SecurityFocus Linux Newsletter #250

Peter Laborge <[email protected]> Wed, 07 Sep 2005 14:30:55 -0600
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #250
----------------------------------------

Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Exploiting Cisco with FX
       2. A changing landscape
II.  LINUX VULNERABILITY SUMMARY
       1. FUDforum Avatar Upload Arbitrary Script Upload Vulnerability
       2. PHPLDAPAdmin Unauthorized Access Vulnerability
       3. SILC Server Insecure Temporary File Creation Vulnerability
       4. Novell NetMail Remote IMAP Heap Buffer Overflow Vulnerability
       5. Linux Kernel ZLib Local Null Pointer Dereference Denial of Service Vulnerability
       6. Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability
       7. OpenSSH DynamicForward Inadvertent GatewayPorts Activation Vulnerability
       8. OpenSSH GSSAPI Credential Disclosure Vulnerability
       9. Squid Proxy SSLConnectTimeout Remote Denial Of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
       1. scanning for windows spywear with linux
       2. Re[2]: Linux hardening
       3. Xvfb Question
       4. Linux hardening
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Exploiting Cisco with FX
By Federico Biancuzzi
This interview with FX discusses Cisco IOS exploitation, Michael Lynn's work, and what FX believes can be done when hacking IOS.
http://www.securityfocus.com/columnists/351

2. A changing landscape
By Rohyt Belani
In 2004, I came across an empirical study published by the CERT/CC that indicated a diminishing correlation between the number of vendor-issued vulnerabilities and the number of reported security incidents.
http://www.securityfocus.com/columnists/352


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. FUDforum Avatar Upload Arbitrary Script Upload Vulnerability
BugTraq ID: 14678
Remote: Yes
Date Published: 2005-08-29
Relevant URL: http://www.securityfocus.com/bid/14678
Summary:
FUDforum is prone to a remote arbitrary PHP file upload vulnerability.

An attacker can merge an image file with a script file and upload it to an affected server.

This issue can facilitate unauthorized remote access.

FUDforum versions prior to 2.7.1 are reported to be affected.  Currently Symantec cannot confirm if version 2.7.1 is affected as well.

2. PHPLDAPAdmin Unauthorized Access Vulnerability
BugTraq ID: 14694
Remote: Yes
Date Published: 2005-08-30
Relevant URL: http://www.securityfocus.com/bid/14694
Summary:
phpldapadmin is prone to an unauthorized access vulnerability.  This issue is due to a failure in the application to properly validate user credentials before granting access to LDAP administrative functions.

An attacker can exploit this vulnerability to login to the server anonymously, and utilize administrative functions to modify the LDAP database. 

3. SILC Server Insecure Temporary File Creation Vulnerability
BugTraq ID: 14716
Remote: No
Date Published: 2005-09-01
Relevant URL: http://www.securityfocus.com/bid/14716
Summary:
SILC Server creates temporary files in an insecure manner. The issue exists in the 'silcd/silcd.c' file.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.

4. Novell NetMail Remote IMAP Heap Buffer Overflow Vulnerability
BugTraq ID: 14718
Remote: Yes
Date Published: 2005-09-01
Relevant URL: http://www.securityfocus.com/bid/14718
Summary:
Novell NetMail is susceptible to a buffer overflow vulnerability in the IMAP command continuation function in the IMAP agent. This issue is due to a lack of proper boundary checks when copying user-supplied data to insufficiently-sized memory buffers.

This vulnerability allows remote attackers to execute arbitrary machine code in the context of the affected server process.

This issue was originally documented in BID 13926 (Novell NetMail Multiple Remote Vulnerabilities).


5. Linux Kernel ZLib Local Null Pointer Dereference Denial of Service Vulnerability
BugTraq ID: 14720
Remote: No
Date Published: 2005-09-01
Relevant URL: http://www.securityfocus.com/bid/14720
Summary:
The Linux kernel is prone to a denial of service vulnerability.  This issue is due to a failure in the application to properly handle malformed compressed files.

An attacker can exploit this vulnerability to cause a kernel crash, effectively denying service to legitimate users.

6. Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability
BugTraq ID: 14721
Remote: Yes
Date Published: 2005-09-01
Relevant URL: http://www.securityfocus.com/bid/14721
Summary:
Apache 2.x mod_ssl is prone to a restriction bypass vulnerability. This issue presents itself when mod_ssl is configured to be used with the 'SSLVerifyClient' directive.

This issue allows attackers to bypass security policies to gain access to locations that are configured to be forbidden for clients without a valid client certificate.

7. OpenSSH DynamicForward Inadvertent GatewayPorts Activation Vulnerability
BugTraq ID: 14727
Remote: Yes
Date Published: 2005-09-01
Relevant URL: http://www.securityfocus.com/bid/14727
Summary:
OpenSSH is susceptible to a vulnerability that causes improper activation of the 'GatewayPorts' option, allowing unintended hosts to utilize the SSH SOCKS proxy.

Specifically, if the 'DynamicForward' option is activated, 'GatewayPorts' is also unconditionally enabled.

This vulnerability allows remote attackers to utilize the SOCKS proxy to make arbitrary TCP connections through the configured SSH session, allowing them to attack computers and services through a connection that was inappropriately thought to be secure.

This issue affects OpenSSH 4.0, and 4.1.

8. OpenSSH GSSAPI Credential Disclosure Vulnerability
BugTraq ID: 14729
Remote: Yes
Date Published: 2005-09-01
Relevant URL: http://www.securityfocus.com/bid/14729
Summary:
OpenSSH is susceptible to a GSSAPI credential delegation vulnerability.

Specifically, if a user has GSSAPI authentication configured, and 'GSSAPIDelegateCredentials' is enabled, their Kerberos credentials will be forwarded to remote hosts. This occurs even when the user uses authentication methods other than GSSAPI to connect, which is not what is usually expected.

This vulnerability allows remote attackers to improperly gain access to GSSAPI credentials, allowing them to utilize the credentials to access resources granted to the original principal.

This issue affects versions of OpenSSH prior to 4.2.

9. Squid Proxy SSLConnectTimeout Remote Denial Of Service Vulnerability
BugTraq ID: 14731
Remote: Yes
Date Published: 2005-09-01
Relevant URL: http://www.securityfocus.com/bid/14731
Summary:
A remote denial of service vulnerability affects the Squid Proxy. This issue is due to a failure of the application to properly handle exceptional network requests.

A remote attacker may leverage this issue to crash the affected Squid Proxy, denying service to legitimate users.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. scanning for windows spywear with linux
http://www.securityfocus.com/archive/91/409832

2. Re[2]: Linux hardening
http://www.securityfocus.com/archive/91/409012

3. Xvfb Question
http://www.securityfocus.com/archive/91/409023

4. Linux hardening
http://www.securityfocus.com/archive/91/408758

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website. 

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130