SecurityFocus Linux Newsletter #83

John Boletta <[email protected]> Mon, 3 Jun 2002 14:12:40 -0600 (MDT)

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #83
----------------------------------

This Issue is Sponsored by: N2H2

Free Linux Software Enhances Your Security Investment!

Control, manage and understand your company's Internet use. N2H2's
Sentian FS is the powerful safeguard that helps limit potential legal
liability, increases user productivity and optimizes network bandwidth.
Get your FREE evaluation copy now!

Visit us at: http://www.n2h2.com/sf1.php

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Securing Privacy Part Four: Internet Issues
2. PortSentry for Attack Detection - Part Two
3. Black Hat Briefings
4. Secure i-World
II. LINUX VULNERABILITY SUMMARY
1. Ethereal DNS Dissector Infinite Loop Denial of Service...
2. Ethereal GIOP Dissector Memory Exhaustion Vulnerability
3. SSH Communications Secure Shell Server AllowedAuthentications...
4. Ethereal Server Message Block Dissector Malformed Packet Denial...
5. Debian GNU/Linux netstd Multiple Buffer Overflow Vulnerabilities
6. ViewCVS Cross-Site Scripting Vulnerability
7. OpenBB BBCode Cross Agent HTML Injection Vulnerability
8. Sendmail File Locking Denial Of Service Vulnerability
9. OpenBB Unauthorized Moderator Access Vulnerability
10. CVS Daemon RCS Off By One Local Buffer Overflow Vulnerability
11. OpenBB Cross-Site Scripting Vulnerability
12. GNU Mailman Pipermail Index Summary HTML Injection Vulnerability
13. IRSSI Trojaned Configure File Arbitrary Access Vulnerability
14. MIT PGP Public Key Server Search String Remote Buffer...
15. Opera Arbitrary File Disclosure Vulnerability
16. AMANDA amindexd Remote Buffer Overflow Vulnerability
17. PHPBB2 Image Tag HTML Injection Vulnerability
18. AMANDA amcheck Local Buffer Overflow Vulnerability
19. Charities.Cron Insecure Temporary File Creation Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. securing nic's for snort (Thread)
2. How to get rid of spoofed IP-Address responses (Thread)
3. Linux Hardening (Thread)
4. irssi backdoor question (Thread)
5. What Is hosts2-ns (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. KillDisk
2. VFind Security Toolkit
3. Covalent Fast Start Server
V. NEW TOOLS FOR LINUX PLATFORMS
1. LCDproc v0.4.3
2. Secura v1.0
3. KFli4L v1.0
4. Exiscan v4.04-6(For exim 4)
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. Securing Privacy Part Four: Internet Issues
By Scott Granneman

This is the fourth and final installment in a series devoted to protecting
users' privacy on the Internet. In this article, we will look more
generally at our usage of the Internet. The Internet offers all of us
unparalleled access to information, but it also brings with it unique
threats to our privacy. This article will examine some of the ways you can
protect yourself.

http://online.securityfocus.com/infocus/1585

2. PortSentry for Attack Detection - Part Two
by Ido Dubrawsky

This is the second in a two-part series on PortSentry. The first article
discussed how PortSentry works to identify attacks, as well as what types
of attacks it identifies. This article will focus on building, installing,
and operating PortSentry. The focus here will be on the various
configuration options available for PortSentry, as well as some of the
benefits and drawbacks of those options.

http://online.securityfocus.com/infocus/1586

3. Black Hat Briefings

Attend Black Hat Briefings & Training, July 29 - August 1, Las Vegas, the
world's premier technical security event! 8 tracks, 12 training sessions,
Richard Clarke keynote, 500 delegates from 30 nations, with a near cult
following of both CSOs and "underground" security experts. See for
yourself what the buzz is all about.

http://www.blackhat.com

4. Secure i-World
August 19-21, 2002, San Diego, CA
Optional Workshops August 17, 18, 21, & 22
Vendor Expo August 19 & 20

WebSec 2002, Online Privacy Conference, Secure i-World Expotwo innovative
conferences and one outstanding expo, all in one blockbuster event.

http://www.secureiworld.com/06/sw02nl18inf.html

II. BUGTRAQ SUMMARY
-------------------
1. Ethereal DNS Dissector Infinite Loop Denial of Service Vulnerability
BugTraq ID: 4807
Remote: Yes
Date Published: May 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4807
Summary:

Ethereal is a freely available, open source network traffic analysis tool.
It is maintained by the Ethereal Project and is available for most Unix
and Linux variants as well as Microsoft Windows operating systems.

