SecurityFocus Linux Newsletter #84

SecurityFocus Linux Newsletter #84
----------------------------------

This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml

-------------------------------------------------------------------------------


I. FRONT AND CENTER
     1. Optimizing NIDS Performance
     2. A Virus by Any Other Name: Virus Naming Practices
     3. United We Fall
     4. Black Hat Briefings & Training
II. LINUX VULNERABILITY SUMMARY
     1. TCPDump Malformed NFS Packet Buffer Overflow Vulnerability
     2. IBM Informix SE sqlexec Buffer Overflow Vulnerability
     3. MNews Server Response Buffer Overflow Vulnerability
     4. MNews Multiple Buffer Overflow Vulnerabilities
     5. Courier MTA Long Year Remote Resource Consumption Vulnerability
     6. University Of Washington IMAP Arbitrary File Access Vulnerability
     7. Debian IN.UUCP Remote Buffer Overflow Vulnerability
     8. Next Generation POSIX Threading Shared Memory Denial of...
     9. Twibright Labs Links Large PNG Image Buffer Overflow...
     10. Teekai's Tracking Online Cross-Site Scripting Vulnerability
     11. Nullsoft SHOUTCast Remote Buffer Overflow Vulnerability
     12. Slurp SysLog Remote Format String Vulnerability
     13. Ghostscript PostScript File Arbitrary Command Execution...
III. LINUX FOCUS LIST SUMMARY
     1. Snort vs. other (Thread)
     2. Linux Hardening (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. StillSecure Border Guard
     2. BRICKServer
     3. CipherServer 440
     4. CSM Proxy
V. NEW TOOLS FOR LINUX PLATFORMS
     1. Vexira Antivirus (Linux Server) v2
     2. Network Equipment Performance Monitor v0.90b1
     3. bg perlyzer v0.1.0
     4. openMosix Cluster for Linux v2.4.17
VI. SPONSORSHIP INFORMATION




I. FRONT AND CENTER
-------------------
1. Optimizing NIDS Performance
By Neil Desai

To help network intrusion detection systems keep up with the demands of
today's networks, and the wide variety of threats that besiege them, there
are a number of things that the NIDS administrator can do to improve the
performance of their NIDS. This article will examine some of those
options.

http://online.securityfocus.com/infocus/1589

2. A Virus by Any Other Name: Virus Naming Practices
by Costin Raiu, Kaspersky Labs Romania

When the "VBS/VBSWG.J" virus appeared, the media decided to call it by a
more appealing name, "AnnaKournikova", which was derived from the JPEG
file that the virus claimed to be. However, none of the anti-virus
products included in the excellent virus names cross reference tool VGrep
currently lists this virus as "AnnaKournikova", "Kournikova", or any other
variation based on the name of the charismatic tennis player. On the other
hand, a considerable number of AV programs detect it as "SST", while a
very small number don’t call it "VBSWG" or "SST".

http://online.securityfocus.com/infocus/1587

3. United We Fall
By Jon Lasser

The United Linux distribution will introduce thousands of open-source fans
to the security nightmare of a software monoculture.

http://online.securityfocus.com/columnists/86

4. Black Hat Briefings & Training

Attend Black Hat Briefings & Training, July 29 - August 1, Las Vegas, the
world's premier technical security event! 8 tracks, 12 training sessions,
Richard Clarke keynote, 500 delegates from 30 nations, with a near cult
following of both CSOs and "underground" security experts. See for
yourself what the buzz is all about.

Please visit www.blackhat.com for more information.


II. BUGTRAQ SUMMARY
-------------------
1. TCPDump Malformed NFS Packet Buffer Overflow Vulnerability
BugTraq ID: 4890
Remote: Yes
Date Published: May 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4890
Summary:

tcpdump is a freely available software package designed for analyzing
network traffic.  It will run on most Unix and Linux variants.

tcpdump is prone to a remote buffer overflow condition which occurs when
handling malformed NFS packets.  This may allow a remote attacker to cause
process memory to be overwritten with arbitrary instructions, which will
be executed with the privileges of the tcpdump process.

