SecurityFocus Linux Newsletter #88

John Boletta <[email protected]> Mon, 8 Jul 2002 10:29:03 -0600 (MDT)

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #88
--------------------------------

This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Clickwrap and Shrinkwrap Risks: The Security Concerns of...
2. One of These Things is not Like the Others: The State of...
3. Secure i-World
4. Black Hat Briefings & Training
II. LINUX VULNERABILITY SUMMARY
1. Sendmail DNS Map TXT Record Buffer Overflow Vulnerability
2. F2HTML.PL SQL Injection Vulnerability
3. Bonobo EFSTool Commandline Argument Buffer Overflow Vulnerability
4. Simple WAIS Interface Arbitrary Command Execution Vulnerability
5. E-Guest Guest Book Script Injection Vulnerability
6. E-Guest Server Side Include Arbitrary Command Execution...
7. Zap Book Server Side Include Arbitrary Command Execution...
8 . Zap Book Script Injection Vulnerability
9. Macromedia JRun Source Disclosure Vulnerabilities
10. Betsie Parserl.PL Cross-Site Scripting Vulnerability
11. NEC Socks5 User Name Buffer Overflow Vulnerability
12. NEC Socks4 User Name Buffer Overflow Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. OpenSSH 3.4 rpm spec file for redhat (Thread)
2. Apache update from SuSE ?? (Thread)
3. Worm update info (Thread)
4. Apache worm (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. InsideOut Firewall Reporter
2. hp secure OS software for Linux
3. PakSecured VPN Server
V. NEW TOOLS FOR LINUX PLATFORMS
1. RADIUS module for Ruby v1.0.0
2. Wireless Access Point Utilites for Unix v1.0.2
3. conntrack viewer v1.1
4. cipherfunk Patched Linux Kernels v2.4.19rc1 (2.4-pre)
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. Clickwrap and Shrinkwrap Risks: The Security Concerns of Licensing
Agreements
By Steven Robinson

This is the first of two articles that will discuss some security issues
surrounding software licenses and agreements for Web-based information
services. This article will discusses why security professionals need to
be particularly aware of some issues that these licensing agreements
present.

http://online.securityfocus.com/infocus/1602

2. One of These Things is not Like the Others: The State of Anomaly
Detection
by Matthew Tanase

"To some, our observations can be summarized succinctly as "bugs happen".
That certainly is not news. But dismissing our results so cavalierly
misses the point. Yes, bugs happen. But bugs can be fixed -if they are
detected. The Internet is, as a whole, working remarkably well. Huge
software packages (i.e., X11R5) can be distributed electronically.
Connections span the globe. But the very success of the Internet makes
some bugs invisible." - Steven Bellovin

http://online.securityfocus.com/infocus/1600

3. Secure i-World

August 19-21, 2002, San Diego, CA
Optional Workshops August 17, 18, 21, & 22
Vendor Expo August 19 & 20

WebSec 2002, Online Privacy Conference, Secure i-World Expotwo innovative
conferences and one outstanding expo, all in one blockbuster event.

Please visit us at: http://www.secureiworld.com/06/sw02nl18inf.html

4. Attend Black Hat Briefings & Training

Attend Black Hat Briefings & Training, July 29 - August 1, Las Vegas, the
world's premier technical security event!

8 tracks, 12 training sessions, Richard Clarke keynote, 1500 delegates
from 30 nations, with a near cult following of both CSOs and "underground"
security experts.

See for yourself what the buzz is all about. www.blackhat.com

II. BUGTRAQ SUMMARY
-------------------
1. Sendmail DNS Map TXT Record Buffer Overflow Vulnerability
BugTraq ID: 5122
Remote: Yes
Date Published: Jun 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5122
Summary:

Sendmail is a freely available, open source mail transport agent. It is
available for most Unix and Linux operating systems.

A problem with Sendmail has been reported that may allow remote code
execution. The problem is in the handling of some types of DNS records.

A buffer overflow in the DNS handling code of Sendmail has been
discovered. Sendmail attempting to map an address using a TXT query type
does not properly check bounds on data returned from the nameserver.
Because of this, a malicious nameserver could send a string of arbitrary
length to the mail server, resulting in a buffer overflow, and potential
code execution.

It has been asserted by the Sendmail Consortium that there are no known
configurations that use this type of DNS mapping. Because of this, the
likelihood of exploitation is considered to be low, and has been called
"theoretical" by the Sendmail Consortium.

If the vulnerability were to be exploited by a malicious nameserver, code
would be executed on the vulnerable system with the privileges of the
sendmail program. As this program is typically a root-owned process, this
could result in root-level compromise of a vulnerable system.

2. F2HTML.PL SQL Injection Vulnerability
BugTraq ID: 5123
Remote: No
Date Published: Jun 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5123
Summary:

f2html.pl is a Perl script which searches recursively through directories
looking for certain types of files, and then creates a HTML page
containing directory listings. It stores listings in a database. It will
run on most Unix and Linux variants as well as Microsoft Windows operating
systems.

The f2html.pl script does not sufficiently validate filenames before
passing them into SQL queries. In the instance that f2html.pl is used to
search a directory which may be accessible to untrusted local users, it
may be possible to launch a SQL injection attack via a maliciously crafted
filename.

An attacker may exploit this condition to modify the logic of SQL queries.

3. Bonobo EFSTool Commandline Argument Buffer Overflow Vulnerability
BugTraq ID: 5125
Remote: No
Date Published: Jun 29 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5125
Summary:

Bonobo is a set of tools and CORBA interfaces included as part of the
Gnome infrastructure. It is designed for use on the Linux and Unix
operating systems.

A problem with the efstool component of Bonobo could make it possible for
a local user to gain elevated privileges. The problem is in the handling
of long strings.

A boundry condition error has been discovered in the efstool program.
Due to improper bounds checking, it is possible for a user to supply a
long commandline argument to the efstool program, which would result in a
buffer overflow. This problem could be exploited on the local system to
overwrite stack memory, including the return address, and execute attacker
supplied code.

It should be noted that recent versions of the efstool program are not
installed with setuid privileges. However, older versions of the Bonobo
package install this program as a setuid root executable. Due to the
default permissions of this program, an attacker could exploit this
program to execute code as root.

4. Simple WAIS Interface Arbitrary Command Execution Vulnerability
BugTraq ID: 5127
Remote: Yes
Date Published: Jun 29 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5127
Summary:

The Simple WAIS interface is an integrated interface to the WAIS system.
It is designed for use on Unix and Linux operating systems.

A problem with the interface could allow arbitrary command execution.
The problem is in the handling of some types of input.

The Simple WAIS interface does not properly handle some types of input.
Because of the insufficient santizing of user-supplied input, it is
possible for a user with access to the interface to execute arbitrary
commands with the privileges of the SWAIS daemon.

By passing a search to the interface with a pipe symbol (|) followed by a
command, a user could execute commands on the local system.

This problem could allow a remote attacker with access to the wais
interface to execute arbitrary commands, and potentially gain access to
the vulnerable host with the privileges of the SWAIS daemon.

5. E-Guest Guest Book Script Injection Vulnerability
BugTraq ID: 5128
Remote: Yes
Date Published: Jun 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5128
Summary:

E-Guest guest book is a freely available, open source guest book. It is
designed for Unix and Linux operating systems.

A problem with the guest book could lead to the injection of script code.

E-Guest does not properly filter script code from some fields of the guest
book entries. It is possible for a remote user to enter HTML and script
code in the name, email, homepage, and location fields. Upon visiting the
page, this script code would be executed in browser of the visiting user.

This problem could make it possible for a remote attacker to execute
script code in the security context of an arbitrary site.

6. E-Guest Server Side Include Arbitrary Command Execution Vulnerability
BugTraq ID: 5129
Remote: Yes
Date Published: Jun 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5129
Summary:

E-Guest guest book is a freely available, open source guest book. It is
designed for Unix and Linux operating systems.

A problem with the guest book could make it possible for a remote user to
execute arbitrary commands through a vulnerable implementation.

E-Guest does not adequately sanitize user-supplied input in guest book
entries. Because of this, it is possible to pass along commands via
server-side includes that could allow a remote user to execute commands on
the local host. This could result in a user gaining local access with the
privileges of the HTTP server.

