SecurityFocus Linux Newsletter #288

Peter Laborge <[email protected]> Wed, 31 May 2006 14:58:25 -0600
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #288
----------------------------------------

This issue is sponsored by: SPI Dynamics

EASY TARGETS: Hacking Web Applications- A Step-by-Step Attack Analysis
The speed with which Web Applications are developed make them prime targets for attackers, often these applications were developed so quickly that they are not coded properly or subjected to any security testing. Hackers know this and use it as their weapon. Download *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/web.asp?cs1_ContSupRef=70130000000CRxF

------------------------------------------------------------------
I.   FRONT AND CENTER
        1. Abandon e-mail!
II.  LINUX VULNERABILITY SUMMARY
        1. Cyrus IMAPD POP3D Remote Buffer Overflow Vulnerability
        2. Nagios Remote Content-Length Integer Overflow Vulnerability
        3. Dia Filename Remote Format String Vulnerability
        4. Linux Kernel SCTP Multiple Remote Denial of Service Vulnerabilities
        5. PostgreSQL Multibyte Character Encoding SQL Injection Vulnerabilities
        6. Cisco VPN Client Local Privilege Escalation Vulnerability
        7. Linux Kernel Choose_New_Parent Local Denial of Service Vulnerability
        8. Linux Kernel SG Driver Direct IO Local Denial of Service Vulnerability
        9. NetPanzer SETFRAME Remote Denial of Service Vulnerability
        10. Linux Kernel LSM ReadV/WriteV Security Restriction Bypass Vulnerability
        11. Vixie Cron PAM_Limits Local Privilege Escalation Vulnerability
        12. Shadow-Utils UserAdd Local Insecure Permissions Vulnerability
        13. Linux Kernel Netfilter Do_Add_Counters Local Race Condition Vulnerability
        14. Dia Multiple Unspecified Remote Format String Vulnerabilities
        15. Linux Kernel Invalid Proc Memory Access Local Denial of Service Vulnerability
        16. Linux Kernel ELF Loader Mismatched Architecture Local Denial of Service Vulnerability
        17. Linux Kernel MIPS Ptrace Local Privilege Escalation Vulnerability
        18. Linux Kernel MREMAP Local Privilege Escalation Vulnerability
        19. Linux Kernel Proc dentry_unused Corruption Local Denial of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Abandon e-mail!
By Kelly Martin
Kelly Martin takes a step back from e-mail's unstoppable phishing-virus-spam epidemic and imagines a world where secure e-mail could be the next big killer app.
http://www.securityfocus.com/columnists/404


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Cyrus IMAPD POP3D Remote Buffer Overflow Vulnerability
BugTraq ID: 18056
Remote: Yes
Date Published: 2006-05-21
Relevant URL: http://www.securityfocus.com/bid/18056
Summary:
Cyrus IMAPD is prone to a remote buffer-overflow vulnerability. This issue is due to a failure in the application to properly verify user-supplied input before copying it into a finite-sized buffer.

Successful exploits may result in memory corruption leading to a denial-of-service condition or arbitrary code execution.

Cyrus IMAPD version 2.3.2 is reported to be vulnerable. Other versions may be affected as well.

2. Nagios Remote Content-Length Integer Overflow Vulnerability
BugTraq ID: 18059
Remote: Yes
Date Published: 2006-05-22
Relevant URL: http://www.securityfocus.com/bid/18059
Summary:
Nagios is prone to a remote integer-overflow vulnerability. The application fails to properly ensure that user-supplied input doesn't overflow integer values. This may result in user-supplied data being copied past the end of a memory buffer.

This issue allows remote attackers to execute arbitrary machine code in the context of hosting webservers.

Nagios versions prior to 2.3.1  are vulnerable to this issue.

This issue is very similar to BID 17879 (Nagios Remote Negative Content-Length Buffer Overflow Vulnerability), but is a separate issue.

3. Dia Filename Remote Format String Vulnerability
BugTraq ID: 18078
Remote: Yes
Date Published: 2006-05-23
Relevant URL: http://www.securityfocus.com/bid/18078
Summary:
Dia is prone to a remote format-string vulnerability.

This issue arises when the application handles specially crafted filenames. An attacker can exploit this vulnerability by crafting a malicious filename that contains format specifiers and then coercing unsuspecting users to open the malicious file with the affected application.

A successful attack may crash the application or lead to arbitrary code execution.

This issue affects Dia versions 0.95 and earlier.

4. Linux Kernel SCTP Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 18085
Remote: Yes
Date Published: 2006-05-22
Relevant URL: http://www.securityfocus.com/bid/18085
Summary:
The Linux kernel SCTP module is susceptible to remote denial-of-service vulnerabilities. These issues are triggered when the kernel handles unexpected SCTP packets.

These issues allow remote attackers to trigger kernel panics, denying further service to legitimate users.

The Linux kernel version 2.6.16 is vulnerable to these issues; prior versions may also be affected.

5. PostgreSQL Multibyte Character Encoding SQL Injection Vulnerabilities
BugTraq ID: 18092
Remote: Yes
Date Published: 2006-05-24
Relevant URL: http://www.securityfocus.com/bid/18092
Summary:
PostgreSQL is prone to SQL-injection vulnerabilities. These issues are due to a potential mismatch of multibyte character conversions between PostgreSQL servers and client applications.