It has not been established that this issue is exploitable to execute
arbitrary code, but it may result in a denial of service to tcpdump.

2. IBM Informix SE sqlexec Buffer Overflow Vulnerability
BugTraq ID: 4891
Remote: No
Date Published: May 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4891
Summary:

Informix is an enterprise database distributed and maintained by IBM.
Informix SE (Standard Engine) is distributed for Linux kernels 2.4.x on
the Intel platform.

Informix SE requires the use of two environment variables for execution,
INFORMIXDIR and INFORMIXSERVER. A buffer overflow condition common to
several Informix components is present when INFORMIXDIR is set to a value
of 2023 (or greater) characters.  The overflow is due to an unbounded
string copy of the INFORMIXDIR environment variable to a local buffer.

There is at least one setuid root executable through which this
vulnerability may be exploited, `sqlexec'.  A malicious user may exploit
the overflow condition in sqlexec to gain root privileges.

3. MNews Server Response Buffer Overflow Vulnerability
BugTraq ID: 4900
Remote: Yes
Date Published: May 31 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4900
Summary:

Mnews is a freely available, open source NNTP and mail client.  It is
designed to handle both Japanese and English character sets, and is
available for the Unix and Linux operating systems.

A problem with mnews could make it possible for a malicious server to
execute code.  The problem is in the handling of server responses.

Under some circumstances, it may be possible to exploit a buffer overflow
in mnews.  When a server sends a 200 response to a client, it may be
possible for the server to include enough data in the response to trigger
a buffer overflow.  This overflow could result in the overwriting of stack
memory, and the potential execution of attacker supplied instructions.

A 200 response from the server is indicative of the server being ready to
handle a session, and posting is allowed.  In the event that the server
sends a 200 response, and with the response an additional 770 bytes of
information, this could result in a potentially exploitable buffer
overflow.  The execution of code would occur with the privileges of the
mnews process, typically run by a local system user, and could result in
remote access to the system.

4. MNews Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 4899
Remote: No
Date Published: May 31 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4899
Summary:

Mnews is a freely available, open source NNTP and mail client.  It is
designed to handle both Japanese and English character sets, and is
available for the Unix and Linux operating systems.

It has been reported that MNews is vulnerable to several buffer overflow
conditions.  The vulnerability has been reported for MNews versions 1.22
and earlier.

MNews does not perform proper bounds checking several command line
arguments. The commandline flags in question are user supplied values for
the '-f', '-D', '-M', '-P' and '-n'.  By supplying strings of arbitrary
length in combination with one of these flags, an attacker could produce a
potentially exploitable buffer overflow.  This could result in local code
execution on the vulnerable system, and potential elevated privileges.

As well, MNews does not perform proper bounds checking on the environment
variables MAILSERVER and JNAMES. MNews performs unbounded string copying
of the MAILSERVER and JNAMES environment variables to local buffers and
excessively long values to the environment variables will cause the buffer
overflow condition.

5. Courier MTA Long Year Remote Resource Consumption Vulnerability
BugTraq ID: 4908
Remote: Yes
Date Published: Jun 01 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4908
Summary:

Courier MTA is a freely available, open source mail transport agent (MTA).
It is developed and maintained by Double Precison, Incorporated, and works
with various Unix and Linux Operating Systems.

A problem with Courier MTA could allow a remote denial of service.  The
problem is in the handling of large year fields in messages.

Under some circumstances, it may be possible to cause a denial of service
in the MTA.  The problem occurs when handling messages by users that
contain an excessively large year.  This bug could result in resource
consumption on the system using the affected MTA, and potentially a denial
of service.

When the MTA receives a mail with a year of large value, a problem in
program design causes the consumption of system resources.  The MTA will
seize 100% of the processor, and could remain in this state for a minute
or more.  By sending multiple malicious mails to an affected server, an
attacker could effectively interrupt the flow of email to and from the
server.

6. University Of Washington IMAP Arbitrary File Access Vulnerability
BugTraq ID: 4909
Remote: Yes
Date Published: Jun 01 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4909
Summary:

uw-imap is an open source Internet Message Access Protocol daemon.  It is
distributed and maintained by the University of Washington, and available
for most operating systems including Unix, Linux, and Microsoft Windows.

A feature in the daemon may make it possible for users to gain access to
unauthorized information.

By default, uw-imap allows users to view files on the system on which the
daemon runs.  The daemon allows users to view files that are normally
readable through a shell on the system with equivalent user privileges.

In configurations where users are not authorized shell access to a system,
but have a valid account from which to download mail via IMAP, a user may
be able to gain access to information on the server.  The feature enabled
by default that allows users to view files via the IMAP daemon could
result in information leakage on systems that depend on users not being
able to view files on the local system.

Disabling this feature on Microsoft Windows systems may present additional
problems.  By design, the software does not filter the '\\' symbol.

This could result in leakage of potentially sensitive information to an
unauthorized user.  It should be noted that this feature is not documented
in the literature distributed with the software.

7. Debian IN.UUCP Remote Buffer Overflow Vulnerability
BugTraq ID: 4910
Remote: Yes
Date Published: Jun 01 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4910
Summary:

in.uucpd is an authentication agent designed to work with the Unix-to-Unix
Copy Protocol (UUCP).

A problem with in.uucp could result in a remote denial of service, and
potentially code execution.

It has been reported that in.uucpd does not properly truncate strings
under some circumstances.  This problem could result in a buffer overflow
that could allow a user to deny service to the daemon.  Following the
crash of the daemon, a manual restart of the service would be required to
resume service.

As this problem is a memory management issue, it may also be possible to
overwrite portions of stack memory, and execute attacker-supplied
instructions.  In the event of an attacker exploiting this issue, code
would be executed with the privileges of the in.uucpd process.  This
possibility is unconfirmed.

8. Next Generation POSIX Threading Shared Memory Denial of Service Vulnerability
BugTraq ID: 4913
Remote: No
Date Published: Jun 03 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4913
Summary:

NGPT (Next Generation POSIX Threading) software implements shared memory
using the filesytem to store data.  It has been reported by the vendor
that this implementation may be exploited by local attackers to cause a
denial of service or perform 'spoofing' attacks.

Though no further details are available from the vendor, it is believed
that exploitation may involve creating 'fake' shared memory files or using
symbolic links.  Exploitation of shared-memory spoofing attacks may result
in a consequence that is application-dependent.  Elevation of privileges
may be possible.

The vulnerability existed in version 1.9.0 of the software.

9. Twibright Labs Links Large PNG Image Buffer Overflow Vulnerability
BugTraq ID: 4921
Remote: No
Date Published: Jun 03 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4921
Summary:

Twibright Labs' Links is a text based and graphical browser developed for
use with Linux and other Unix variant operating systems. Links version
2.0pre4 and earlier are vulnerable to a buffer overflow condition when
processing overly large 16-bit PNG images.

The vulnerability occurs in the 'make_gamma_table()' function in the file
dip.c. Checks are not made to account for large 16-bit PNG files. This
would cause a segmentation fault and crash the browser.

This potentially exploitable issue may enable an attacker to execute
arbitrary code as the user running the vulnerable client.  At the very
least, it is possible for a malicious webpage to cause the client to
crash, resulting in a denial of service.

The browser must be in graphics mode for this to be an issue.

10. Teekai's Tracking Online Cross-Site Scripting Vulnerability
BugTraq ID: 4924
Remote: Yes
Date Published: Jun 03 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4924
Summary:

Teekai's Tracking Online is a script for tracking website usage.  It is
written in PHP and will run on most Unix and Linux variants as well as
Microsoft Windows operating systems.

Teekai's Tracking Online does not adequately filter HTML tags from certain
URL parameters, making it prone to cross-site scripting attacks.
Attackers may exploit this by creating a malicious link to a vulnerable
webpage.  When a web user visits the malicious link, the attacker's script
code will be executed in their browser in the security context of the
website running the Tracking Online software.

11. Nullsoft SHOUTCast Remote Buffer Overflow Vulnerability
BugTraq ID: 4934
Remote: Yes
Date Published: Jun 04 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4934
Summary:

Nullsoft SHOUTCast Server is used to broadcast Shoutcast music. Remote
users known as DJs may connect to the server and supply data, which is
rebroadcast to other users. SHOUTcast Server is available for Windows,
Linux and a number of other Unix based platforms.

A remote buffer overflow vulnerability has been reported in some versions
of SHOUTCast Server. An authenticated DJ may supply oversized data to the
server, which will then overflow a memory buffer. Reportedly, it is
possible to corrupt sensitive information contained in the stack,
including a return address. As a result, exploitation of this
vulnerability can lead to the execution of arbitrary code as the server
process.

This vulnerability has been confirmed on SHOUTCast Server for Windows,
FreeBSD and Linux. Mac OS X and Solaris may also be vulnerable, this has
not however been confirmed.

12. Slurp SysLog Remote Format String Vulnerability
BugTraq ID: 4935
Remote: Yes
Date Published: Jun 04 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4935
Summary:

slurp is a freely available, open source NNTP client.  It is designed for
use on most Unix and Linux operating systems.

A problem with slurp could make it possible for a malicious server to
execute arbitrary code.

It may be possible for a remote server to execute code on a vulnerable
client.  slurp offers functionality that allows the software to write
messages to the system log.  A format string vulnerability in the syslog
function may allow a malicious server to supply a custom format string
that writes to an arbitrary address in memory.

By supplying a malicious 200 response to the client, the server could
execute code on the vulnerable client.  This code would be executed with
the privileges of the slurp user.

13. Ghostscript PostScript File Arbitrary Command Execution Vulnerability
BugTraq ID: 4937
Remote: No
Date Published: Jun 04 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4937
Summary:

Ghostscript is a freely available, open source software package for
rendering postscript and portable document format files.  It is available
for most Unix and Linux operating systems.

A problem with Ghostscript could make it possible to execute arbitrary
commands.

A problem has been discovered that may allow maliciously formatted
postscript files to execute arbitrary commands.  By using the .locksafe or
.setsafe functions of the package to reset the page device, an attacker
could execute arbitrary commands when the page is printed.

It should be noted that commands executed while the malicious postscript
file is being printed would be executed with the privileges of the print
service.  Typically, this is as the user lp.  This problem could allow a
remote attacker to gain access to the vulnerable system.


IV. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Snort vs. other (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

2. Linux Hardening (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/715CD64BB5629046B8C80A929D1B1B126B53B5@uul-wv.adelaide.cmst.csiro.au


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. StillSecure Border Guard
by Latis Networks
Platforms: Linux
Relevant URL:
http://www.latis.com/solutions.html
Summary:

StillSecure Border Guard is a security solution that enhances the
capabilities of your existing firewall and IDS. By actively connecting
these components, Border Guard provides real-time intrusion protection.
Once a security threat is detected, you can determine whether Border Guard
engages dynamic attack suppression, or sends alerts with recommendations
of appropriate actions for you to take.

2. BRICKServer
by SAGE
Platforms: Linux
Relevant URL:
http://www.thirdpig.com/brickserver.htm
Summary:

BRICKServer is a secure Web appliance featuring Process-Based security,
created for the sole purpose of protecting a website from Hackers.

3. CipherServer 440
by SSP Solutions
Platforms: Linux, Windows 2000
Relevant URL:
http://www.litronic.com/solutions/cipherserver.html
Summary:

The CipherServer 440 is specially designed to off-load the public key
functions to on-board processors, free up CPU resources and provide
instant responses back to the customer. Whether transactions need server
and/or client authentication, the CipherServer 440 accelerates SSL
transactions to handle multiple, simultaneous sessions for passing
information securely between the client and sever.