The Ethereal DNS dissector is a mechanism for decoding the DNS protocol.
A condition exists where the DNS dissector routine may enter an infinite
loop while processing a request. This may be triggered by a maliciously
constructed DNS query transmitted across the network. A remote attacker
may exploit this vulnerability to prevent Ethereal from functioning.

Successful exploitation may result in data loss and evasion of detection
by Ethereal.

2. Ethereal GIOP Dissector Memory Exhaustion Vulnerability
BugTraq ID: 4808
Remote: Yes
Date Published: May 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4808
Summary:

The Ethereal GIOP dissector is a mechanism for decoding the General
Inter-ORB Protocol (GIOP). A condition exists that may result in
exhaustion of available memory. A specially constructed packet may cause
allocation of a large amount of memory. Attackers may exploit this
vulnerability to cause an exhaustion of available memory.

Successful exploitation may result in Ethereal failing or crashing.

3. SSH Communications Secure Shell Server AllowedAuthentications Configuration Overriding Vulnerability
BugTraq ID: 4810
Remote: Yes
Date Published: May 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4810
Summary:

Secure Shell is the commercial SSH implementation distributed and
maintained by SSH Communications. It is available for the Unix, Linux,
and Microsoft Windows platforms.

A problem with some SSH servers may allow remote users to authentication
using arbitrary methods. The problem is in the handling of authentication
types specified via configuration.

SSH Servers allow an administrator to specify modes of authentication via
the server configuration file. Through the "AllowedAuthentications"
parameter, an administrator may limit the means of authentication used by
remote users.

Under some circumstances, it may be possible for a remote user to bypass
the "AllowedAuthentications" specified in the server configuration. This
could allow a user to authenticate using a different or weaker means, such
as a password. In such a situation where stronger authentication
protocols are in place, and system user accounts have been secured with
weak passwords, an attacker may be able to gain access to the system using
the weak password, rather than the strong authentcation scheme.

This problem makes it possible for remote users to circumvent
authentication mechanisms and, potentially, use a weaker method of
authentication.

4. Ethereal Server Message Block Dissector Malformed Packet Denial Of Service Vulnerability
BugTraq ID: 4806
Remote: Yes
Date Published: May 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4806
Summary:

The Ethereal Server Message Block (SMB) dissector is a mechanism for
decoding the Microsoft SMB protocol. A problem with this portion of
Ethereal could make it possible for a remote attacker to deny service to
an Ethereal user.

Two conditions exists that may result in attempts to dereference NULL
pointers. The conditions may be triggered by a specially constructed SMB
packet transmitted across the network by the attacker. By transmitting
such a packet while a session of Ethereal is running, Ethereal could be
made to dereference a NULL pointer, resulting in a crash of the
application.

Successful exploitation may result in Ethereal crashing due to an access
violation, resulting in a denial of service.

5. Debian GNU/Linux netstd Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 4816
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4816
Summary:

The netstd package, included with the Debian GNU/Linux distribution, is a
collection of networking utilities and daemons. Reportedly, version 3.07
of netstd is vulnerable to a buffer overflow attack. The vulnerability
affects multiple utilities included with netstd. The affected utilities
are:

- linux-ftpd
- pcnfsd
- tftp
- traceroute
- from/to

The condition occurs when an FQDN (Fully Qualified Domain Name) response,
generated by the target DNS (Domain Name System) server is copied into a
small buffer without any checks. It may be possible for a malicious
attacker to overflow the buffer and execute code as the owner of the
vulnerable processes.

Versions of Debian post-2.2 release do not include this program as a
binary package. This program is however distributed as source code
through the source tree. Versions pre-2.2 may have to binary package
installed.

6. ViewCVS Cross-Site Scripting Vulnerability
BugTraq ID: 4818
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4818
Summary:

ViewCVS is an open-source web interface for CVS. It is available for most
Unix and Linux variants as well as Microsoft Windows operating systems.

