SecurityFocus Linux Newsletter #254

Peter Laborge <[email protected]> Tue, 04 Oct 2005 16:10:52 -0600
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #254
----------------------------------------

Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Can writing software be a crime?
       2. Security-related innovation in Unix
II.  LINUX VULNERABILITY SUMMARY
       1. Wzdftpd SITE Command Arbitrary Command Execution Vulnerability
       2. RSyslog Syslog Message SQL Injection Vulnerability
       3. Qpopper Local Arbitrary File Modification Vulnerability
       4. RealNetworks RealPlayer And Helix Player Format String Vulnerability 
       5. Astaro Security Linux PPTP Server Unspecified Remote Denial of Service Vulnerability
       6. Linux Kernel USB Subsystem Local Denial Of Service Vulnerability
       7. AbiWord RTF File Processing Buffer Overflow Vulnerability 
       8. BackupNinja Insecure Temporary File Creation Vulnerability
       9. ApacheTop Insecure Temporary File Creation Vulnerability
       10. Blender Command Line Processing Buffer Overflow Vulnerability 
       11. MediaWiki Multiple Cross-Site Scripting Vulnerabilities
       12. ProZilla Buffer Overflow Vulnerability
       13. GNU CFEngine Insecure Temporary File Creation Vulnerability
       14. Bugzilla config.cgi Information Disclosure Vulnerability
       15. Bugzilla User-Matching Information Disclosure Vulnerability
III. LINUX FOCUS LIST SUMMARY
       1. routing_based_on_port/services
       2. Group permissions changed
       3. Securing Fedora Core 4
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Can writing software be a crime?
By Mark Rasch
Can writing software be a crime? A recent indictment in San Diego, California indicates that the answer to that question may be yes.
http://www.securityfocus.com/columnists/360

2. Security-related innovation in Unix
By Jason Miller
Recently, a good friend of mine forwarded me an article from kerneltrap.org, which talked about a new heap implementation that's being introduced into an upcoming release of the OpenBSD operating system.
http://www.securityfocus.com/columnists/359


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Wzdftpd SITE Command Arbitrary Command Execution Vulnerability
BugTraq ID: 14935
Remote: Yes
Date Published: 2005-09-24
Relevant URL: http://www.securityfocus.com/bid/14935
Summary:
wzdftpd is affected by a remote arbitrary command execution vulnerability.

This issue can allow an attacker to execute commands in the context of an affected server and potentially gain unauthorized access. 

wzdftpd 0.5.4 is reported to be vulnerable.  Other versions may be affected as well.


2. RSyslog Syslog Message SQL Injection Vulnerability
BugTraq ID: 14942
Remote: Yes
Date Published: 2005-09-26
Relevant URL: http://www.securityfocus.com/bid/14942
Summary:
RSyslog is prone to an SQL injection vulnerability.  This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

3. Qpopper Local Arbitrary File Modification Vulnerability
BugTraq ID: 14944
Remote: No
Date Published: 2005-09-26
Relevant URL: http://www.securityfocus.com/bid/14944
Summary:
Qpopper is a POP3 mail server available for Linux and Unix based systems.

Qpopper is susceptible to a local arbitrary file modification vulnerability. This issue is due to insecure file handling in the 'poppassd' setuid-superuser application.

A local attacker could exploit this vulnerability to alter the permissions on, overwrite and alter arbitrary files with superuser privileges. Depending on the purpose of the modified files, this may cause system crashes, or allow attackers to gain elevated privileges.

4. RealNetworks RealPlayer And Helix Player Format String Vulnerability 
BugTraq ID: 14945
Remote: Yes
Date Published: 2005-09-26
Relevant URL: http://www.securityfocus.com/bid/14945
Summary:
RealPlayer and Helix player are susceptible to a format string vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input, allowing a remote attacker to supply format specifiers directly to a formatted printing function.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary machine code in the context of the affected application.

RealPlayer 10.0 through 10.0.5 for Linux and Helix Player 1.0 through 1.0.5 are prone to this issue.


5. Astaro Security Linux PPTP Server Unspecified Remote Denial of Service Vulnerability
BugTraq ID: 14950
Remote: Yes
Date Published: 2005-09-26
Relevant URL: http://www.securityfocus.com/bid/14950
Summary:
Astaro Security Linux Point-to-Point Tunneling Protocol (PPTP) server is affected by an unspecified remote denial of service vulnerability.

It is conjectured that a remote attacker may exploit this issue by sending specially crafted data to the PPTP server and causing the application to crash.

Due to a lack of details, further information cannot be provided at the moment.  This BID will be updated when more details are available.

6. Linux Kernel USB Subsystem Local Denial Of Service Vulnerability
BugTraq ID: 14955
Remote: No
Date Published: 2005-09-27
Relevant URL: http://www.securityfocus.com/bid/14955
Summary:
A local denial of service vulnerability affects the USB subsystem of the Linux kernel. This issue is due to a failure of the kernel to properly handle unexpected conditions when attempting to handle URBs (USB Request Blocks).

This vulnerability may be exploited by local users to trigger a kernel 'Oops' on computers where the vulnerable USB subsystem is enabled. This may be used to deny service to legitimate users.

7. AbiWord RTF File Processing Buffer Overflow Vulnerability 
BugTraq ID: 14971
Remote: Yes
Date Published: 2005-09-29
Relevant URL: http://www.securityfocus.com/bid/14971
Summary:
AbiWord is susceptible to a buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer while importing RTF files.

This issue likely allows attackers to execute arbitrary machine code in the context of the user running the affected application.

8. BackupNinja Insecure Temporary File Creation Vulnerability
BugTraq ID: 14978
Remote: No
Date Published: 2005-09-30
Relevant URL: http://www.securityfocus.com/bid/14978
Summary:
backupninja creates temporary files in an insecure manner.  This may allow a local attacker to perform symbolic link attacks.

Successful exploitation may result in sensitive data or configuration files being overwritten.  This may result in a denial of service; other attacks may also be possible.


9. ApacheTop Insecure Temporary File Creation Vulnerability
BugTraq ID: 14982
Remote: No
Date Published: 2005-09-30
Relevant URL: http://www.securityfocus.com/bid/14982
Summary:
ApacheTop creates temporary files in an insecure manner. This may allow a local attacker to perform symbolic link attacks.

Successful exploitation may result in sensitive data or configuration files being overwritten.  This may result in a denial of service; other attacks may also be possible.


10. Blender Command Line Processing Buffer Overflow Vulnerability 
BugTraq ID: 14983
Remote: Yes
Date Published: 2005-09-30
Relevant URL: http://www.securityfocus.com/bid/14983
Summary:
Blender is susceptible to a buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer while handling command line arguments.

This issue likely allows attackers to execute arbitrary machine code in the context of the user running the affected application.

This issue is reported in version 2.37a of Blender; other versions may also be affected.

11. MediaWiki Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 14987
Remote: Yes
Date Published: 2005-09-29
Relevant URL: http://www.securityfocus.com/bid/14987
Summary:
MediaWiki is prone to multiple cross-site scripting vulnerabilities.  These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site.  This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

12. ProZilla Buffer Overflow Vulnerability
BugTraq ID: 14993
Remote: Yes
Date Published: 2005-10-01
Relevant URL: http://www.securityfocus.com/bid/14993
Summary:
ProZilla is prone to a buffer overflow vulnerability. This issue is due to the failure of the application to properly bounds check user-supplied input prior to copying it to an insufficiently sized memory buffer.

Arbitrary code execution in the context of the user running the application is possible.

13. GNU CFEngine Insecure Temporary File Creation Vulnerability
BugTraq ID: 14994
Remote: No
Date Published: 2005-10-01
Relevant URL: http://www.securityfocus.com/bid/14994
Summary:
GNU cfengine is prone to an insecure temporary file creation vulnerability.  Exploitation may allow arbitrary files to be overwritten.


14. Bugzilla config.cgi Information Disclosure Vulnerability
BugTraq ID: 14995
Remote: Yes
Date Published: 2005-10-01
Relevant URL: http://www.securityfocus.com/bid/14995
Summary:
Bugzilla is prone to an information disclosure issue exposed through config.cgi.  This may allow an unauthorized user to access product names that are supposed to be confidential.

Bugzilla versions 2.18rc1 to 2.18.3, 2.19 to 2.20rc2, and 2.21 are affected.

15. Bugzilla User-Matching Information Disclosure Vulnerability
BugTraq ID: 14996
Remote: Yes
Date Published: 2005-10-01
Relevant URL: http://www.securityfocus.com/bid/14996
Summary:
Bugzilla is prone to an information disclosure vulnerability when user-matching is turned on.  This could allow an attacker to enumerate usernames on the system.

Bugzilla 2.19.1 to 2.20rc2 and 2.21 are prone to this vulnerability.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. routing_based_on_port/services
http://www.securityfocus.com/archive/91/412365

2. Group permissions changed
http://www.securityfocus.com/archive/91/412015

3. Securing Fedora Core 4
http://www.securityfocus.com/archive/91/411346

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website. 

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
Need to know what's happening on YOUR network? Symantec DeepSight Analyzer
is a free service that gives you the ability to track and manage attacks.
Analyzer automatically correlates attacks from various Firewall and network
based Intrusion Detection Systems, giving you a comprehensive view of your
computer or general network. Sign up today!

http://www.securityfocus.com/sponsor/Symantec_sf-news_041130