SecurityFocus Linux Newsletter #87

SecurityFocus Linux Newsletter #87
--------------------------------

This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!

http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml

-------------------------------------------------------------------------------


I. FRONT AND CENTER
     1. Black Hat Briefings & Training
     2. Filtering E-Mail with Postfix and Procmail, Part Two
     3. No Stone Unturned, Part Five
     4. Irresponsible Disclosure
     5. The Domestic Spying Renaissance
II. LINUX VULNERABILITY SUMMARY
     1. YaBB Invalid Topic Error Page Cross Site Scripting Vulnerability
     2. BEA Systems WebLogic Access Controls Bypass Vulnerability
     3. Apache Tomcat Null Character Malformed Request Denial Of...
     4. DPGS Form Field Input Validation Vulnerability
     5. Mod_SSL Off-By-One HTAccess Buffer Overflow Vulnerability
     6. ht://Dig htsearch Cross Site Scripting Vulnerability
     7. Adobe Acrobat Reader Insecure Temporary File Creation...
     8. APC PowerChute Plus Insecure Shared Folder Permission...
     9. PHPSquidPass Index.PHP Unauthorized User Deletion Vulnerability
     10. OpenSSH Challenge-Response Buffer Overflow Vulnerabilities
III. LINUX FOCUS LIST SUMMARY
     1. List problems (Thread)
     2. Have I been kitted? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. IronMail
     2. Symantec Gateway Security
     3. Ringneck Security Console (RSC)
V. NEW TOOLS FOR LINUX PLATFORMS
     1. XLNT Procguard v1.0
     2. CRM v20020626
     3. ssh-multiadd v1.3.2
     4. BackerUpper v0.3
VI. SPONSORSHIP INFORMATION










I. FRONT AND CENTER
-------------------
1. Black Hat Briefings & Training

Attend Black Hat Briefings & Training, July 29 - August 1, Las Vegas, the
world's premier technical security event! 8 tracks, 12 training sessions,
Richard Clarke keynote, 1500 delegates from 30 nations, with a near cult
following of both CSOs and "underground" security experts.  See for
yourself what the buzz is all about.

Visit us at: http://www.blackhat.com

2. Filtering E-Mail with Postfix and Procmail, Part Two
By Brian Hatch

This article is the second of three articles that will help systems
administrators configure SMTP daemons and local mail delivery agents to
filter out unwanted e-mails before they arrive in the end-users' in-box.
In this part, we will look at sender/recipient restrictions, restriction
ordering, and map file naming conventions before moving on to Procmail in
the final article.

http://online.securityfocus.com/infocus/1598

3. No Stone Unturned, Part Five
by H. Carvey

This is the fifth and final installment of a five-part series describing
the (mis)adventures of a sysadmin named Eliot and his haphazard journey in
discovering "The Way" of incident response. As we left off last time,
Eliot had started putting together a toolkit to help with incident
response and analysis. He had had an opportunity to give the kit a quick
test and had been satisfied with the results, but the toolkit was not
quite finished.

http://online.securityfocus.com/infocus/1597

4. Irresponsible Disclosure
By Jon Lasser

Internet Security Systems violated community standards and common sense
with its surprise Apache bug announcement.

http://online.securityfocus.com/columnists/91

5. The Domestic Spying Renaissance
By Mark Rasch

Earlier this month, Attorney General Ashcroft announced that he was
essentially removing the shackles from the FBI, and permitting agents to
engage in surveillance -- including certain Internet surveillance -- of
political, social or ethnic groups, without either probable cause or
reasonable suspicion that any of these groups had been or were likely to
be engaged in any form of criminal activity.

http://online.securityfocus.com/columnists/90


II. BUGTRAQ SUMMARY
-------------------
1. YaBB Invalid Topic Error Page Cross Site Scripting Vulnerability
BugTraq ID: 5078
Remote: Yes
Date Published: Jun 21 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5078
Summary:

YaBB (Yet Another Bulletin Board) is freely available web forum software
that is written in Perl. YaBB will run on most Unix/Linux variants, MacOS,
and Microsoft Windows 9x/ME/NT/2000/XP platforms.

It is possible for attackers to construct a URL that will cause scripting
code to be embedded in error pages.

YaBB fails to check URLs for the presence of script commands when
generating error pages, allowing attacker supplied code to execute. As a
result, when an innocent user follows such a link, the script code will
execute within the context of the hosted site.

Successful exploitation of this vulnerability could enable an attacker to
execute code in the security context of a trusted site. This vulnerability
may be exploited to steal cookie-based authentication credentials from
legitimate users of YaBB.