4. CSM Proxy
by SurfControl
Platforms: Linux, Windows NT
Relevant URL:
http://www.csm-usa.com/product/proxy/
Summary:

CSM Proxy is a full featured proxy and caching server, especially written
to handle the various demands of every network administrator. Support for
WebSENSE URL Filtering Virus Scanning (McAfee) Active-X Blocking JAVA
Blocking Support for Kansmen LittleBrother Internet Monitor Support for
Sequel Net Access Manager SMTP Command Filtering Support for SmartFilter
Control Lists News Filtering CARP Support (Caching Array Routing Protocol)
IMAP 4 Proxy Native News Proxy HTTP Cookie Filtering Socks 4 and Socks 5
proxy Inactivity Timeouts Connection Limits Automatic Site Replicator
(Probot) Automatic Netscape Proxy Configuration Remote Administration over
the Web User and Group Authentication User and Group extended Filtering
Reverse Proxy Altering Various User Settings Does NOT need a Webserver on
the same machine DNS Forwarding Native FTP Proxy HTTP Proxy with
integrated support for FTP with your browser, also SSL Tunneling and HTTPS
HTTP Caching (Reduces Internet Bandwidth up to 60%) HTTP Browser dependent
caching HTTP Cascading HTTP Domain & IP Address Filtering CERN compatible
Proxy POP3 Proxy Real Audio / Video Proxy Telnet Proxy TCP mapped Links
VDOLive Proxy Secure Channels with TCP mapped Links using SSL VPN's
(Virtual Privat Networks) Rules (for more Firewall capabilities) Remote
Watch Monitor Automatic dialing on demand Runs on Win95/98 & WinNT
workstation Runs as own System Service under NT Various logging
capabilities Log File Cycling Easy Configuration and Administration FTP
Caching


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Vexira Antivirus (Linux Server) v2
by Central Command, Inc. sales at centralcommand dot com
Relevant URL:
http://www.centralcommand.com/linux_server.html
Platforms: Linux, POSIX
Summary:

Vexira Antivirus is virus defense system. It can identify which files may
contain malicious code requiring further investigation, which greatly
increases virus scanning speed. It features the ability to scan files
automatically as they are accessed, configurable path protection, email
notification, blocking of access to infected files, options to repair,
rename, or delete infected files, automated Internet updating, virus scan
archives (.zip, .rar, gz, .tar, etc.), a commandline scanner, scalable
concurrent scanning, heuristic detection of new macro viruses, and low
system resource requirements.

2. Network Equipment Performance Monitor v0.90b1
by jimesh
Relevant URL:
http://www.nepm.net/
Platforms: AIX, FreeBSD, HP-UX, Linux, Solaris, True64 UNIX, UNIX, Windows
2000, Windows NT, Windows XP
Summary:

NEPM monitors and reports uptime, critical events and their predecessors,
access rates, bytes-served rates, and error rates for network node
equipment. Hardware and software elements within the nodes are tracked and
reported separately to make possible rapid fault isolation. It is a very
general, highly configurable, two-part software system that captures and
analyzes logged performance data from IP-networked equipment and reports
it via email and Web pages. Current conditions and history from systems
based on Windows NT/2000, Unix, and Unix-style operating systems can be
tracked and reported. Most major server, switch and router systems can be
monitored, without running agents on the target systems. NEPM itself is
system-independent and can be hosted on either a Unix or Win NT system or
a combination of these with equal ease.

3. bg perlyzer v0.1.0
by endrium
Relevant URL:
http://www.endrium.com/
Platforms: Linux, POSIX, Solaris, SunOS, UNIX
Summary:

bg perlyzer is a combination of scripts which parse Apache log files and
inserts them into a MySQL database. There is also a Web-based interface
which sorts, groups, and analyzes the log files based on any input.

4. openMosix Cluster for Linux v2.4.17
by Moshe Bar [email protected]
Relevant URL:
http://www.openmosix.org/
Platforms: Linux, POSIX
Summary:

openMosix is a a set of extensions to the standard Linux kernel allowing
you to build a cluster of out of off-the-shelf PC hardware. openMosix
scales perfectly up to thousands of nodes. You do not need to modify your
applications to benefit from your cluster (unlike PVM, MPI, Linda, etc.).
Processes in openMosix migrate transparently between nodes and the cluster
will always auto-balance.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml

-------------------------------------------------------------------------------