SecurityFocus Linux Newsletter #271

Peter Laborge <[email protected]> Wed, 01 Feb 2006 11:54:03 -0700

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #271
----------------------------------------

This Issue is Sponsored By: 8e6 Technologies

Stop Spyware Now - Free White Paper!
Spyware remains a problem for most companies, disrupting productivity, wasting time and money. Now 8e6 Technologies' free White Paper proposes breakthrough solutions to counteract the Spyware problem: recognize potential infections, stop unauthorized programs at the source. Get the Free White Paper.

http://a.gklmedia.com/sfln/nl/110

------------------------------------------------------------------
I. FRONT AND CENTER
1. Google's data minefield
2. Nmap 4.00 with Fyodor
3. Malicious Malware: attacking the attackers, part 1
II. LINUX VULNERABILITY SUMMARY
1. Red Hat Directory Server / Certificate Server Management Console Buffer Overflow Vulnerability
2. Eterm LibAST Library Local Buffer Overflow Vulnerability
3. LSH Seed File File Descriptor Leakage Vulnerability
4. OpenSSH SCP Shell Command Execution Vulnerability
5. SUSE NFS-SERVER Remote Buffer Overflow Vulnerability
6. Communigate Pro Server LDAP Denial of Service Vulnerability
7. Linux Kernel Multiple Security Vulnerabilities
8. MyDNS DNS Query Denial Of Service Vulnerability
9. Mail-Audit Insecure Temporary File Creation Vulnerability
III. LINUX FOCUS LIST SUMMARY
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Google's data minefield
By Mark Rasch
The U.S. government's broad subpoena to search engines effectively seeks to mine the data of the Internet. While Google has resisted the subpoena, there may be little they can do to protect our privacy from many prying eyes.
http://www.securityfocus.com/columnists/383

2. Nmap 4.00 with Fyodor
By Federico Biancuzzi
After more than eight years since its first release in Phrack magazine, Fyodor has announced Nmap 4.00. Curious as usual, Federico Biancuzzi interviewed Fyodor on behalf of SecurityFocus to discuss the new port scanning engine, version detection improvements, and the new stack fingerprinting algorithm under work by the community.
http://www.securityfocus.com/columnists/384

3. Malicious Malware: attacking the attackers, part 1
By Thorsten Holz, Frederic Raynal
This article explores measures to attack those malicious attackers who seek to harm our legitimate systems. The proactive use of exploits and bot networks that fight other bot networks, along with social engineering and attacker techniques are all discussed in an ethical manner. Part one of two.
http://www.securityfocus.com/infocus/1856

II. LINUX VULNERABILITY SUMMARY
------------------------------------
1. Red Hat Directory Server / Certificate Server Management Console Buffer Overflow Vulnerability
BugTraq ID: 16345
Remote: Yes
Date Published: 2006-01-23
Relevant URL: http://www.securityfocus.com/bid/16345
Summary:
Red Hat Directory Server and Certificate Server are prone to a buffer-overflow vulnerability.

This issue affects the Admin pages of the Management Console.

Reports indicate that this issue can be exploited remotely to execute arbitrary code under some circumstances; local attackers may be able to gain superuser privileges by executing arbitrary code.

A successful attack may lead to a complete compromise.

2. Eterm LibAST Library Local Buffer Overflow Vulnerability
BugTraq ID: 16350
Remote: No
Date Published: 2006-01-23
Relevant URL: http://www.securityfocus.com/bid/16350
Summary:
Eterm LibAST library is prone to a local buffer-overflow vulnerability.

An attacker can trigger this issue by supplying a long filename through the '-X' option of Eterm. A successful attack can corrupt memory and facilitate arbitrary code execution with the privileges of the 'utmp' user.

LibAST versions 0.6.1 and prior are vulnerable to this issue.

Note that other applications using the affected library may be vulnerable as well.

3. LSH Seed File File Descriptor Leakage Vulnerability
BugTraq ID: 16357
Remote: No
Date Published: 2006-01-23
Relevant URL: http://www.securityfocus.com/bid/16357
Summary:
lsh may leak file descriptors that may allow a local attacker to access sensitive information or to cause a denial-of-service condition.

lsh 2.0.1 is reportedly vulnerable. Other versions may be affected as well.

4. OpenSSH SCP Shell Command Execution Vulnerability
BugTraq ID: 16369
Remote: Yes
Date Published: 2006-01-24
Relevant URL: http://www.securityfocus.com/bid/16369
Summary:
OpenSSH is susceptible to an SCP shell command-execution vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input before using it in a 'system()' function call.

This issue allows attackers to execute arbitrary shell commands with the privileges of users executing a vulnerable version of SCP.

This issue reportedly affects version 4.2 of OpenSSH. Other versions may also be affected.

5. SUSE NFS-SERVER Remote Buffer Overflow Vulnerability
BugTraq ID: 16388
Remote: Yes
Date Published: 2006-01-26
Relevant URL: http://www.securityfocus.com/bid/16388
Summary:
SUSE 'nfs-server' is prone to a remote buffer-overflow vulnerability.

A remote attacker with the ability to create symlinks on any of the filesystems on an affected computer running 'rpc.mountd' can exploit this issue to execute arbitrary code. Attackers without filesystem access may also be able to execute arbitrary code, but this has not been confirmed.

Note that the 'nfs-server' package is obsolete but still available in SUSE Linux products. The 'nfs-utils' package is not affected by this issue.

6. Communigate Pro Server LDAP Denial of Service Vulnerability
BugTraq ID: 16407
Remote: Yes
Date Published: 2006-01-28
Relevant URL: http://www.securityfocus.com/bid/16407
Summary:
CommuniGate Pro Server is prone to a remote denial-of-service vulnerability with a potential for arbitrary code execution. This issue reportedly resides in the LDAP component of the application.

CommuniGate Pro Server 5.0.6 is vulnerable; earlier versions may also be affected.

7. Linux Kernel Multiple Security Vulnerabilities
BugTraq ID: 16414
Remote: Yes
Date Published: 2006-01-30
Relevant URL: http://www.securityfocus.com/bid/16414
Summary:
Linux kernel is prone to multiple vulnerabilities. These issues can allow local and remote attackers to trigger denial-of-service conditions or to corrupt memory to potentially execute arbitrary code.

These issues affect kernel versions 2.6.15 and prior.

8. MyDNS DNS Query Denial Of Service Vulnerability
BugTraq ID: 16431
Remote: Yes
Date Published: 2006-01-30
Relevant URL: http://www.securityfocus.com/bid/16431
Summary:
MyDNS is prone to a remote denial-of-service vulnerability. This issue is due to a failure in the application to properly handle DNS queries.

An attacker can exploit this issue to crash the affected service, effectively denying service to legitimate users.

The vendor has addressed this issue in version 1.1.0; earlier versions are reportedly vulnerable.

9. Mail-Audit Insecure Temporary File Creation Vulnerability
BugTraq ID: 16434
Remote: No
Date Published: 2006-01-31
Relevant URL: http://www.securityfocus.com/bid/16434
Summary:
Mail-Audit creates temporary files in an insecure manner. This issue arises only when logging has been enabled.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.

Mail-Audit 2.1 and prior versions are considered vulnerable.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V. SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: 8e6 Technologies

http://a.gklmedia.com/sfln/nl/110