SecurityFocus Linux Newsletter #242

Peter Laborge <[email protected]> Tue, 05 Jul 2005 14:58:22 -0600
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #242
----------------------------------------

This Issue is Sponsored By: Black Hat

Attend the Black Hat Briefings & Training USA, July 23-28, 2005 in Las 
Vegas. World renowned security experts reveal tomorrow's threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your security environment. Featuring 29 hands-on training courses and 10 conference tracks, networking opportunities with over 2,000 delegates from 30+ nations. 

http://www.securityfocus.com/sponsor/BlackHat_sf-news_050705

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Rats in the security world
       2. Fighting EPO Viruses
       3. Who's to blame?
II.  LINUX VULNERABILITY SUMMARY
       1. RealNetworks Real and RealOne Player Unspecified MP3 ActiveX Control Execution Vulnerability
       2. Infradig Inframail Advantage Server Edition Multiple Remote Buffer Overflow Vulnerabilities
       3. PHPBB Viewtopic.PHP Remote Code Execution Vulnerability
       4. XML-RPC for PHP Remote Code Injection Vulnerability
       5. Clam Anti-Virus ClamAV Cabinet File Parsing Remote Denial Of Service Vulnerability
       6. Clam Anti-Virus ClamAV MS-Expand File Parsing Remote Denial Of Service Vulnerability
       7. Xoops XMLRPC Multiple SQL Injection Vulnerabilities
       8. Xoops Multiple Cross-Site Scripting Vulnerabilities
       9. Community Link Pro Login.CGI File Parameter Remote Command Execution Vulnerability
       10. Raven Software Soldier Of Fortune 2 Ignore Command Remote Denial of Service Vulnerability
       11. Crip Helper Script Insecure Temporary File Creation Vulnerability
       12. Drupal Arbitrary PHP Code Execution Vulnerability
       13. PADL Software PAM_LDAP TLS Plaintext Password Vulnerability
III. LINUX FOCUS LIST SUMMARY
       1. Apache issue
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Rats in the security world
By Mark Burnett
I say it's now time we took a step back and exterminated some of these rats.
http://www.securityfocus.com/columnists/336

2. Fighting EPO Viruses
By Piotr Bania
This short article describes the so-called Entry-Point Obscuring (EPO) virus coding technique, primarily through a direct analysis of the Win32.CTX.Phage virus.
http://www.securityfocus.com/infocus/1841

3. Who's to blame?
By Kelly Martin
If there's one thing the security industry is really good at, it's pointing fingers.
http://www.securityfocus.com/columnists/337


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. RealNetworks Real and RealOne Player Unspecified MP3 ActiveX Control Execution Vulnerability
BugTraq ID: 14073
Remote: Yes
Date Published: 2005-06-27
Relevant URL: http://www.securityfocus.com/bid/14073
Summary:
NGSSoftware report that a vulnerability affects RealPlayer for Windows. Reports indicate that the issue may be exploited to overwrite an arbitrary file or execute an ActiveX control using a specially formatted malicious MP3 file.

Details about this vulnerability have been withheld until a later date (Sep 27th, 2005). This BID will be updated as soon as this information is made available.


2. Infradig Inframail Advantage Server Edition Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 14077
Remote: Yes
Date Published: 2005-06-28
Relevant URL: http://www.securityfocus.com/bid/14077
Summary:
Infradig Inframail Advantage Server Edition is affected by multiple remote buffer overflow vulnerabilities.  These issues arise due to a lack of boundary checks performed by the application and may allow remote attackers to execute machine code in the context of the server process. 

The following specific issues were identified:

A remote buffer overflow vulnerability affects the FTP server component of Inframail Advantage Server Edition.

Another remote buffer overflow vulnerability affects the mail server component of Inframail Advantage Server Edition.

Infradig Inframail Advantage Server Edition 6.0 version 6.37 is reportedly affected by this issue.

3. PHPBB Viewtopic.PHP Remote Code Execution Vulnerability
BugTraq ID: 14086
Remote: Yes
Date Published: 2005-06-28
Relevant URL: http://www.securityfocus.com/bid/14086
Summary:
The 'viewtopic.php' phpBB script is prone to a remote PHP script injection vulnerability.  This issue is due to a failure of the application to properly sanitize user-supplied URI parameters before using them to construct dynamically generated web pages.

This issue may allow a remote attacker to execute arbitrary commands in the context of the web server that is hosting the vulnerable software.

4. XML-RPC for PHP Remote Code Injection Vulnerability
BugTraq ID: 14088
Remote: Yes
Date Published: 2005-06-29
Relevant URL: http://www.securityfocus.com/bid/14088
Summary:
XML-RPC for PHP is affected by a remote code injection vulnerability.

An attacker may exploit this issue to execute arbitrary commands or code in the context of the Web server.  This may facilitate various attacks including unauthorized remote access.

XML-RPC for PHP 1.1 and prior versions are affected by this issue.  Other applications using this library are also affected.


