826
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4826
Summary:

GNU Mailman is a freely available, open-source mailing list manager
written in Python and C. It runs on Linux and other Unix-based systems.
Pipermail is bundled into GNU Mailman and is used as the mailing list
archiver.

HTML tags are not properly filtered from the HTML list archive index.
This may enable a remote attacker to inject arbitrary HTML, including
script code, into the HTML list archive index.

When a web user views the list index archive containing attacker-supplied
script code, the script code will be executed in their web client in the
security context of the website running GNU Mailman.

This issue exists in the Pipermail component of GNU Mailman.

18. IBM DB2 db2ckpw Buffer Overflow Vulnerability
BugTraq ID: 4817
Remote: No
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4817
Summary:

IBM DB2 includes the utility 'db2ckpw' as part of it's authentication
system. By default, db2ckpw is installed setuid root.

An exploitable buffer overflow vulnerability exists in db2ckpw. It is
possible to trigger the condition by supplying a username value greater
than 8 characters in length.

By design, db2ckpw is meant to be invoked by other components. While
bounds checking on username and password values occurs in these components
prior to invocation of db2ckpw, none exists in db2ckpw itself.

An unsafe string copy operation in db2ckpw may thus be exploited by local
users if db2ckpw is run directly. Local users may supply a username value
that overwrites the return address of the affected function with a pointer
to shellcode. When the function returns, the attacker-supplied shellcode
will run with effective root privileges.

Successful exploitation of this vulnerability may result in complete
compromise of the host.

19. MIT PGP Public Key Server Search String Remote Buffer Overflow Vulnerability
BugTraq ID: 4828
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4828
Summary:

The PGP Public Key Server is a freely available, open source software
package distributed by MIT. It is designed for use on Linux and Unix
operating systems.

A problem with the software package may allow remote code execution. The
problem is in the handling of long search strings.

The PGP Public Key Server does not properly handle long search strings.
Under some conditions, it may be possible to pass a long string to the
server that could result in a buffer overflow. This may result in the
overwriting of stack variables, including the return address.

Upon passing a search string of 512 or more characters, the server
crashes. Minimally, this could result in a denial of service to users of
the key server. In the event that this could be exploited to execute
code, a remote user would be able to execute code with the privileges of
the PGP Public Key Server process.

It is noteworthy that exploit strings must be able to pass through an
isalnum() function, as well as a tolower() function, limiting the
characters that may be used in an exploit string.

III. LINUX FOCUS LIST SUMMARY
----------------------------

1. How to get rid of spoofed IP-Address responses (Thread)
Relevant URL: