SecurityFocus Linux Newsletter #275

Peter Laborge <[email protected]> Tue, 28 Feb 2006 15:09:21 -0700
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #275
----------------------------------------

This Issue is Sponsored By: SpiDynamics

ALERT: "How a Hacker Launches a SQL Injection Attack!"-  SPI Dynamics White Paper It's as simple as placing additional SQL commands into a Web Form input box giving hackers complete access to all your backend systems! Firewalls and IDS will not stop such attacks because SQL Injections are NOT seen as intruders. Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70130000000C543

------------------------------------------------------------------
I.   FRONT AND CENTER
        1. John the Ripper 1.7, by Solar Designer
        2. Zero to IPSec in 4 minutes
        3. Spreading security awareness for OS X
II.  LINUX VULNERABILITY SUMMARY
        1. Bugzilla Whinedays SQL Injection Vulnerability
        2. Bugzilla User Credentials Information Disclosure Vulnerability
        3. SquirrelMail Multiple Cross-Site Scripting and IMAP Injection Vulnerabilities
        4. Linux Kernel SDLA_XFER Kernel Memory Disclosure Vulnerability
        5. GNU Tar Invalid Headers Buffer Overflow Vulnerability
        6. ViRobot Linux Server Authentication Bypass Vulnerability
        7. Mozilla Thunderbird IFRAME JavaScript Execution Vulnerability
        8. SUSE CASA Pam_Micasa Remote Buffer Overflow Vulnerability
        9. Zoo Misc.c Buffer Overflow Vulnerability
        10. PHPWebSite Topics.PHP SQL Injection Vulnerability
        11. Simple Machines X-Forwarded-For HTML Injection Vulnerability
        12. MySQL Query Logging Bypass Vulnerability
III. LINUX FOCUS LIST SUMMARY
        1. Kryptor Whitepaper released
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. John the Ripper 1.7, by Solar Designer
By Federico Biancuzzi
Federico Biancuzzi interviews Solar Designer, creator of the popular John the Ripper password cracker. Solar Designer discusses what's new in version 1.7, the advantages of popular cryptographic hashes, the relative speed at which many passwords can now be cracked, and how one can choose strong passphrases (forget passwords) that are harder to break.
http://www.securityfocus.com/columnists/388

2. Zero to IPSec in 4 minutes
By Dragos Ruiu
This short article looks at how to get a fully functional IPSec VPN up and running between two fresh OpenBSD installations in about four minutes flat.
http://www.securityfocus.com/infocus/1859

3. Spreading security awareness for OS X
By Robert Lemos
Robert Lemos interviews Kevin Finisterre, founder of security startup Digital Munition, who created the three recent versions of the InqTana worm to raise awareness of security in Apple's OS X. Finisterre discusses his reasons for creating the worms, the problems with Mac OS X security, and why he does not fear prosecution.
http://www.securityfocus.com/columnists/389


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Bugzilla Whinedays SQL Injection Vulnerability
BugTraq ID: 16738
Remote: Yes
Date Published: 2006-02-21
Relevant URL: http://www.securityfocus.com/bid/16738
Summary:
Bugzilla is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Exploitation of this issue requires the attacker to have administrative access to the affected application.

2. Bugzilla User Credentials Information Disclosure Vulnerability
BugTraq ID: 16745
Remote: Yes
Date Published: 2006-02-21
Relevant URL: http://www.securityfocus.com/bid/16745
Summary:
Bugzilla is prone to an information-disclosure vulnerability. This issue is due to a design error in the application.

An attacker can exploit this issue by tricking a victim user into following a malicious URI and then retrieving the victim user's login credentials.

To successfully exploit this issue, the attacker requires the name of the path where the login page resides and resolves to a computer on the local network of the victim user.

3. SquirrelMail Multiple Cross-Site Scripting and IMAP Injection Vulnerabilities
BugTraq ID: 16756
Remote: Yes
Date Published: 2006-02-21
Relevant URL: http://www.securityfocus.com/bid/16756
Summary:
SquirrelMail is susceptible to multiple cross-site scripting and IMAP-injection vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input.

An attacker may leverage any of the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

An attacker may leverage the IMAP-injection issue to execute arbitrary IMAP commands on the configured IMAP server. This may aid attackers in further attacks as well as allow them to exploit latent vulnerabilities in the IMAP server.

4. Linux Kernel SDLA_XFER Kernel Memory Disclosure Vulnerability
BugTraq ID: 16759
Remote: No
Date Published: 2006-02-21
Relevant URL: http://www.securityfocus.com/bid/16759
Summary:
The Linux kernel is affected by a local memory-disclosure vulnerability.

This issue allows an attacker to read kernel memory. Information gathered via exploitation may aid malicious users in further attacks.

This issue affects kernel versions 2.4.x up to 2.4.29-rc1, and 2.6.x up to 2.6.5.

5. GNU Tar Invalid Headers Buffer Overflow Vulnerability
BugTraq ID: 16764
Remote: Yes
Date Published: 2006-02-22
Relevant URL: http://www.securityfocus.com/bid/16764
Summary:
GNU Tar is prone to a buffer overflow when handling invalid headers.  Successful exploitation could potentially lead to arbitrary code execution, though this has not been confirmed.

Tar versions 1.14 and above are vulnerable.

6. ViRobot Linux Server Authentication Bypass Vulnerability
BugTraq ID: 16768
Remote: Yes
Date Published: 2006-02-22
Relevant URL: http://www.securityfocus.com/bid/16768
Summary:
ViRobot Linux Server is prone to an authentication-bypass vulnerability.

Remote attackers can exploit this issue to gain access to the application's file-scanning functionality.

Presumably, the exploitation of this issue may allow attackers to carry out other attacks, such as triggering denial-of-service conditions by scanning a large number of large files. Other attacks due to latent vulnerabilities in the application are possible.

ViRobot Linux Server 2.0 (20050817) is reportedly vulnerable. Other versions may be affected as well.

7. Mozilla Thunderbird IFRAME JavaScript Execution Vulnerability
BugTraq ID: 16770
Remote: Yes
Date Published: 2006-02-22
Relevant URL: http://www.securityfocus.com/bid/16770
Summary:
Mozilla Thunderbird is prone to a script-execution vulnerability.

The vulnerability presents itself when an attacker supplies a specially crafted email to a user containing malicious script code in an IFRAME and the user tries to reply to the mail. Arbitrary JavaScript can be executed even if the user has disabled JavaScript execution in the client.

Mozilla Thunderbird 1.0.7 and prior versions are reportedly affected.

8. SUSE CASA Pam_Micasa Remote Buffer Overflow Vulnerability
BugTraq ID: 16779
Remote: Yes
Date Published: 2006-02-22
Relevant URL: http://www.securityfocus.com/bid/16779
Summary:
SUSE CASA is prone to a remote buffer-overflow vulnerability.

This issue can allow remote attackers to gain superuser privileges to a vulnerable computer by executing arbitrary code.

The 'pam_micasa' module is affected.

9. Zoo Misc.c Buffer Overflow Vulnerability
BugTraq ID: 16790
Remote: Yes
Date Published: 2006-02-23
Relevant URL: http://www.securityfocus.com/bid/16790
Summary:
Zoo is prone to a buffer-overflow vulnerability. This issue is due to a failure in the application to do proper bounds checking on user-supplied data before using it in a finite-sized buffer.

An attacker can exploit this issue to execute arbitrary code in the context of the victim user running the affected application.

10. PHPWebSite Topics.PHP SQL Injection Vulnerability
BugTraq ID: 16825
Remote: Yes
Date Published: 2006-02-25
Relevant URL: http://www.securityfocus.com/bid/16825
Summary:
phpWebSite is prone to an SQL injection vulnerability.  This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

11. Simple Machines X-Forwarded-For HTML Injection Vulnerability
BugTraq ID: 16841
Remote: Yes
Date Published: 2006-02-24
Relevant URL: http://www.securityfocus.com/bid/16841
Summary:
Simple Machines is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.


This issue is reported to affect Simple Machines version 1.0.6 and earlier.

12. MySQL Query Logging Bypass Vulnerability
BugTraq ID: 16850
Remote: Yes
Date Published: 2006-02-27
Relevant URL: http://www.securityfocus.com/bid/16850
Summary:
MySQL is susceptible to a query logging bypass vulnerability. This issue is due to a discrepency between the handling of NULL bytes in input data.

  This issue allows attackers to bypass the query logging functionality of the database, so they can cause malicious SQL queries to be improperly logged. This may aid them in hiding the traces of malicious activity from administrators.

  This issue affects MySQL version 5.0.18; other versions may also be affected.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Kryptor Whitepaper released
http://www.securityfocus.com/archive/91/425067

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: SpiDynamics

ALERT: "How a Hacker Launches a SQL Injection Attack!"-  SPI Dynamics White Paper It's as simple as placing additional SQL commands into a Web Form input box giving hackers complete access to all your backend systems! Firewalls and IDS will not stop such attacks because SQL Injections are NOT seen as intruders. Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70130000000C543