SecurityFocus Linux Newsletter #237

SecurityFocus Linux Newsletter #237
------------------------------------

Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------------
I. FRONT AND CENTER
     1. Is Deleting Spyware A Crime?
     2. Chrooted Snort on Solaris
     3. Sit Back and React
II. LINUX VULNERABILITY SUMMARY
     1. PServ Symbolic Link Information Disclosure Vulnerability
     2. PostNuke Blocks Module Directory Traversal Vulnerability
     3. PServ Remote Source Code Disclosure Vulnerability
     4. Mozilla Suite And Firefox Multiple Script Manager Security B...
     5. Pserv Directory Traversal Vulnerability
     6. Mozilla Suite And Firefox DOM Property Overrides Code Execut...
     7. Pserv completedPath Remote Buffer Overflow Vulnerability
     8. Multiple Linux Kernel IOCTL Handlers Local Memory Corruption...
     9. bzip2 Remote Denial of Service Vulnerability
     10. MySQL mysql_install_db Insecure Temporary File Creation Vuln...
     11. Cheetah Local Privilege Escalation Vulnerability
     12. Linux Kernel 64 Bit EXT3 Filesystem Extended Attribute Denia...
     13. PPXP Local Privilege Escalation Vulnerability
     14. NetWin SurgeMail Multiple Unspecified Input Validation Vulne...
     15. GDB Multiple Vulnerabilities
     16. Gedit Filename Format String Vulnerability
     17. ImageMagick And GraphicsMagick XWD Decoder Denial Of Service...
III. LINUX FOCUS LIST SUMMARY
     1. Secure Kickstart Installation (Thread)
     2. Bind cache availability... (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. CoreGuard Core Security System
     2. EnCase Forensic Edition
     3. KeyGhost SX
     4. SafeKit
     5. Astaro Linux Firewall
     6. CAT Cellular Authentication Token and eAuthentication Servic...
V. NEW TOOLS FOR LINUX PLATFORMS
     1. webcvtsa 0.0.8
     2. Umbrella v0.6
     3. Kernel Socks Bouncer 2.6.11
     4. NuFW 1.0.0
     5. ldaupenum 0.02alpha
     6. File System Saint 1.02a
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Is Deleting Spyware A Crime?
By Mark Rasch
The murky waters that sustain the spyware companies may have a few
unpleasant surprises just beneath the surface.
http://www.securityfocus.com/columnists/329

2. Chrooted Snort on Solaris
By Andre Lue-Fook-Sang
This article discussed installation and configuration of a chrooted Snort
IDS on most versions of Solaris.
http://www.securityfocus.com/infocus/1833

3. Sit Back and React
By Daniel Hanson
As the security industry moves more mainstream, it's becoming stagnant due
to a lack of vision. Who will lead the charge?
http://www.securityfocus.com/columnists/328

II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. PServ Symbolic Link Information Disclosure Vulnerability
BugTraq ID: 13634
Remote: No
Date Published: May 16 2005
Relevant URL: http://www.securityfocus.com/bid/13634
Summary:
pServ is prone to an information disclosure vulnerability through symbolic link files.  This occurs because the application will follow symbolic links to files outside the Web root.

This issue was reported to affect pServ 3.2 and 3.3; other versions are likely vulnerable.

2. PostNuke Blocks Module Directory Traversal Vulnerability
BugTraq ID: 13636
Remote: Yes
Date Published: May 16 2005
Relevant URL: http://www.securityfocus.com/bid/13636
Summary:
PostNuke Blocks module is affected by a directory traversal vulnerability. 

The problem presents itself when an attacker passes a name for a target file, along with directory traversal sequences, to the affected application.

An attacker may leverage this issue to disclose arbitrary files on an affected computer.  It was also reported that an attacker can supply NULL bytes with a target file name.  This may aid in other attacks such as crashing the server.

3. PServ Remote Source Code Disclosure Vulnerability
BugTraq ID: 13638
Remote: Yes
Date Published: May 16 2005
Relevant URL: http://www.securityfocus.com/bid/13638
Summary:
pServ is affected by a remote source code disclosure vulnerability.

When handling a specially-crafted URI request, the application discloses the source code of scripts in the 'cgi-bin' directory.

Information gathered through this attack could be used to launch further attacks against a system.

4. Mozilla Suite And Firefox Multiple Script Manager Security B...
BugTraq ID: 13641
Remote: Yes
Date Published: May 16 2005
Relevant URL: http://www.securityfocus.com/bid/13641
Summary:
Multiple issues exist in Mozilla Suite and Firefox. These issues allow attackers to bypass security checks in the script security manager.

Security checks in the script security manager are designed to prevent script injection vulnerabilities.

An attacker sending certain undisclosed JavaScript in 'view-source:', and 'jar:' pseudo protocol URIs, may bypass these security checks.

