SecurityFocus Linux Newsletter #244

Peter Laborge <[email protected]> Tue, 26 Jul 2005 16:28:20 -0600
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #244
----------------------------------------

This Issue is Sponsored By: AirDefense

FREE WHITE PAPER - Wireless LAN Security: What Hackers Know That You Don't
Learn the hacker's secrets that compromise wireless LANs. Secure your
WLAN by understanding these threats, available hacking tools and proven
countermeasures. Defend your WLAN against man-in-the-Middle attacks and
session hijacking, denial-of-service, rogue access points, identity
thefts and MAC spoofing. Request your complimentary white paper at:

http://www.securityfocus.com/sponsor/AirDefense_linux-secnews_050726

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Identifying P2P users using traffic analysis
II.  LINUX VULNERABILITY SUMMARY
       1. Macromedia JRun Unauthorized Session Access Vulnerability
       2. Sybase EAServer Remote Buffer Overflow Vulnerability
       3. PowerDNS LDAP Backend Query Escape Failure Vulnerability
       4. PowerDNS Recursive Query Denial of Service Vulnerability
       5. Shorewall MACLIST Firewall Rules Bypass Vulnerability
       6. Skype Technologies Skype Insecure Temporary File Creation Vulnerability
       7. KDE Kate, KWrite Local Backup File Information Disclosure Vulnerability
       8. Novell GroupWise WebAccess HTML Injection Vulnerability
       9. Mozilla Firefox Weak Authentication Mechanism Vulnerability
       10. MediaWiki Unspecified Remote Cross-Site Scripting Vulnerability
       11. Zlib Compression Library Decompression Denial Of Service Vulnerability
       12. EKG LIbGadu Multiple Remote Integer Overflow Vulnerabilities
       13. Fetchmail POP3 Client Buffer Overflow Vulnerability
III. LINUX FOCUS LIST SUMMARY
       1. SID HIDS 0.4.2 released
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Identifying P2P users using traffic analysis
By Yiming Gong
With the popularity of P2P and the bandwidth it consume, there is a growing need to identify P2P users within the network traffic.
http://www.securityfocus.com/infocus/1843


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Macromedia JRun Unauthorized Session Access Vulnerability
BugTraq ID: 14271
Remote: Yes
Date Published: 2005-07-15
Relevant URL: http://www.securityfocus.com/bid/14271
Summary:
Macromedia JRun is affected by a vulnerability that may allow a user's session to be shared with another user. 

Under certain circumstances, two users may share the same session facilitating various attacks including a compromise of the user's account.

It should be noted that this issue cannot be triggered by an attacker and occurs rarely.

JRun 4.0, ColdFusion MX 7.0 Enterprise Multi-Server Edition, and ColdFusion MX 6.1 Enterprise with JRun are affected by this vulnerability.

2. Sybase EAServer Remote Buffer Overflow Vulnerability
BugTraq ID: 14287
Remote: Yes
Date Published: 2005-07-15
Relevant URL: http://www.securityfocus.com/bid/14287
Summary:
Sybase EAServer is affected by a remote buffer overflow vulnerability.

The vulnerability exists in the server's WebConsole.  A successful attack can result in overflowing a finite sized buffer and ultimately leading to arbitrary code execution in the context of the 'jagsrv.exe' process.  This may allow the attacker to gain elevated privileges.

It should be noted that an attacker needs to provide authentication credentials prior to carrying out this attack.


3. PowerDNS LDAP Backend Query Escape Failure Vulnerability
BugTraq ID: 14290
Remote: Yes
Date Published: 2005-07-17
Relevant URL: http://www.securityfocus.com/bid/14290
Summary:
The PowerDNS LDAP back-end did not adequately escape requests prior to version 2.9.18.   As a result, it was possible for requests to fail without answering questions.  This may have security implications in environments where PowerDNS and LDAP are used.  The vendor has fixed this in version 2.9.18.


4. PowerDNS Recursive Query Denial of Service Vulnerability
BugTraq ID: 14291
Remote: Yes
Date Published: 2005-07-17
Relevant URL: http://www.securityfocus.com/bid/14291
Summary:
A denial of service vulnerability affects PowerDNS.  The vulnerability allows for remote attackers from external networks to cause lookups for authorized hosts to fail.  The technical details of this vulnerability are not yet available.  The condition occurs when PowerDNS is configured to allow only hosts from specific IP address ranges to perform recursive queries. 

5. Shorewall MACLIST Firewall Rules Bypass Vulnerability
BugTraq ID: 14292
Remote: Yes
Date Published: 2005-07-18
Relevant URL: http://www.securityfocus.com/bid/14292
Summary:
Shorewall is susceptible to a firewall rules bypass vulnerability. This issue is due to a failure of the software to properly implement expected firewall rules for MAC address-based filtering.

This issue arrises when 'MACLIST_TTL' is greater than 0, or 'MACLIST_DISPOSITION' is configured as 'ACCEPT'.