7. Zap Book Server Side Include Arbitrary Command Execution Vulnerability
BugTraq ID: 5130
Remote: Yes
Date Published: Jun 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5130
Summary:

Zap Book is a freely available, open source guest book. It is designed
for Unix and Linux operating systems.

A problem with the guest book could make it possible for a remote user to
execute arbitrary commands through a vulnerable implementation.

Zap Book does not adequately sanitize user-supplied input in guest book
entries. Because of this, it is possible to pass along commands via
server-side includes that could allow a remote user to execute commands on
the local host. This could result in a user gaining local access with the
privileges of the HTTP server.

8. Zap Book Script Injection Vulnerability
BugTraq ID: 5131
Remote: Yes
Date Published: Jun 30 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5131
Summary:

Zap Book is a freely available, open source guest book. It is designed
for Unix and Linux operating systems.

A problem with the guest book could lead to the injection of script code.

Zap Book does not properly filter script code from some fields of the
guest book entries. It is possible for a remote user to enter HTML and
script code in the name, email, homepage, and location fields. Upon
visiting the page, this script code would be executed in browser of the
visiting user.

This problem could make it possible for a remote attacker to execute
script code in the security context of an arbitrary site.

9. Macromedia JRun Source Disclosure Vulnerabilities
BugTraq ID: 5134
Remote: Yes
Date Published: Jul 01 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5134
Summary:

Macromedia JRun is a J2EE application server for use with IIS 4/5 on the
Microsoft Windows operating systems. It is also available for Unix and
Linux variants.

Macromedia JRun is prone to a number of source code disclosure issues.
These issues are reportedly due to improper handling of null characters.
Malformed requests containing variations of null characters may cause JRun
to serve .JSP files uninterpreted. One example of how this may be
exploited is to append a unicode null character to the end of a valid
request.

This may allow remote attackers to disclose the contents of arbitrary .JSP
files. Remote attackers may exploit this issue to gain access to
sensitive information contained in source files (such as database
credentials).

10. Betsie Parserl.PL Cross-Site Scripting Vulnerability
BugTraq ID: 5135
Remote: Yes
Date Published: Jul 01 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5135
Summary:

Betsie (BBC Education Text to Speech Internet Enhancer) is a script to
supports users of text to speech systems for web browsing. It is written
in Perl and will run on Microsoft Windows operating systems as well as
Unix and Linux variants.

Betsie is prone to a cross-site scripting vulnerability. This issue
exists in the parserl.pl script. The vulnerable script fails to sanitize
HTML tags from CGI parameters.

Attackers may exploit this condition via a malicious link to a site
running the vulnerable software. Successful exploitation will enable an
attacker to cause script code to be executed in the web browser of a user
who visits the malicious link. The attacker's script code will be
executed in the context of the site running the vulnerable software.

Attackers may exploit this condition to steal cookie-based authentication
credentials from legitimate users.

11. NEC Socks5 User Name Buffer Overflow Vulnerability
BugTraq ID: 5145
Remote: Yes
Date Published: Jul 03 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5145
Summary:

Socks5 is the freely available, open source proxy implementation developed
by NEC. It is available for Unix, Linux, and Microsoft operating
environments.

A problem with the implementation may make it possible for a remote user
to exploit a buffer overflow. The problem is in the handling of user
names.

Socks5 handles user names in an unsafe manner. A boundary condition error
in the software package may make it possible for users to send user names
of 132 bytes or greater, and cause memory corruption.

It is unknown whether this issue is a buffer overflow that may be
exploited to execute arbitrary code. Exploitation of this vulnerability
could minimally result in the crashing of the socks5 process, and denial
of service to legitimate users of the service.

In the event that this is an exploitable buffer overflow, this
vulnerability could be used to execute code with the privileges of the
socks5 process.

12. NEC Socks4 User Name Buffer Overflow Vulnerability
BugTraq ID: 5147
Remote: Yes
Date Published: Jul 03 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/5147
Summary:

Socks4 is the freely available, open source proxy implementation developed
by NEC. It is available for Unix, Linux, and Microsoft operating
environments.

A problem with the implementation may make it possible for a local user to
exploit a buffer overflow. The problem is in the handling of user names.

Socks4 handles user names in an unsafe manner. A boundary condition error
in the software package may make it possible for users to send user names
of 132 bytes or greater, and cause memory corruption.

It is unknown whether this issue is a buffer overflow that may be
exploited to execute arbitrary code. Exploitation of this vulnerability
could minimally result in the crashing of the socks4 process, and denial
of service to legitimate users of the service.

In the event that this is an exploitable buffer overflow, this
vulnerability could be used to execute code with the privileges of the
socks4 process.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. OpenSSH 3.4 rpm spec file for redhat (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/Pine.LNX.4.44.0207041530330.14982-100000@xanadu.astro.Princeton.EDU

2. Apache update from SuSE ?? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/Pine.LNX.4.44.0207031519390.1923-100000@tinberg.wi.securepipe.com

3. Worm update info (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

4. Apache worm (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

IV.NEW PRODUCTS FOR LINUX PLATFORMS
-----------------------------------
1. InsideOut Firewall Reporter
by Stonylake Solutions
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Relevant URL:
http://www.stonylakesolutions.com/insideout.asp
Summary:

InsideOut Firewall Reporter is an easy to use, powerful, real time,
browser based reporting application for firewall logs. It provides over
150 useful reports. Windows and Linux versions available. Visit the site
for a live demo.

2. hp secure OS software for Linux
by Hewlett-Packard
Platforms: N/A
Relevant URL:
http://www.hp.com/security/products/linux/
Summary:

A secure server platform for Linux as an enhancement to the HP Netaction
software suite. HP Secure OS Software for Linux, will help businesses
secure their Linux environments by offering intrusion prevention,
real-time protection against attacks, and damage containment. HP is first
to market with this business-critical security solution for Linux. HP
Secure OS Software for Linux provides high reliability, performance,
availability, flexibility and scalability. Additionally, it is easy to
install and manage, making it attractive to businesses that don't have
large IT organizations.

3. PakSecured VPN Server
by Paktronix Systems
Platforms: N/A
Relevant URL:
http://www.paktronix.com/products/vpn.php
Summary:

The most popular enhancement option for the PakSecured Firewall is our
IPSec VPN. The PakSecured VPN connects any two or more networks together
across the Internet using full IPSec encryption technology. Topologies
range from point-to-point through partial-mesh and full-mesh all the way
to fully geared mesh networks with redundant stems. Policy Routing
structures within the Linux kernel enable advanced routing and selection
mechanisms for providing different VPN mesh structures thus maximizing
expensive bandwidth and providing automatic failover and priority routing.

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. RADIUS module for Ruby v1.0.0
by Rafael 'Dido' Sevilla
Relevant URL:
http://online.securityfocus.com/tools/2757
Platforms: Os Independent
Summary:

The RADIUS Ruby module provides an RFC 2138/2139-compliant interface to
RADIUS using Ruby. Its API is based somewhat on the Net::Radius module for
Perl, but with some changes made to reflect Ruby's features (such as
iterators).

2. Wireless Access Point Utilites for Unix v1.0.2
by roma
Relevant URL:
http://ap-utils.polesye.net/
Platforms: Linux, POSIX
Summary:

Wireless Access Point Utilites for Unix is a set of utilities to configure
and monitor Wireless Access Points under Unix.

3. conntrack viewer v1.1
by patou
Relevant URL:
http://cv.intellos.net
Platforms: Linux, POSIX
Summary:

Conntrack Viewer is a Perl script to view the masquerading connection with
iptables, it uses /proc/net/ip_conntrack. With ipchains, it was extremely
easy to view the masquerading connection; 'netstat -M' or 'netstat --
masquerade' gave you the result right away. But since iptables, if you try
this you will get "netstat: no support for `ip_masquerade' on this
system.". With iptables, the information regarding the masquerading
connection are accesible via /proc/net/ip_conntrack, which is extremely
hard to read. This program makes it more legible.

4. cipherfunk Patched Linux Kernels v2.4.19rc1 (2.4-pre)
by Paul Drain
Relevant URL:
http://freshmeat.net/projects/fnk/?topic_id=43%2C143
Platforms: Linux, POSIX
Summary:

cipherfunk Patched Linux Kernels provide patchsets that focus on
optimizations, bugfixes, and security enhancements to the current stable
Linux Kernel. They are suitable for workstation or high-end server use in
both production and development environments.

VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

-------------------------------------------------------------------------------