ViewCVS does not filter HTML tags from certain URL parameters, making it
prone to cross-site scripting attacks.

An attacker may exploit this by constructing a malicious link with script
code to a site running ViewCVS and sending it to a legitimate user of the
site. When the legitimate user follows the link, the attacker's script
code is executed in their web client in the security context of the
website running ViewCVS.

The attacker may be able to steal cookie-based authentication credentials
or hijack web content as a result of this vulnerability.

7. OpenBB BBCode Cross Agent HTML Injection Vulnerability
BugTraq ID: 4819
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4819
Summary:

OpenBB is web forum software written in PHP. It will run on most Linux and
Unix variants, in addition to Microsoft Windows operating systems.

This vulnerability is similar to the issue discussed in BugTraq ID 4171.
The vulnerability discussed in BugTraq ID 4171 was fixed in OpenBB 1.0.0
RC3, however this issue bypasses the fix provided in 1.0.0 RC3.

OpenBB version 1.0.0 RC3 is reportedly vulnerable to HTML injection
attacks. The vulnerability occurs in the file lib/codeparse.php which
replaces HTML code with BBCodes.

OpenBB uses 'BBCodes' in the place of HTML code to include images, links
etc. This is meant for HTML functionality without being suceptible to
malicious users. However, HTML tags are not adequately replaced with
BBCodes. It is possible to inject arbitrary HTML code into forum messages.
As a result, OpenBB is prone to cross-agent scripting attacks. Script code
will be executed in the browser of the user viewing the forum message and
may allow an attacker to steal cookie-based authentication credentials.

8. Sendmail File Locking Denial Of Service Vulnerability
BugTraq ID: 4822
Remote: No
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4822
Summary:

Sendmail is a MTA (Mail Transport Agent) for Unix and Linux variants.

There is a vulnerability in Sendmail that will lead to a denial of service
condition. The vulnerability occurs when a malicious user acquires an
exclusive lock on files that Sendmail requires for operation.

Sendmail uses file locking for a variety of files including aliases, maps,
statistics, and the pid file. If a user has access to these files, the
user may be able to obtain exclusive locks on these files. If Sendmail,
or its associated programs, is unable to obtain access to any critical
files, it will cease to function properly.

A malicious user may exploit this vulnerability to cause Sendmail to stop
functioning.

9. OpenBB Unauthorized Moderator Access Vulnerability
BugTraq ID: 4823
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4823
Summary:

OpenBB is web forum software written in PHP. It will run on most Linux and
Unix variants, in addition to Microsoft Windows operating systems.

OpenBB is reported to be vulnerable to a condition that will allow an
unauthorized user to gain moderator or administrative access to forums.

The attacker can only change a few options as follows:

- Open or close a forum
- To toggle sticky mode status of a forum
- To toggle significant mode status of a forum

This will allow an attacker to effectively cause significant, if not all,
parts of the forum to be closed.

10. CVS Daemon RCS Off By One Local Buffer Overflow Vulnerability
BugTraq ID: 4829
Remote: No
Date Published: May 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4829
Summary:

CVS is the concurrent versioning system. CVS is a freely available, open
source software development package for the Unix, Linux, and Microsoft
Windows platforms.

A problem with the software could make it possible for an attacker to gain
elevated privileges.

Due to a boundry condition error, it may be possible for a local attacker
to execute arbitrary code. The rcs.c file contains an off-by-one error
that could result in an attacker overwriting portions of stack memory, and
executing arbitrary code.

This problem could result in an attacker gaining access to the CVS
archives with the privileges of the CVS user. This could allow an
attacker to alter source code within the CVS archive, and potentially
backdoor source code.

11. OpenBB Cross-Site Scripting Vulnerability
BugTraq ID: 4824
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4824
Summary:

OpenBB is web forum software written in PHP. It will run on most Linux and
Unix variants, in addition to Microsoft Windows operating systems.

It has been reported that OpenBB is vulnerable to a cross-site scripting
attack.