An undisclosed, nested URI, as well as a variant of BID 13216 are reportedly also able to bypass security checks.

These vulnerabilities allow remote attackers to execute script code with elevated privileges, leading to the installation and execution of malicious applications on an affected computer. Cross-site scripting, and other attacks are also likely possible.

The vendor has not provided enough information to determine how many specific instances of the issue were addressed, and has not clarified whether or not they have addressed a single general vulnerability or multiple specific vulnerabilities. This BID may be split into its separate issues as further information is disclosed.

Further details are scheduled to be released in the future. This BID will be updated at that time.

5. Pserv Directory Traversal Vulnerability
BugTraq ID: 13642
Remote: Yes
Date Published: May 16 2005
Relevant URL: http://www.securityfocus.com/bid/13642
Summary:
pServ is prone to a directory traversal vulnerability.  This occurs because the application does not implement a proper method for filtering directory traversal sequences from URIs.  Since this can be done from the cgi-bin directory, it is possible to execute commands to which the Web server has permission.

This issue was reported to affect pServ version 3.2; earlier versions are like vulnerable.

6. Mozilla Suite And Firefox DOM Property Overrides Code Execut...
BugTraq ID: 13645
Remote: Yes
Date Published: May 16 2005
Relevant URL: http://www.securityfocus.com/bid/13645
Summary:
Mozilla Suite and Mozilla Firefox are affected by a code execution vulnerability.  This issue is due to a failure in the application to properly verify Document Object Model (DOM) property values.

An attacker may leverage this issue to execute arbitrary code with the privileges of the user that activated the vulnerable Web browser, ultimately facilitating a compromise of the affected computer.

This issue is reportedly a variant of BID 13233. Further details are scheduled to be released in the future, and this BID will be updated accordingly.

7. Pserv completedPath Remote Buffer Overflow Vulnerability
BugTraq ID: 13648
Remote: Yes
Date Published: May 16 2005
Relevant URL: http://www.securityfocus.com/bid/13648
Summary:
pServ is prone to a remotely exploitable buffer overflow vulnerability.  The issue occurs because proper boundary checks are not performed allowing an internal buffer to be overrun.  This vulnerability could potentially be exploited to execute arbitrary code in the context of the Web server.

This issue was fixed in pServ 3.3; earlier versions are likely vulnerable.

8. Multiple Linux Kernel IOCTL Handlers Local Memory Corruption...
BugTraq ID: 13651
Remote: No
Date Published: May 17 2005
Relevant URL: http://www.securityfocus.com/bid/13651
Summary:
The Linux kernel raw device and pktcdvd block device ioctl handlers are reported prone to local kernel-based memory corruption vulnerabilities. The issues manifest due to a lack of sanity checks performed on argument values that are passed to the 'raw_ioctl()' and 'pkt_ioctl()' functions.

A local attacker, that has read access to a sufficient block device, may leverage this memory corruption to execute arbitrary attacker-supplied code in the context of the system kernel (ring-0).

9. bzip2 Remote Denial of Service Vulnerability
BugTraq ID: 13657
Remote: Yes
Date Published: May 17 2005
Relevant URL: http://www.securityfocus.com/bid/13657
Summary:
bzip2 is prone to a remote denial of service vulnerability.  This issue arises when the application processes malformed archives. 

A successful attack can result in resource exhaustion and trigger a denial of service condition.

bzip2 version 1.0.2 is reportedly affected by this issue.  Other version are likely vulnerable as well.

10. MySQL mysql_install_db Insecure Temporary File Creation Vuln...
BugTraq ID: 13660
Remote: No
Date Published: May 17 2005
Relevant URL: http://www.securityfocus.com/bid/13660
Summary:
MySQL is reportedly affected by a vulnerability that can allow local attackers to gain unauthorized access to the database or gain elevated privileges.  This issue results from a design error due to the creation of temporary files in an insecure manner.

The vulnerability affects the 'mysql_install_db' script.

Due to the nature of the script it may be possible to create database accounts or gain elevated privileges.

MySQL versions prior to 4.0.12 and MySQL 5.x releases 5.0.4 and prior versions are reported to be affected.

11. Cheetah Local Privilege Escalation Vulnerability
BugTraq ID: 13662
Remote: No
Date Published: May 17 2005
Relevant URL: http://www.securityfocus.com/bid/13662
Summary:
Cheetah is prone to a local privilege escalation vulnerability.

The issue arises because the application imports modules from the '/tmp' directory before searching for the path from the 'PYTHONPATH' variable.

This can result in arbitrary code execution granting elevated privileges to an attacker.

Cheetah versions prior to 0.9.17-rc1 are affected by this issue.