This vulnerability allows attackers to bypass firewall rules, letting them attack protected services and computers without further restriction.

This also issue leads to a false sense of security by firewall administrators.

6. Skype Technologies Skype Insecure Temporary File Creation Vulnerability
BugTraq ID: 14293
Remote: No
Date Published: 2005-07-18
Relevant URL: http://www.securityfocus.com/bid/14293
Summary:
Skype is affected by an insecure temporary file creation vulnerability.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.

Skype 1.1.0.20 and prior versions are affected.

7. KDE Kate, KWrite Local Backup File Information Disclosure Vulnerability
BugTraq ID: 14297
Remote: No
Date Published: 2005-07-18
Relevant URL: http://www.securityfocus.com/bid/14297
Summary:
KDE kate, and kwrite are susceptible to a local information disclosure vulnerability. This issue is due to a failure of the applications to maintain secure file permissions when creating backup files.

This vulnerability allows local attackers to gain access to the contents of potentially sensitive files.

Note: Since these applications are network-aware, under some unknown circumstances, this issue may not be restricted to local attackers.

8. Novell GroupWise WebAccess HTML Injection Vulnerability
BugTraq ID: 14310
Remote: Yes
Date Published: 2005-07-15
Relevant URL: http://www.securityfocus.com/bid/14310
Summary:
Novell GroupWise WebAccess is prone to an HTML injection vulnerability.  This may be used to inject hostile HTML and script code into the Web mail application.  When a user opens an email containing the hostile code, it may be rendered in their browser.

Successful exploitation could potentially allow theft of cookie-based authentication.  Other attacks are also possible.

9. Mozilla Firefox Weak Authentication Mechanism Vulnerability
BugTraq ID: 14325
Remote: Yes
Date Published: 2005-07-19
Relevant URL: http://www.securityfocus.com/bid/14325
Summary:
Firefox is affected by a vulnerability that may result in sending authentication credentials across the network in plaintext format.

By default, the browser chooses basic authentication even if other authentication schemas such as Digest or NTLM are available from the server.

Mozilla Firefox 1.0.4 and 1.0.5 running on Windows are confirmed to be vulnerable.  Other versions on different platforms may be affected as well.

10. MediaWiki Unspecified Remote Cross-Site Scripting Vulnerability
BugTraq ID: 14327
Remote: Yes
Date Published: 2005-07-20
Relevant URL: http://www.securityfocus.com/bid/14327
Summary:
MediaWiki is prone to cross-site scripting attacks.

The specific scripts and parameters that are affected by this issue are currently unknown. This BID will be updated as more details are released.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

MediaWiki 1.4.6 and prior versions are affected.

11. Zlib Compression Library Decompression Denial Of Service Vulnerability
BugTraq ID: 14340
Remote: Yes
Date Published: 2005-07-21
Relevant URL: http://www.securityfocus.com/bid/14340
Summary:
Zlib is susceptible to a denial of service vulnerability. This issue is due to a failure of the library to properly handle unexpected input to its decompression routines.

Certain values used during decompression are incorrectly specified, allowing invalid inflate input to crash the library.

This vulnerability allows attackers to crash applications that utilize the affected library.

12. EKG LIbGadu Multiple Remote Integer Overflow Vulnerabilities
BugTraq ID: 14345
Remote: Yes
Date Published: 2005-07-21
Relevant URL: http://www.securityfocus.com/bid/14345
Summary:
EKG libgadu is susceptible to multiple remote integer overflow vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input data prior to using it in memory allocation and copy operations.

Attackers may exploit these vulnerabilities to execute arbitrary machine code in the context of applications that utilize the affected library. Failed exploitation attempts likely result in crashed applications.

13. Fetchmail POP3 Client Buffer Overflow Vulnerability
BugTraq ID: 14349
Remote: Yes
Date Published: 2005-07-21
Relevant URL: http://www.securityfocus.com/bid/14349
Summary:
Fetchmail POP3 client is prone to a buffer overflow vulnerability.  This issue presents itself because the application fails to perform boundary checks prior to copying user-supplied data into sensitive process buffers. This includes POP variants such as APOP, and others.

A successful attack can result in overflowing a finite sized buffer and ultimately leading to arbitrary code execution in the context of the fetchmail process.  This may allow the attacker to gain elevated privileges.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. SID HIDS 0.4.2 released
http://www.securityfocus.com/archive/91/405592

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website. 

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: AirDefense

FREE WHITE PAPER - Wireless LAN Security: What Hackers Know That You Don't
Learn the hacker's secrets that compromise wireless LANs. Secure your
WLAN by understanding these threats, available hacking tools and proven
countermeasures. Defend your WLAN against man-in-the-Middle attacks and
session hijacking, denial-of-service, rogue access points, identity
thefts and MAC spoofing. Request your complimentary white paper at:

http://www.securityfocus.com/sponsor/AirDefense_linux-secnews_050726