SecurityFocus Linux Newsletter #248

Peter Laborge <[email protected]> Wed, 24 Aug 2005 11:14:15 -0600

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #248
----------------------------------------

Need to know what's happening on YOUR network? Symantec DeepSight Analyzer is a free service that gives you the ability to track and manage attacks. Analyzer automatically correlates attacks from various Firewall and network based Intrusion Detection Systems, giving you a comprehensive view of your computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------
I. FRONT AND CENTER
1. Legal disassembly
2. It's only a matter of time...
II. LINUX VULNERABILITY SUMMARY
1. PHPXMLRPC and PEAR XML_RPC Remote Code Injection Vulnerability
2. BlueZ Arbitrary Command Execution Vulnerability
3. PHPOutsourcing Zorum Prod.PHP Arbitrary Command Execution Vulnerability
4. Adobe Acrobat and Adobe Reader Remote Buffer Overflow Vulnerability
5. Mantis Multiple Input Validation Vulnerabilities
6. HAURI Anti-Virus Compressed Files Directory Traversal Vulnerability
7. Linux Kernel IPSec Policies Authorization Bypass Vulnerability
8. Linux Kernel SNMP Handler Denial of Service Vulnerability
9. Elm Expires Header Remote Buffer Overflow Vulnerability
10. Linux Kernel ISO File System Denial Of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. POC /dev/input/event* keylogger
2. Cracking bigcrypt/crypt16 password hashes
3. Xvfb Question
4. linux password cracking tools
5. Linux hardening
6. one time passwords
7. SMB : TCP/445 impossible to sniff a document sent to be printed to a MS Spooler Server
8. OPIE
9. Content Filtering Firewall in Linux..
10. Volunteery Administrators needed for codehunters.com
11. Certifications
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Legal disassembly
By Mark Rasch
When security researcher and ISS employee Michael Lynn went to give a presentation at the Black Hat conference in Las Vegas, little did he know he would ignite a legal firestorm questioning whether even the act of looking for security vulnerabilities violates the law.
http://www.securityfocus.com/columnists/349

2. It's only a matter of time...
By Jason Miller
According to the Apple Web site, Security Update 2005-007 was released to the public on August 12, 2005. And, as with all of their recent security updates, it is available to all Apple customers free of charge. I'm sure none of you reading this article will argue with me about that being a good thing.
http://www.securityfocus.com/columnists/348

II. LINUX VULNERABILITY SUMMARY
------------------------------------
1. PHPXMLRPC and PEAR XML_RPC Remote Code Injection Vulnerability
BugTraq ID: 14560
Remote: Yes
Date Published: 2005-08-15
Relevant URL: http://www.securityfocus.com/bid/14560
Summary:
PHPXMLRPC and PEAR XML_RPC are affected by a remote PHP code injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

2. BlueZ Arbitrary Command Execution Vulnerability
BugTraq ID: 14572
Remote: Yes
Date Published: 2005-08-16
Relevant URL: http://www.securityfocus.com/bid/14572
Summary:
BlueZ is affected by an arbitrary command execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of this vulnerability will permit an attacker to execute arbitrary commands on the system hosting the affected application in the security context of the application. This may aid in further attacks against the underlying system; other attacks are also possible.

3. PHPOutsourcing Zorum Prod.PHP Arbitrary Command Execution Vulnerability
BugTraq ID: 14601
Remote: Yes
Date Published: 2005-08-18
Relevant URL: http://www.securityfocus.com/bid/14601
Summary:
Zorum is prone to an arbitrary command execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

This issue may facilitate unauthorized remote access in the context of the Web server to the affected computer.

4. Adobe Acrobat and Adobe Reader Remote Buffer Overflow Vulnerability
BugTraq ID: 14603
Remote: Yes
Date Published: 2005-08-16
Relevant URL: http://www.securityfocus.com/bid/14603
Summary:
Adobe Acrobat and Adobe Reader are affected by a remote buffer overflow vulnerability. This issue presents itself because the application fails to perform boundary checks prior to copying user-supplied data into sensitive process buffers.

An attacker can exploit this issue by crafting a malicious PDF file and sending it to a vulnerable user. If the victim user opens this PDF file, the attacker may be able to execute arbitrary code on the affected computer and gain unauthorized access in the context of the user.