12. Linux Kernel 64 Bit EXT3 Filesystem Extended Attribute Denia...
BugTraq ID: 13680
Remote: No
Date Published: May 19 2005
Relevant URL: http://www.securityfocus.com/bid/13680
Summary:
The Linux Kernel is prone to a local denial of service vulnerability. Reports indicate the issue manifests on 64-bit platforms and is because of a flaw present in offset handling for the extended attribute file system code.

A local attacker may trigger this issue to crash the system kernel.

13. PPXP Local Privilege Escalation Vulnerability
BugTraq ID: 13681
Remote: No
Date Published: May 19 2005
Relevant URL: http://www.securityfocus.com/bid/13681
Summary:
ppxp is prone to a local privilege escalation vulnerability.  An attacker may abuse the issue to open a shell with superuser privileges.

14. NetWin SurgeMail Multiple Unspecified Input Validation Vulne...
BugTraq ID: 13689
Remote: Yes
Date Published: May 19 2005
Relevant URL: http://www.securityfocus.com/bid/13689
Summary:
Multiple unspecified vulnerabilities affect SurgeMail. Reportedly, these issues are due to a failure of the application to properly sanitize user-supplied input prior to employing it in critical locations including dynamic content.  A successful attack may allow attackers to execute arbitrary HTML and script code in a user's browser.

SurgeMail 3.0c2 is reported to be affected by these issues.  Other versions may be vulnerable as well.

Due to a lack of details, further information cannot be provided at the moment.  This BID will be updated when more details are available.

15. GDB Multiple Vulnerabilities
BugTraq ID: 13697
Remote: Yes
Date Published: May 20 2005
Relevant URL: http://www.securityfocus.com/bid/13697
Summary:
GDB is reportedly affected by multiple vulnerabilities.  These issues can allow an attacker to execute arbitrary code and commands on an affected computer.  A successful attack may result in the attacker gaining elevated privileges or unauthorized access.

The following specific issues were identified:

The application is affected by a remote heap overflow vulnerability when loading malformed object files.

Another vulnerability affecting the application may allow local attackers to gain elevated privileges.

GDB 6.3 is reportedly affected by these issues.  Other versions are likely vulnerable as well.

16. Gedit Filename Format String Vulnerability
BugTraq ID: 13699
Remote: Yes
Date Published: May 30 2005
Relevant URL: http://www.securityfocus.com/bid/13699
Summary:
gEdit is prone to a format string vulnerability.  Exploitation may occur when the program is invoked with a filename that includes malicious format specifiers.  This issue could be exploited to corrupt arbitrary regions of memory with attacker-supplied data, potentially resulting in execution of arbitrary code in the context of the user running the program.

17. ImageMagick And GraphicsMagick XWD Decoder Denial Of Service...
BugTraq ID: 13705
Remote: Yes
Date Published: May 21 2005
Relevant URL: http://www.securityfocus.com/bid/13705
Summary:
A remote, client-side denial of service vulnerability affects ImageMagick and GraphicsMagick.  This issue is due to a failure of the application to handle malformed XWD image files.

A remote attacker may leverage this issue to cause the affected application to enter into an infinite loop condition, consuming CPU resources on the affected computer, denying service to legitimate users.

III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Secure Kickstart Installation (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/398817

2. Bind cache availability... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/398739

IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. CoreGuard Core Security System
By: Vormetric
Platforms: AIX, Linux, Solaris, Windows 2000, Windows XP
Relevant URL: http://www.vormetric.com/products/#overview
Summary: 

CoreGuard System profile

The CoreGuard System is the industry's first solution that enforces
acceptable use policy for sensitive digital information assets and
protects personal data privacy across an enterprise IT environment.
CoreGuard's innovative architecture and completeness of technology
provide a comprehensive, extensible solution that tightly integrates all
the elements required to protect information across a widespread,
heterogeneous enterprise network, while enforcing separation of duties
between security and IT administration. At the same time, CoreGuard is
transparent to users, applications and storage infrastructures for ease
of deployment and system management.

CoreGuard enables customers to:
* Protect customer personal data privacy and digital information assets 
* Protect data at rest from unauthorized viewing by external attackers
and unauthorized insiders
* Enforce segregation of duties between IT administrators and security
administration
* Ensure host & application integrity * Block malicious code, including
zero-day exploits

2. EnCase Forensic Edition
By: Guidance Software Inc.
Platforms: DOS, FreeBSD, Linux, MacOS, NetBSD, OpenBSD, PalmOS, Solaris, UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.guidancesoftware.com/products/EnCaseForensic/index.shtm
Summary: 

EnCase Forensic Edition Version 4 delivers the most advanced features for computer forensics and investigations. With an intuitive GUI and superior performance, EnCase Version 4 provides investigators with the tools to conduct large-scale and complex investigations with accuracy and efficiency. Guidance Software?s award winning solution yields completely non-invasive computer forensic investigations while allowing examiners to easily manage large volumes of computer evidence and view all relevant files, including "deleted" files, file slack and unallocated space. 

The integrated functionality of EnCase allows the examiner to perform all functions of the computer forensic investigation process. EnCase's EnScript, a powerful macro-programming language and API included within EnCase, allows investigators to build customized and reusable forensic scripts.

3. KeyGhost SX
By: KeyGhost Ltd
Platforms: BeOS, DOS, Linux, OS/2, Solaris, SunOS, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.keyghost.com/SX/
Summary: 

KeyGhost SX discreetly captures and records all keystrokes typed, including chat conversations, email, word processor, or even activity within an accounting or specialist system. It is completely undetectable by software scanners and provides you with one of the most powerful stealth surveillance applications offered anywhere. 

Because KeyGhost uses STRONG 128-Bit encryption to store the recorded data in it?s own internal memory (not on the hard drive), it is impossible for a network intruder to gain access to any sensitive data stored within the device.

4. SafeKit
By: Evidian Inc.
Platforms: AIX, HP-UX, Linux, Solaris, Windows 2000
Relevant URL: http://www.evidian.com/safekit/index.htm
Summary: 

Evidian's SafeKit technology makes it possible to render any application available 24 hours per day. With no extra hardware: just use your existing servers and install this software-only solution.

This provides ultimate scalability. As your needs grow, all you need to do is add more standard servers into the cluster. With the load balancing features of SafeKit, you can distribute applications over multiple servers. If one system fails completely, the others will continue to serve your users.

5. Astaro Linux Firewall
By: Astaro
Platforms: Linux
Relevant URL: http://www.astaro.com/php/statics.php?action=asl&lang=gb
Summary: 

Astaro Linux Firewall: All-in-one firewall, virus protection, content filtering and spam protection internet security software package for Linux. 
Free download for home users.

6. CAT Cellular Authentication Token and eAuthentication Servic...
By: Mega AS Consulting Ltd
Platforms: Java, Linux, OpenBSD, Os Independent, SecureBSD, Solaris, UNIX, Windows 2000, Windows NT
Relevant URL: http://www.megaas.co.nz
Summary: 

Low cost, easy to use Two Factor Authentication One Time Password token using the Cellular. Does not use SMS or communication, manages multiple OTP accounts - new technology. For any business that want a safer access to its Internet Services. More information at our site.
 
We also provide eAuthentication service for businesses that will not buy an Authentication product but would prefer to pay a monthly charge for authentication services from our our CAT Server.

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. webcvtsa 0.0.8
By: Paolo Ardoino
Relevant URL: http://cvtsa.sourceforge.net/http://cvtsa.sourceforge.net/
Platforms: Linux
Summary: 

WEBCVTSA is a tool that allows users to administrate their computers [running GNU/Linux] using a form on a web page to post commands.

2. Umbrella v0.6
By: Umbrella
Relevant URL: http://umbrella.sourceforge.net/
Platforms: Linux
Summary: 

Umbrella is a security mechanism that implements a combination of Process-Based Access Control (PBAC) and authentication of binaries through Digital Signed Binaries (DSB). The scheme is designed for Linux-based consumer electronic devices ranging from mobile phones to settop boxes.

Umbrella is implemented on top of the Linux Security Modules (LSM) framework. The PBAC scheme is enforced by a set of restrictions on each process.

3. Kernel Socks Bouncer 2.6.11
By: Paolo Ardoino
Relevant URL: http://ksb.sourceforge.net/
Platforms: Linux
Summary: 

Kernel Socks Bouncer is a Linux Kernel 2.6.x patch that redirects tcp connections [SSH, telnet, browsers...] to follow through socks5. KSB26 uses a character device to pass socks5 and target ips to the Linux Kernel.

4. NuFW 1.0.0
By: INL
Relevant URL: http://www.nufw.org
Platforms: Linux
Summary: 

NuFW performs an authentication of every single connections passing through the IP filter, by transparently requesting user's credentials before any filtering decision is taken. Practically, this brings the notion of user ID down to the IP layers.

5. ldaupenum 0.02alpha
By: Roni Bachar & Sol Zehnwirth
Relevant URL: https://sourceforge.net/projects/ldapenum
Platforms: Linux, Perl (any system supporting perl), Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary: 

ldapenum is a perl script designed to enumerate system and password information from domain controllers using the LDAP service when IPC$ is locked. The script has been tested on windows and linux.

6. File System Saint 1.02a
By: Joshua Fritsch
Relevant URL: http://www.unixgeeks.org/saint
Platforms: Linux, UNIX
Summary: 

A fast, flexible, lightweight perl-based host IDS.

VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website. 

If your email address has changed email [email protected] and ask to be manually removed. 
    
VII. SPONSOR INFORMATION
-----------------------

Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------------