5. Clam Anti-Virus ClamAV Cabinet File Parsing Remote Denial Of Service Vulnerability
BugTraq ID: 14089
Remote: Yes
Date Published: 2005-06-29
Relevant URL: http://www.securityfocus.com/bid/14089
Summary:
A remote denial of service vulnerability affects ClamAV.  This issue is due to a failure of the application to properly handle malicious Cab file content.

An attacker may leverage this issue to crash the Clam Anti-Virus daemon, potentially leaving an affected computer open to infection by malicious code.

6. Clam Anti-Virus ClamAV MS-Expand File Parsing Remote Denial Of Service Vulnerability
BugTraq ID: 14090
Remote: Yes
Date Published: 2005-06-29
Relevant URL: http://www.securityfocus.com/bid/14090
Summary:
A remote denial of service vulnerability affects ClamAV.  This issue is due to a failure of the application to properly handle MS-Expand files.

An attacker may leverage this issue to cause the Clam Anti-Virus daemon to cease functioning correctly, leaving an affected computer open to infection by malicious code.

7. Xoops XMLRPC Multiple SQL Injection Vulnerabilities
BugTraq ID: 14094
Remote: Yes
Date Published: 2005-06-29
Relevant URL: http://www.securityfocus.com/bid/14094
Summary:
Xoops is prone to multiple SQL injection vulnerabilities.  These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

The vendor has addressed this issue in Xoops version 2.0.12; earlier versions are reported vulnerable.



8. Xoops Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 14096
Remote: Yes
Date Published: 2005-06-29
Relevant URL: http://www.securityfocus.com/bid/14096
Summary:
Xoops is prone to multiple cross-site scripting vulnerabilities.  These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site.  This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

The vendor has addressed these issues in Xoops version 2.0.12; earlier versions are reported vulnerable.


9. Community Link Pro Login.CGI File Parameter Remote Command Execution Vulnerability
BugTraq ID: 14097
Remote: Yes
Date Published: 2005-06-29
Relevant URL: http://www.securityfocus.com/bid/14097
Summary:
Community Link Pro is prone to a remote arbitrary command execution vulnerability.  This issue presents itself due to insufficient sanitization of user-supplied data. 

Due to this, an attacker can prefix arbitrary commands with the '|' character and have them executed in the context of the server.


10. Raven Software Soldier Of Fortune 2 Ignore Command Remote Denial of Service Vulnerability
BugTraq ID: 14098
Remote: Yes
Date Published: 2005-06-29
Relevant URL: http://www.securityfocus.com/bid/14098
Summary:
A remote denial of service vulnerability affects Raven Software Soldier Of Fortune 2.

The problem presents itself specifically when the affected server application receives an excessively large value through a '/ignore' command from a malicious client.

An attacker may leverage this issue to cause an affected server to crash, denying service to legitimate users.

11. Crip Helper Script Insecure Temporary File Creation Vulnerability
BugTraq ID: 14105
Remote: No
Date Published: 2005-06-30
Relevant URL: http://www.securityfocus.com/bid/14105
Summary:
The crip helper scripts create temporary files in an insecure manner.  An attacker will local access could potentially exploit this issue to overwrite files in the context of the application.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack.  There is also an unconfirmed potential for privilege escalation if the attacker can write custom data in the attack.

This issue is known to affect crip 3.5.  Other releases may also be affected.

12. Drupal Arbitrary PHP Code Execution Vulnerability
BugTraq ID: 14110
Remote: Yes
Date Published: 2005-06-30
Relevant URL: http://www.securityfocus.com/bid/14110
Summary:
Drupal is prone to a vulnerability that permits the execution of arbitrary PHP code.  This issue is due to a failure in the application to properly sanitize user-supplied input.

The application's filter mechanism fails to properly sanitize user-supplied input to 'comments' and 'postings'.

The vendor has addressed this issue in Drupal versions 4.6.2 and 4.5.4; earlier versions are reported vulnerable.



13. PADL Software PAM_LDAP TLS Plaintext Password Vulnerability
BugTraq ID: 14126
Remote: Yes
Date Published: 2005-07-01
Relevant URL: http://www.securityfocus.com/bid/14126
Summary:
PAM_LDAP is affected by a password disclosure vulnerability when used with TLS.

This issue arises when a connection to a slave is established using TLS and the client is referred to a master.  TLS is not used with this connection, which can allow an attacker to sniff network traffic and obtain user credentials.

PAM_LDAP build 166 is known to be vulnerable at the moment. Other versions may be affected as well.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Apache issue
http://www.securityfocus.com/archive/91/403019

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website. 

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: Black Hat

Attend the Black Hat Briefings & Training USA, July 23-28, 2005 in Las 
Vegas. World renowned security experts reveal tomorrow's threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your security environment. Featuring 29 hands-on training courses and 10 conference tracks, networking opportunities with over 2,000 delegates from 30+ nations. 

http://www.securityfocus.com/sponsor/BlackHat_sf-news_050705