5. Mantis Multiple Input Validation Vulnerabilities
BugTraq ID: 14604
Remote: Yes
Date Published: 2005-08-19
Relevant URL: http://www.securityfocus.com/bid/14604
Summary:
Mantis is prone to multiple input validation vulnerabilities. These issues range from SQL injection to cross-site scripting. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Successful exploitation of the SQL injection issue could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

6. HAURI Anti-Virus Compressed Files Directory Traversal Vulnerability
BugTraq ID: 14606
Remote: Yes
Date Published: 2005-08-19
Relevant URL: http://www.securityfocus.com/bid/14606
Summary:
HAURI Anti-Virus is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An unauthorized user can write files to arbitrary locations by supplying directory traversal strings '../' in archived file names. Exploitation of this vulnerability could lead to a loss of integrity and possibly availability. An attacker can exploit this vulnerability to possibly cause a denial of service in the affected application. This may aid in further attacks against the underlying system once the anti-virus software has been disabled.

7. Linux Kernel IPSec Policies Authorization Bypass Vulnerability
BugTraq ID: 14609
Remote: No
Date Published: 2005-08-19
Relevant URL: http://www.securityfocus.com/bid/14609
Summary:
Linux Kernel is prone to an authorization bypass vulnerability.

This issue is due to a failure in the application to perform proper authorization before permitting access to a privileged function.

Successful exploitation will permit a local attacker to bypass intended IPSec policies, set invalid policies and cause a denial of service when adding policies until kernel memory is exhausted.

It should be noted an attacker can use this vulnerability enhance the exploitation of BID 14477 (Linux Kernel XFRM Array Index Buffer Overflow Vulnerability); that issue requires the ability to add IPSec policies.

8. Linux Kernel SNMP Handler Denial of Service Vulnerability
BugTraq ID: 14611
Remote: Yes
Date Published: 2005-08-19
Relevant URL: http://www.securityfocus.com/bid/14611
Summary:
The Linux kernel is prone to a denial of service vulnerability. This issue is due to a NULL pointer dereference that can occur when malformed UDP packets are received by snmpd.

9. Elm Expires Header Remote Buffer Overflow Vulnerability
BugTraq ID: 14613
Remote: Yes
Date Published: 2005-08-20
Relevant URL: http://www.securityfocus.com/bid/14613
Summary:
Elm is prone to a buffer overflow vulnerability which could allow an attacker to execute malicious code. This issue is due to a failure in the application to perform proper bounds checking on user-supplied data.

A successful attack can result in overflowing a finite sized buffer and may ultimately lead to arbitrary code execution in the context of the affected application.

10. Linux Kernel ISO File System Denial Of Service Vulnerability
BugTraq ID: 14614
Remote: Yes
Date Published: 2005-08-19
Relevant URL: http://www.securityfocus.com/bid/14614
Summary:
The kernel driver for compressed ISO file systems is prone to a denial of service vulnerability. This issue is due to a failure in the driver to properly sanitize input data.

When the kernel attempts to mount a malicious compressed ISO image, the kernel crashes.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. POC /dev/input/event* keylogger
http://www.securityfocus.com/archive/91/409017

2. Cracking bigcrypt/crypt16 password hashes
http://www.securityfocus.com/archive/91/409016

3. Xvfb Question
http://www.securityfocus.com/archive/91/409023

4. linux password cracking tools
http://www.securityfocus.com/archive/91/408915

5. Linux hardening
http://www.securityfocus.com/archive/91/408758

6. one time passwords
http://www.securityfocus.com/archive/91/408796

7. SMB : TCP/445 impossible to sniff a document sent to be printed to a MS Spooler Server
http://www.securityfocus.com/archive/91/408574

8. OPIE
http://www.securityfocus.com/archive/91/408479

9. Content Filtering Firewall in Linux..
http://www.securityfocus.com/archive/91/408476

10. Volunteery Administrators needed for codehunters.com
http://www.securityfocus.com/archive/91/408481

11. Certifications
http://www.securityfocus.com/archive/91/408062

IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V. SPONSOR INFORMATION
------------------------

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130