The vulnerability is present in the 'myhome.php' script. OpenBB does not
properly santize client-supplied value of certain parameters prior to
output. Attackers are able to circumvent existing measures to protect
against cross- site scripting attacks with the use of '<form>' tags
followed by arbitrary HTML.

Attackers may exploit this vulnerability by constructing a link to one of
these scripts containing malicious script code. If the link is sent to an
OpenBB user and clicked on, the attacker-supplied script code will run in
the context of the user's OpenBB session. The script code may obtain
cookie values or perform unauthorized actions as the victim user.

12. GNU Mailman Pipermail Index Summary HTML Injection Vulnerability
BugTraq ID: 4826
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4826
Summary:

GNU Mailman is a freely available, open-source mailing list manager
written in Python and C. It runs on Linux and other Unix-based systems.
Pipermail is bundled into GNU Mailman and is used as the mailing list
archiver.

HTML tags are not properly filtered from the HTML list archive index.
This may enable a remote attacker to inject arbitrary HTML, including
script code, into the HTML list archive index.

When a web user views the list index archive containing attacker-supplied
script code, the script code will be executed in their web client in the
security context of the website running GNU Mailman.

This issue exists in the Pipermail component of GNU Mailman.

13. IRSSI Trojaned Configure File Arbitrary Access Vulnerability
BugTraq ID: 4831
Remote: Yes
Date Published: May 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4831
Summary:

irssi is a freely available, open source irc client. irssi is available
for the Linux and Unix operating systems.

A problem with the client could make it possible for a remote user to gain
control of a users account.

The server hosting irssi was compromised at some point. After being
compromised, the source code to irssi was altered to include a backdoor.
This backdoor allowed a user from the IP address 204.120.36.206 to
remotely execute commands on the host that irssi was installed on. The
source code is known to have been trojaned between the beginning of April,
and end of May. Downloads of the source during this time likely contain
the trojan code.

This problem could lead to a remote attacker gaining access to system with
the privileges of the irssi process. This problem could additionally lead
to further compromise.

14. MIT PGP Public Key Server Search String Remote Buffer Overflow Vulnerability
BugTraq ID: 4828
Remote: Yes
Date Published: May 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4828
Summary:

The PGP Public Key Server is a freely available, open source software
package distributed by MIT. It is designed for use on Linux and Unix
operating systems.

A problem with the software package may allow remote code execution. The
problem is in the handling of long search strings.

The PGP Public Key Server does not properly handle long search strings.
Under some conditions, it may be possible to pass a long string to the
server that could result in a buffer overflow. This may result in the
overwriting of stack variables, including the return address.

Upon passing a search string of 512 or more characters, the server
crashes. Minimally, this could result in a denial of service to users of
the key server. In the event that this could be exploited to execute
code, a remote user would be able to execute code with the privileges of
the PGP Public Key Server process.

It is noteworthy that exploit strings must be able to pass through an
isalnum() function, as well as a tolower() function, limiting the
characters that may be used in an exploit string.

15. Opera Arbitrary File Disclosure Vulnerability
BugTraq ID: 4834
Remote: Yes
Date Published: May 27 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4834
Summary:

Opera is a web browser created by Opera Software. It is available for a
range of operating systems including Windows and Linux. A vulnerability
has been reported in Opera 6.01/6.02.

The vulnerability is related to handling of the 'file' HTML input-type.
The 'file' input-type supports upload of files as HTML form input, from a
client to a webserver. By design, Opera does not prevent the server from
setting the filename to be uploaded. To prevent malicious servers from
forcing the upload of arbitrary files, a warning dialog is presented to
the user when a form with a file upload is submitted. If a form with a
'file' input type is submitted with no file value set, the dialog is not
displayed (as there is no file being uploaded).

It is possible for a server to set the file value while fooling Opera into
thinking no file has been specified. An attacker may accomplish this if
the filename is appended with the string "&#10;". This HTML-encoded
newline character will cause the browser to believe that no value has been
set. Consequently, the form will be submitted and the specified file will
be uploaded to the server. This may occur without knowledge or consent of
the victim user.

Exploitation of this vulnerability allows for malicious webmasters to
obtain arbitrary files from client systems.