It should be noted that this issue was tested on YaBB 1 Gold SP1, other
versions may also be affected by this issue.

2. BEA Systems WebLogic Access Controls Bypass Vulnerability
BugTraq ID: 5089
Remote: Yes
Date Published: Jun 21 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5089
Summary:

BEA Systems WebLogic Server is a web and wireless application server for
Microsoft Windows and most Unix and Linux distributions.

A vulnerability has been announced in WebLogic. A remote attacker may
bypass access control measures, and view restricted resources. This may be
accomplished by submitting a maliciously constructed URL for the resource
in question to the WebLogic server.

Access control measures may be bypassed if the URL requested contains
multiple forward slashes (/) immediately before the protected resource.
Exploitation of this vulnerability may allow a remote attacker access to
sensitive JSP or servlet pages.

3. Apache Tomcat Null Character Malformed Request Denial Of Service Vulnerability
BugTraq ID: 5067
Remote: Yes
Date Published: Jun 20 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5067
Summary:

Apache Tomcat is a freely available, open source web server maintained by
the Apache Foundation. It is available for use on Unix and Linux variants
as well as Microsoft Windows operating environments.

A vulnerability has been reported for Apache Tomcat 4.0.3 on a Microsoft
Windows platform. Reportedly, it is possible for a remote attacker to make
requests consisting of a large number of null characters to Tomcat that
will cause the web service to stop responding.

An attacker needs to make approximately 75 requests, consisting of a large
number of null characters, to the web service. This will exhaust all
available threads for Tomcat leading to the denial of service condition.

An attacker may take advantage of this vulnerability to deny service to
legitimate users.

4. DPGS Form Field Input Validation Vulnerability
BugTraq ID: 5081
Remote: Yes
Date Published: Jun 21 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5081
Summary:

Duma Photo Gallery System (DPGS) is web-based software for managing
photographs.  It is written in Perl and will run on most Unix and Linux
variants as well as Microsoft Windows operating systems.

DPGS does not sufficiently validate form field input.  Specifically, this
vulnerability is due to insufficient filtering of input supplied to the
Perl open() function.  This may allow remote attackers to disclose the
contents of arbitrary web-readable files via directory traversals.
Requesting a web-readable file by supplying a relative path to the file
using dot-dot-slash sequences (../) is all that is required to exploit
this issue.

It has also been reported that this lack of sufficient input validation
may also be exploited to overwrite any files which are writeable by the
webserver process.  This is due to insufficient filtering of null
characters (\0) from the same form fields that are affected by the file
disclosure issue.

Exploitation of this vulnerability may be extended to affect arbitrary
system files on some webservers running under Microsoft Windows, if the
webserver is run with SYSTEM privileges.

It should be noted that DPGS is no longer being maintained, so a
vendor-supplied fix is unlikely.

5. Mod_SSL Off-By-One HTAccess Buffer Overflow Vulnerability
BugTraq ID: 5084
Remote: No
Date Published: Jun 22 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5084
Summary:

mod_ssl is a freely available, open source cryptography package designed
for the Apache Web Server.  It is available for the Unix and Linux
operating systems.

A problem with mod_ssl may make it possible to execute code on a
vulnerable web server with the privileges of the HTTP user.

An off-by-one issue exists in mod_ssl that affects Apache when handling
certain types of long entries in an .htaccess file.  Though this
capability within the web server is not enabled by default, it is popular
as it allows non-privileged users to create web access control schemes for
hosted sites, and is enabled through the "AllowOverride" configuration
variable in Apache.  A .htaccess file with 10000 or more bytes set into
the variable DATE_LOCALE will result in a buffer overflow within the web
server process handling the request.

This is an exploitable buffer overflow.  In the event that for a user is
able to upload or create a malicious .htaccess file, it would be possible
to execute code with the privileges of the HTTP server child process
handling the request.  This could make it possible for a user to gain
access to a shell in an environment where the user isn't authorized
regular shell access, or execute code to perform other actions as the HTTP
user.

It should be noted that Apache 1.3.26 servers compiled without the mod_ssl
package are not vulnerable to this issue.  Additionally, systems that have
an installed version of mod_ssl compiled without backward compatibility
enabled are also not vulnerable.  The default compilation of mod_ssl
enables backwards compatibility.

6. ht://Dig htsearch Cross Site Scripting Vulnerability
BugTraq ID: 5091
Remote: Yes
Date Published: Jun 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5091
Summary:

ht://Dig is a freely available, open source search engine. It is developed
and maintained by the ht://Dig project, and functions on the Unix and
Linux operating systems.

When a user submits a search request using ht://Dig, the htsearch CGI
program executes. It is possible for an attacker to create a custom URL to
htsearch.cgi which contains malicious script code. User supplied input is
not sufficiently sanitized by ht://Dig before being included in the
generated page. If such a URL is viewed by a user, the script code will
execute within the context of the vulnerable site.

Successful exploitation of this vulnerability could enable an attacker to
execute code in the security context of a trusted site. This vulnerability
may be exploited to steal cookie-based authentication credentials from
legitimate users.

7. Adobe Acrobat Reader Insecure Temporary File Creation Vulnerability
BugTraq ID: 5068
Remote: No
Date Published: Jun 20 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5068
Summary:

Acroread is a freely available PDF document reading utility distributed by
Adobe. It is available for Unix and Linux variant operating environments.

A vulnerabilty has been reported in Adobe Acroread 4.05 that may make it
possible to exploit symbolic link attacks. Acroread creates temporary
files with predictable filenames and also does not check for the existence
of files or symbolic links. As a result, a file may be created that may
corrupt an existing file in the temporary directory.

This problem is further compounded by the fact that Acroread does not
check whether or not the file is a symbolic link. In the event of the
temporary file being a symbolic link, the file at the end of the symbolic
link would be overwritten. This could result in a corruption or loss of
data.

This problem makes it possible to exploit a symbolic link attack, and
potentially overwrite files. It could additionally lead to elevated
privileges.

This vulnerability has been reported for the Linux Acroread 4.05. It is
not known whether other versions of Acroread are vulnerable.

8. APC PowerChute Plus Insecure Shared Folder Permission Vulnerability
BugTraq ID: 5069
Remote: Yes
Date Published: Jun 20 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5069
Summary:

APC PowerChute PLUS is a software package that will safely shutdown
computer systems locally or accross a network when UPS power starts to
fail. It is intended for use with Unix and Linux variant as well as
Microsoft Windows operating environments.

A vulnerability has been reported for PowerChute PLUS 5.0.2 for use with
Microsoft Windows. PowerChute Plus installs to the 'Program
Files\Pwrchute' folder. It also enables the installation folder to be
shared as PWRCHUTE with world writeable permissions without any user
notification.

If file sharing is enabled on these machines, remote attackers have access
to the shared folder. This may enable attackers install various tools to
compromise the vulnerable system or use it as a site for attacks against
other systems. If the PowerChute binaries are trojaned or replaced with a
backdoor, they may be inadvertently executed by legitimate users of the
system.

9. PHPSquidPass Index.PHP Unauthorized User Deletion Vulnerability
BugTraq ID: 5090
Remote: Yes
Date Published: Jun 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5090
Summary:

phpSquidPass is a tool designed for users to change user authentication
files for the squid web proxy. It is implemented in PHP and should be
available for use with Unix and Linux variants as well as Microsoft
Windows operating environments.

phpSquidPass may allow a malicious user of the system to overwrite
additional accounts. When a password is updated, the proxy_users file is
searched for the provided username, and that account is updated. Due to an
error in the program, usernames ending with the supplied username will
also be modified. In this case, both the username and password are
overwritten.

This effectively deletes the additional account. A malicious user may be
able to take advantage of this vulnerability to create a denial of service
condition for other users of the system. The ability to exploit this
vulnerability is, however, dependant on the possession of a valid user
account which is a substring of another username.

10. OpenSSH Challenge-Response Buffer Overflow Vulnerabilities
BugTraq ID: 5093
Remote: Yes
Date Published: Jun 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5093
Summary:

The OpenSSH team has reported that vulnerabilities exist in OpenSSH.  The
vulnerabilities are remotely exploitable and may allow for unauthenticated
attackers to obtain root privileges.

The conditions are related to the OpenSSH SSH2 challenge-response
mechanism.  They are present when the OpenSSH server is configured at
compile-time to support BSD_AUTH or SKEY.  OpenBSD 3.0 and later ship with
OpenSSH built to support BSD_AUTH.  Systems are vulnerable when either of
the following configuration options are enabled:

PAMAuthenticationViaKbdInt

ChallengeResponseAuthentication

It is possible for attackers to exploit the vulnerabilities by
constructing a malicious response.  As this occurs before the
authentication process completes, it may be exploited by remote attackers
without valid credentials.  Successful exploitation may result in the
execution of shellcode or a denial of service.

OpenSSH 3.4 has been released.  Upgrading to this version will eliminate
the vulnerability.  If this is not possible, administrators should upgrade
to version 3.3 and enable the privilege separation feature.

Privilege separation may be enabled by modifying the sshd configuration
file, found at (on many systems, configuration may differ):

/etc/ssh/sshd_config

The configuration option 'UsePrivilegeSeparation' should be set to 'Yes':

UsePrivilegeSeparation yes

Once this is done, the file should be saved and the service should be
restarted completely.

Administrators of systems using OpenSSH versions prior to 3.3 are urged to
upgrade immediately and follow the instructions listed above.  If
privilege separation does not work or the version of OpenSSH cannot be
upgraded, the following workaround is prescribed:

disable ChallengeResponseAuthentication in sshd_config.

and

disable PAMAuthenticationViaKbdInt in sshd_config.

Note: It has been reported that hackers may be developing, or have
functional exploit code.  Users are advised to upgrade immediately.


III. LINUX FOCUS LIST SUMMARY
----------------------------
1. List problems (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

2. Have I been kitted? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]


IV.NEW PRODUCTS FOR LINUX PLATFORMS
----------------------------------
1. IronMail
by CipherTrust
Platforms: N/A
Relevant URL:
http://www.ciphertrust.com/ironmail/index.htm
Summary:

Designed as a single-purpose security appliance, IronMail sits between
your network firewall and your mail servers. IronMail augments your
general-purpose network firewall by adding a second layer of
email-specific protection. Developed to support leading mail servers and
mail clients, IronMail acts as armor for your mail server(s), preventing
attacks and intrusion.

2. Symantec Gateway Security
by Symantec
Platforms: N/A
Relevant URL:
http://enterprisesecurity.symantec.com/products/products.cfm?ProductID=133
Summary:

Symantec Gateway Security is the first comprehensive gateway protection
solution that addresses the unique security needs of small and
medium-sized offices by combining five essential network security
functions in a single, easy-to-manage appliance. The fully integrated
rack-mountable unit protects against today's multi-faceted security
threats through a unique combination of state-of-the-art firewall,
anti-virus, Internet content filtering, intrusion detection, and virtual
private networking technologies.

3. Ringneck Security Console (RSC)
by Ringneck Technologies
Platforms: N/A
Relevant URL:
http://www.ringnecktech.net/solution.htm
Summary:

Ringneck Security Console (RSC) platform integrates all network security
tools into a single management console. It is a unique framework that
allows users to plug in their own arsenal of network security tools. It
does not require the user purchase "security suites" or a given set of
security tools. Users can individually tailor RSC for both global and
locally enacted policies empowers network security administrators across
institutions (corporate, federal or education networks) to be aware of
cyber-threats across their network (locally, across the country, or
globally). Administrators are able to access all relevant information from
a single platform, and to quickly choose a course of action appropriate to
the level of attack.


V. NEW TOOLS FOR LINUX PLATFORMS
---------------------------------
1. XLNT Procguard v1.0
by Adrianus Warmenhoven
Relevant URL:
http://www.xlnt-software.com/procguard_dl.html
Platforms: FreeBSD, Linux, Solaris
Summary:

XLNT Procguard monitors a basic Unix daemon. It uses the fastest timer
available and restarts the daemon if it dies. It can join a running daemon
or it can be used in a startup script.

2. CRM v20020626
by Crah the Merciless
Relevant URL:
http://crm114.sourceforge.net/
Platforms: Linux, POSIX
Summary:

CRM is a very powerful filtering and mutilation language based on regex
operations. It is capable of classifying mail messages, syslogs, firewall
logs, and other incoming streams of unbounded length. It has a very
powerful sparse-spectral learning capability; given examples of multiple
classes (say, business email, jokes, and spam), it can learn to
discriminate the classes.

3. ssh-multiadd v1.3.2
by Matthew Mueller
Relevant URL:
http://www.azstarnet.com/~donut/programs/index_s.html#ssh-multiadd
Platforms: Linux, POSIX
Summary:

ssh-multiadd adds multiple ssh keys to the ssh authentication agent. These
may use the same passphrase. When run without arguments, it adds
$HOME/.ssh/identity and $HOME/.ssh/id_dsa. Alternative file names can be
given on the command line or in the configuration file. It uses
ssh-askpass if necessary. Unlike ssh-add, if any of the keys use the same
passphrase, you will only need to enter each unique passphrase once, and
keys that are already added will not be prompted for again.

4. BackerUpper v0.3
by Kevin L. Ellis
Relevant URL:
http://www.bluelavalamp.net/backerupper
Platforms: Linux, UNIX
Summary:

BackerUpper is a simple, easy to configure backup utility that will
perform monthly full backups and daily incremental backups. Backups are
created in the zip file format.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!

http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml

-------------------------------------------------------------------------------