SecurityFocus Linux Newsletter #272

SecurityFocus Linux Newsletter #272
----------------------------------------

This Issue is Sponsored By: 8e6 Technologies

Stop Spyware Now - Free White Paper!
Spyware remains a problem for most companies, disrupting productivity, wasting time and money. Now 8e6 Technologies' free White Paper proposes breakthrough solutions to counteract the Spyware problem: recognize potential infections, stop unauthorized programs at the source. Get the Free White Paper.

http://a.gklmedia.com/sfln/nl/110

------------------------------------------------------------------
I.   FRONT AND CENTER
        1. Malicious Malware: attacking the attackers, part 2
        2. Nmap 4.00 with Fyodor
II.  LINUX VULNERABILITY SUMMARY
        1. Communigate Pro Server LDAP Denial of Service Vulnerability
        2. Linux Kernel Multiple Security Vulnerabilities
        3. Pioneers Chat Buffer Denial Of Service Vulnerability
        4. MyDNS DNS Query Denial Of Service Vulnerability
        5. Mail-Audit Insecure Temporary File Creation Vulnerability
        6. Fcron Convert-FCronTab Local Buffer Overflow Vulnerability
        7. Multiple Mozilla Products Memory Corruption/Code Injection/Access Restriction Bypass Vulnerabilities
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Malicious Malware: attacking the attackers, part 2
By Thorsten Holz, Frederic Raynal
This article explores measures to attack those malicious attackers who seek to harm our legitimate systems. The proactive use of exploits and bot networks that fight other bot networks, along with social engineering and attacker techniques are all discussed in an ethical manner. Part two of two.
http://www.securityfocus.com/infocus/1857

2. Nmap 4.00 with Fyodor
By Federico Biancuzzi
After more than eight years since its first release in Phrack magazine, Fyodor has announced Nmap 4.00. Curious as usual, Federico Biancuzzi interviewed Fyodor on behalf of SecurityFocus to discuss the new port scanning engine, version detection improvements, and the new stack fingerprinting algorithm under work by the community.
http://www.securityfocus.com/columnists/384


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Communigate Pro Server LDAP Denial of Service Vulnerability
BugTraq ID: 16407
Remote: Yes
Date Published: 2006-01-28
Relevant URL: http://www.securityfocus.com/bid/16407
Summary:
CommuniGate Pro Server is prone to a remote denial-of-service vulnerability with a potential for arbitrary code execution. This issue reportedly resides in the LDAP component of the application.

CommuniGate Pro Server 5.0.6 is vulnerable; earlier versions may also be affected.

2. Linux Kernel Multiple Security Vulnerabilities
BugTraq ID: 16414
Remote: Yes
Date Published: 2006-01-30
Relevant URL: http://www.securityfocus.com/bid/16414
Summary:
Linux kernel is prone to multiple vulnerabilities. These issues can allow local and remote attackers to trigger denial-of-service conditions or to corrupt memory to potentially execute arbitrary code.

These issues affect kernel versions 2.6.15 and prior.

3. Pioneers Chat Buffer Denial Of Service Vulnerability
BugTraq ID: 16429
Remote: Yes
Date Published: 2006-01-30
Relevant URL: http://www.securityfocus.com/bid/16429
Summary:
Pioneers is prone to a remote denial-of-service vulnerability. This issue is due to a failure in the application to handle exceptional conditions.

An attacker can exploit this issue to crash the affected Pioneers server and possibly clients connected to a vulnerable Pioneers server.

This issue is reported to affect version 0.9.40; other versions may also be vulnerable.

4. MyDNS DNS Query Denial Of Service Vulnerability
BugTraq ID: 16431
Remote: Yes
Date Published: 2006-01-30
Relevant URL: http://www.securityfocus.com/bid/16431
Summary:
MyDNS is prone to a remote denial-of-service vulnerability. This issue is due to a failure in the application to properly handle DNS queries.

An attacker can exploit this issue to crash the affected service, effectively denying service to legitimate users.

The vendor has addressed this issue in version 1.1.0; earlier versions are reportedly vulnerable.

5. Mail-Audit Insecure Temporary File Creation Vulnerability
BugTraq ID: 16434
Remote: No
Date Published: 2006-01-31
Relevant URL: http://www.securityfocus.com/bid/16434
Summary:
Mail-Audit creates temporary files in an insecure manner. This issue arises only when logging has been enabled.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.


Mail-Audit 2.1 and prior versions are considered vulnerable.

6. Fcron Convert-FCronTab Local Buffer Overflow Vulnerability
BugTraq ID: 16467
Remote: No
Date Published: 2006-02-01
Relevant URL: http://www.securityfocus.com/bid/16467
Summary:
Fcron is susceptible to a local buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

This issue allows local attackers to execute arbitrary machine code with superuser privileges, since the affected utility is installed setuid-superuser by default in some installations. This allows attackers to completely compromise affected computers.

Fcron version 3.0 is affected by this issue; previous versions may also be affected.

Update: This issue is now retired. Further analysis reveals that this issue cannot be exploited for code execution; therefore, this is not a vulnerability.

7. Multiple Mozilla Products Memory Corruption/Code Injection/Access Restriction Bypass Vulnerabilities
BugTraq ID: 16476
Remote: Yes
Date Published: 2006-02-02
Relevant URL: http://www.securityfocus.com/bid/16476
Summary:
Multiple Mozilla products are prone to multiple vulnerabilities. These issues include various memory-corruption, code-injection, and access-restriction-bypass vulnerabilities. Other undisclosed issues may have also been addressed in the various updated vendor applications.

Successful exploitation of these issues may permit an attacker to execute arbitrary code in the context of the affected application. This may facilitate a compromise of the affected computer; other attacks are also possible.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: 8e6 Technologies

Stop Spyware Now - Free White Paper!
Spyware remains a problem for most companies, disrupting productivity, wasting time and money. Now 8e6 Technologies' free White Paper proposes breakthrough solutions to counteract the Spyware problem: recognize potential infections, stop unauthorized programs at the source. Get the Free White Paper.

http://a.gklmedia.com/sfln/nl/110