16. AMANDA amindexd Remote Buffer Overflow Vulnerability
BugTraq ID: 4836
Remote: Yes
Date Published: May 27 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4836
Summary:

AMANDA (Advanced Maryland Automatic Network Disk Archiver) is a system for
backing up multiple hosts onto a single tape drive. It will run on most
Unix and Linux variants.

The AMANDA amindexd daemon is prone to a remotely exploitable buffer
overflow condition. This condition is due to insufficient bounds checking
of command strings. Overly long command strings (260+ bytes) may cause
stack variables such as the return address to be overwritten.

This vulnerability may be exploited by remote attackers to run arbitrary
instructions as root, leading to a complete compromise of the host running
the vulnerable software.

The amindexd daemon runs on port 10082.

This issue was reported for AMANDA 2.3.0.4, which is an older release.
Other versions may also be affected.

17. PHPBB2 Image Tag HTML Injection Vulnerability
BugTraq ID: 4858
Remote: Yes
Date Published: May 26 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4858
Summary:

phpBB2 is free, open-source web forums software that is written in PHP and
backended by MySQL. It will run on most Unix and Linux variants, as well
as Microsoft Windows operating systems.

BBCode is a feature which allows users to include HTML-style formatting
elements in their forum messages.

It is possible to inject arbitrary HTML into phpBB2 forum messages via the
use of BBCode image tags. A similar issue is described in Bugtraq ID 4379
"PHPBB Image Tag User-Embedded Scripting Vulnerability". However, phpBB2
was found to not be vulnerable to this previous issue.

When the image tag is translated into HTML, the following code is used:

phpBB2 checks to ensure that the user-provided image source is prepended
with "http://", which restricts the user from injecting arbitrary HTML as
the image source. However, it has been reported that this measure may be
circumvented by using a double-quotation (") character to close the image
source tag. The attacker may then include arbitrary HTML after the
double-quotation.

The attacker may exploit this issue to inject script code into forum
messages. When such messages are displayed by a web user, the attacker's
script code will execute in their browser in the context of the website.
If the web user is an authenticated user of the phpBB2 forum, then the
attacker may exploit this condition to steal cookie-based authentication
credentials from the user.

phpBB versions prior to the phpBB2 series may also be affected by this
vulnerability.

18. AMANDA amcheck Local Buffer Overflow Vulnerability
BugTraq ID: 4840
Remote: No
Date Published: May 27 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4840
Summary:

AMANDA (Advanced Maryland Automatic Network Disk Archiver) is a system for
backing up multiple hosts onto a single tape drive. It will run on most
Unix and Linux variants.

The AMANDA amcheck component is prone to a locally exploitable buffer
overflow condition. The amcheck utility is installed setuid root by
default. The overflow condition is due to insufficient bounds checking
when processing command line input. It is possible for remote attackers
to overwrite the stack frame of the affected function when amcheck is
invoked with an oversized command parameter.

It should be noted that amcheck may only be executed by the user/group
'operator'. Only attackers with sufficient privileges to execute amcheck
may exploit this vulnerability.

This issue was reported for AMANDA 2.3.0.4, which is an older release.
Other versions may also be affected.

19. Charities.Cron Insecure Temporary File Creation Vulnerability
BugTraq ID: 4869
Remote: No
Date Published: May 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4869
Summary:

Charities.cron is a cron script written in gawk, which clicks the links on
various charity websites. Charities.cron is intended to be run as a daily
cron job. It will run on most Unix and Linux variants.

Charities.cron uses the lynx web browser to poll various charity websites.
It downloads the charity webpages and stores them in temporary files.
However, Charities.cron creates these temporary files with predictable
filenames. A local attacker may exploit this to cause arbitrary files
writeable by the cron scheduling daemon process to be written to via
symlink attacks. This may result in a denial of service condition.

This vulnerability has existed in one form or another through various
releases of Charities.cron. Since the most recent version (1.7.0) still
uses prediactable temporary filenames, it may be still be possible to
exploit this condition. Charities.cron does check to see if the temporary
files used already exist before dumping the charity webpages, however,
this fix only creates a race condition which may still be potentially
exploitable.

III. LINUX FOCUS LIST SUMMARY
----------------------------
1. securing nic's for snort (Thread)
Relevant URL: