SecurityFocus Linux Newsletter #240

Peter Laborge <[email protected]> Tue, 21 Jun 2005 14:11:24 -0600

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #240
----------------------------------------

This Issue is Sponsored By: Black Hat

Attend the Black Hat Briefings & Training USA, July 23-28, 2005 in Las
Vegas. World renowned security experts reveal tomorrow's threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your security environment. Featuring 29 hands-on training courses and 10 conference tracks, networking opportunities with over 2,000 delegates from 30+ nations.

http://www.securityfocus.com/sponsor/BlackHat_sf-news_050621

------------------------------------------------------------------
I. FRONT AND CENTER
1. Interview with Marcus Ranum
2. Your fingerprints are everywhere
3. Software Firewalls: Made of Straw? Part 2 of 2
II. LINUX VULNERABILITY SUMMARY
1. RedHat Linux SysReport Proxy Information Disclosure Vulnerability
2. Multiple Vendor Telnet Client Remote Information Disclosure Vulnerability
3. Sun Java Web Start Unspecified Privilege Escalation Vulnerability
4. Iron Bars Shell Multiple Unspecified Buffer Overflow Vulnerabilities
5. Sun Java Runtime Environment Unspecified Privilege Escalation Vulnerability
6. ViRobot Linux Server Remote Buffer Overflow Vulnerability
7. PAFileDB Multiple Input Validation Vulnerabilities
8. Opera Web Browser Cross-Site Scripting Local File Disclosure Vulnerability
9. Opera Web Browser XMLHttpRequest Object Cross-Domain Access Vulnerability
10. Ultimate PHP Board Multiple Cross-Site Scripting Vulnerabilities
11. SquirrelMail Multiple Unspecified Cross-Site Scripting Vulnerabilities
12. Ultimate PHP Board Weak Password Encryption Vulnerability
13. SpamAssassin Malformed Email Header Remote Denial Of Service Vulnerability
14. SuSE Linux GPG2 S/MIME Signing Unspecified Vulnerability
15. Yaws Remote Source Code Disclosure Vulnerability
16. XAMMP Lang.PHP HTML Injection Vulnerability
17. XAMMP Lang.PHP Directory Traversal Vulnerability
18. Vipul Razor-agents Multiple Unspecified Denial Of Service Vulnerability
19. JBoss Malformed HTTP Request Remote Information Disclosure Vulnerability
III. LINUX FOCUS LIST SUMMARY
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Interview with Marcus Ranum
By Federico Biancuzzi
Could you introduce yourself?
http://www.securityfocus.com/columnists/334

2. Your fingerprints are everywhere
By Scott Granneman
How much do you trust your government? That's a question that all of us have to ask, perhaps the more often the better.
http://www.securityfocus.com/columnists/333

3. Software Firewalls: Made of Straw? Part 2 of 2
By Israel G. Lugo, Don Parker
In part two we look at how easily the firewall's operation can be circumvented by inserting a malicious Trojan into the network stack itself.
http://www.securityfocus.com/infocus/1840

II. LINUX VULNERABILITY SUMMARY
------------------------------------
1. RedHat Linux SysReport Proxy Information Disclosure Vulnerability
BugTraq ID: 13936
Remote: Yes
Date Published: 2005-06-13
Relevant URL: http://www.securityfocus.com/bid/13936
Summary:
Sysreport is susceptible to an information disclosure vulnerability. This issue is due to a failure of the application to ensure that sensitive information is not included in its generated reports.

This vulnerability may result in sending unencrypted proxy authentication usernames and passwords to potentially malicious people. This may aid them in further attacks.

2. Multiple Vendor Telnet Client Remote Information Disclosure Vulnerability
BugTraq ID: 13940
Remote: Yes
Date Published: 2005-06-14
Relevant URL: http://www.securityfocus.com/bid/13940
Summary:
Telnet clients provided by multiple vendors are susceptible to a remote information disclosure vulnerability.

Any information stored in the environment of clients utilizing the affected telnet application is available for attackers to retrieve. The contents of the environment variables may be sensitive in nature, allowing attackers to gain information that may aid them in further system compromise.

3. Sun Java Web Start Unspecified Privilege Escalation Vulnerability
BugTraq ID: 13945
Remote: Yes
Date Published: 2005-06-14
Relevant URL: http://www.securityfocus.com/bid/13945
Summary:
Sun Java Web Start is susceptible to an unspecified privilege escalation vulnerability.

This vulnerability allows remote, untrusted Java applications to gain elevated privileges. This allows them to read or write local files, or to execute arbitrary local applications. These actions are normally forbidden for untrusted applications running in the Java virtual machine.

Further details are not available at this time. This BID will be updated as further information is disclosed.

4. Iron Bars Shell Multiple Unspecified Buffer Overflow Vulnerabilities
BugTraq ID: 13957
Remote: No
Date Published: 2005-06-14
Relevant URL: http://www.securityfocus.com/bid/13957
Summary:
Multiple unspecified buffer overflow vulnerabilities affect Iron Bars Shell. These issues are due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

The details currently available regarding these issues are insufficient to provide an accurate technical description. It can be speculated that these issues may be leveraged by an attacker to gain escalated privileges on a local machine.

An attacker may leverage these issues to execute instructions with the privileges of the affected application.

5. Sun Java Runtime Environment Unspecified Privilege Escalation Vulnerability
BugTraq ID: 13958
Remote: Yes
Date Published: 2005-06-14
Relevant URL: http://www.securityfocus.com/bid/13958
Summary:
Sun Java Runtime Environment is susceptible to an unspecified privilege escalation vulnerability.

Further details are not available at this time. This BID will be updated as further information is disclosed.

6. ViRobot Linux Server Remote Buffer Overflow Vulnerability
BugTraq ID: 13964
Remote: Yes
Date Published: 2005-06-15
Relevant URL: http://www.securityfocus.com/bid/13964
Summary:
ViRobot Linux Server is prone to a remote buffer overflow vulnerability affecting the Web based management interface. This issue presents itself because the application fails to perform boundary checks prior to copying user-supplied data into sensitive process buffers.

An attacker can unauthorized access to a vulnerable computer by supplying malformed values through cookies. This issue can lead to a complete compromise.

ViRobot Linux Server 2.0 is vulnerable to this issue. Other versions may be affected as well.

7. PAFileDB Multiple Input Validation Vulnerabilities
BugTraq ID: 13967
Remote: Yes
Date Published: 2005-06-15
Relevant URL: http://www.securityfocus.com/bid/13967
Summary:
paFileDB is prone to multiple input validation vulnerabilities. The following issues are reported:

Multiple SQL injection issues exist in paFileDB.

The impact of these issues will vary depending on features supported by the database implementation but may be limited due to the nature of affected queries.

Multiple cross-site scripting issues are also reported when passing user-supplied arguments to the 'sortby', 'filelist', and 'pages' parameters of the 'pafiledb.php' script.

Exploitation of these issues may allow for compromise of the software, session hijacking, or attacks against the underlying database.

Finally, paFileDB is prone to a file disclosure vulnerability. The 'action' parameter of the 'pafiledb.php' script is affected by the vulnerability.

8. Opera Web Browser Cross-Site Scripting Local File Disclosure Vulnerability
BugTraq ID: 13969
Remote: Yes
Date Published: 2005-06-16
Relevant URL: http://www.securityfocus.com/bid/13969
Summary:
Opera Web Browser is affected by a cross-site scripting vulnerability that can be leveraged to disclose local files as well.

Attackers may steal cookie-based authentication credentials, disclose local files in the context of the browser and carry out other attacks.

Opera Web Browser version 8.0 is prone to this issue.

9. Opera Web Browser XMLHttpRequest Object Cross-Domain Access Vulnerability
BugTraq ID: 13970
Remote: Yes
Date Published: 2005-06-16
Relevant URL: http://www.securityfocus.com/bid/13970
Summary:
Opera Web Browser is prone to an issue that allows a violation of the cross-domain security model.

This issue arises due to an access validation error affecting the 'XMLHttpRequest' object.

Successful exploitation may result in cookie theft, content manipulation, information disclosure or other attacks.

Opera Web Browser version 8.0 is prone to this issue.

10. Ultimate PHP Board Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 13971
Remote: Yes
Date Published: 2005-06-16
Relevant URL: http://www.securityfocus.com/bid/13971
Summary:
Ultimate PHP Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

11. SquirrelMail Multiple Unspecified Cross-Site Scripting Vulnerabilities
BugTraq ID: 13973
Remote: Yes
Date Published: 2005-06-16
Relevant URL: http://www.securityfocus.com/bid/13973
Summary:
SquirrelMail is affected by multiple unspecified cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

12. Ultimate PHP Board Weak Password Encryption Vulnerability
BugTraq ID: 13975
Remote: Yes
Date Published: 2005-06-16
Relevant URL: http://www.securityfocus.com/bid/13975
Summary:
Ultimate PHP Board is prone to a weak password encryption vulnerability. This issue is due to a failure of the application to protect passwords with a sufficiently effective encryption scheme.

This issue may allow a malicious user to gain access to user and administrator passwords for the affected application.

13. SpamAssassin Malformed Email Header Remote Denial Of Service Vulnerability
BugTraq ID: 13978
Remote: Yes
Date Published: 2005-06-17
Relevant URL: http://www.securityfocus.com/bid/13978
Summary:
SpamAssassin is prone to a remote denial of service vulnerability. This issue is due to a failure of the application to properly handle overly long email headers.

Further details regarding this vulnerability are currently not available. This BID will be updated as more information is disclosed.

An attacker may cause SpamAssassin to take inordinate amounts of time to check a specially crafted email message. By sending many malicious messages, it may be possible for attackers to cause extremely large delays in email delivery, denying service to legitimate users.

14. SuSE Linux GPG2 S/MIME Signing Unspecified Vulnerability
BugTraq ID: 13980
Remote: Yes
Date Published: 2005-06-17
Relevant URL: http://www.securityfocus.com/bid/13980
Summary:
SuSE Linux is affected by an unspecified vulnerability related to S/MIME signing using gpg2. The cause and impact of this issue is currently unknown.

Due to a lack of details, it cannot be confirmed whether this issue poses a security threat or results in an adverse affect on the functionality of the application. It is conjectured that this issue is remote in nature.

SUSE Linux 9.3 is affected by this issue.

15. Yaws Remote Source Code Disclosure Vulnerability
BugTraq ID: 13981
Remote: Yes
Date Published: 2005-06-17
Relevant URL: http://www.securityfocus.com/bid/13981
Summary:
A vulnerability has been reported in Yaws that may result in the disclosure of script files' source code.

Information obtained in this manner may be used by the attacker to launch further attacks against a vulnerable system.

Yaws 1.55 and prior versions are affected.

16. XAMMP Lang.PHP HTML Injection Vulnerability
BugTraq ID: 13982
Remote: Yes
Date Published: 2005-06-17
Relevant URL: http://www.securityfocus.com/bid/13982
Summary:
XAMMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

This issue is reported to affect the Linux distribution of XAMMP.

17. XAMMP Lang.PHP Directory Traversal Vulnerability
BugTraq ID: 13983
Remote: Yes
Date Published: 2005-06-17
Relevant URL: http://www.securityfocus.com/bid/13983
Summary:
XAMMP is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

A remote unauthorized user can disclose the contents of arbitrary local PHP scripts through the use of directory traversal strings '../'. Exploitation of this vulnerability could lead to a loss of confidentiality.

This issue is reported to affect the Linux distribution of XAMMP.

18. Vipul Razor-agents Multiple Unspecified Denial Of Service Vulnerability
BugTraq ID: 13984
Remote: Yes
Date Published: 2005-06-17
Relevant URL: http://www.securityfocus.com/bid/13984
Summary:
Vipul Razor-agents is prone to multiple unspecified denial of service vulnerabilities. The following issues are reported:

The first denial of service vulnerability exists in the discovery logic of Razor-agents.

The second issue exists in the preprocessing code of Razor-agents.

Both issues may be exploited to cause a denial of service for the vulnerable application.

19. JBoss Malformed HTTP Request Remote Information Disclosure Vulnerability
BugTraq ID: 13985
Remote: Yes
Date Published: 2005-06-17
Relevant URL: http://www.securityfocus.com/bid/13985
Summary:
JBoss is prone to a remote information disclosure vulnerability. The issue exists in the 'org.jboss.web.WebServer' class and is due to a lack of sufficient sanitization of user-supplied request data.

Information that is harvested through leveraging of this issue may be used to aid in further attacks that are launched against the affected service.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V. SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: Black Hat

http://www.securityfocus.com/sponsor/BlackHat_sf-news_050621