A successful exploit could allow an attacker to execute arbitrary SQL statements on affected servers. This may allow the attacker to compromise the targeted computer, access or modify data, or exploit other latent vulnerabilities.

PostgreSQL versions prior to 7.3.15, 7.4.13, 8.0.8, and 8.1.4 are vulnerable to these issues.

6. Cisco VPN Client Local Privilege Escalation Vulnerability
BugTraq ID: 18094
Remote: No
Date Published: 2006-05-24
Relevant URL: http://www.securityfocus.com/bid/18094
Summary:
Cisco VPN Client is susceptible to a local privilege-escalation vulnerability. This issue is due to an unspecified flaw in the VPN client GUI application.

This issue allows local attackers to gain Local System privileges on affected computers. This facilitates the complete compromise of affected computers.

This vulnerability affects Cisco VPN Clients on Microsoft Windows. Versions prior to 4.8.01.x, with the exception of version 4.7.00.0533, are affected.

7. Linux Kernel Choose_New_Parent Local Denial of Service Vulnerability
BugTraq ID: 18099
Remote: No
Date Published: 2006-05-24
Relevant URL: http://www.securityfocus.com/bid/18099
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a design error in the 'choose_new_parent' function.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.6.11.12.

8. Linux Kernel SG Driver Direct IO Local Denial of Service Vulnerability
BugTraq ID: 18101
Remote: No
Date Published: 2006-05-25
Relevant URL: http://www.securityfocus.com/bid/18101
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a design error in the SG driver.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.6.13.

9. NetPanzer SETFRAME Remote Denial of Service Vulnerability
BugTraq ID: 18104
Remote: Yes
Date Published: 2006-05-23
Relevant URL: http://www.securityfocus.com/bid/18104
Summary:
netPanzer is affected by a remote denial-of-service vulnerability.

The vulnerability presents itself in the 'setFrame' function. A client can exploit this issue to cause a server to crash.

netPanzer 0.8 (rev 952) and prior versions are affected by this issue.

10. Linux Kernel LSM ReadV/WriteV Security Restriction Bypass Vulnerability
BugTraq ID: 18105
Remote: No
Date Published: 2006-05-25
Relevant URL: http://www.securityfocus.com/bid/18105
Summary:
The Linux kernel is susceptible to a security-restriction-bypass vulnerability. This issue is due to the kernel's failure to properly enforce Linux Security Module security checks.

This issue allows local attackers to bypass security restrictions, allowing them to read and write to files they do not have permissions to access. This may aid them in further attacks.

This issue occurs during read and write calls that occur after files have been opened. During the open process, proper security checks are enforced. This means that this issue is exploitable only when access to files is revoked after they have already been opened by an attacker.

Linux kernel versions prior to 2.6.16.12 are vulnerable to this issue.

11. Vixie Cron PAM_Limits Local Privilege Escalation Vulnerability
BugTraq ID: 18108
Remote: No
Date Published: 2006-05-25
Relevant URL: http://www.securityfocus.com/bid/18108
Summary:
Vixie cron is susceptible to a local privilege-escalation vulnerability. This issue is due to the application's failure to properly drop superuser privileges in certain circumstances when executing jobs.

This issue allows local attackers that have been authorized to execute cron jobs to execute arbitrary commands with superuser privileges. This facilitates the complete compromise of affected computers.

Vixie cron version 4.1 is vulnerable to this issue when used in conjunction with pam_limits. Other versions may also be affected.

12. Shadow-Utils UserAdd Local Insecure Permissions Vulnerability
BugTraq ID: 18111
Remote: No
Date Published: 2006-05-24
Relevant URL: http://www.securityfocus.com/bid/18111
Summary:
The useradd utility in shadow-utils is susceptible to a local insecure-permissions vulnerability. This issue is due to a race-condition between when user mailboxes are created and when permissions are set on the file.

A local, unprivileged attacker can exploit this issue to gain access to newly created mailbox files. This may allow them to directly inject forged email messages to aid them in social-engineering attacks. Attackers may also be able to inject data into the mailbox file that will cause mail applications to fail to access the file, denying email access to targeted users. Other attacks may also be possible.

Version 4.0.3 of shadow-utils is vulnerable to this issue; other versions may also be affected.

13. Linux Kernel Netfilter Do_Add_Counters Local Race Condition Vulnerability
BugTraq ID: 18113
Remote: No
Date Published: 2006-05-26
Relevant URL: http://www.securityfocus.com/bid/18113
Summary:
The Linux kernel is susceptible to a local race-condition vulnerability.

This issue allows local attackers to gain access to potentially sensitive kernel memory, aiding them in further attacks. Failed exploit attempts may crash the kernel, denying service to legitimate users.

This issue is exploitable only by local users who have superuser privileges or have the CAP_NET_ADMIN capability. This issue is therefore a security concern only if computers run virtualization software that allows users to have superuser access to guest operating systems or if the CAP_NET_ADMIN capability is given to untrusted users.

Linux kernel versions prior to 2.6.16.17 in the 2.6 series are affected by this issue.

14. Dia Multiple Unspecified Remote Format String Vulnerabilities
BugTraq ID: 18166
Remote: Yes
Date Published: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18166
Summary:
Dia is prone to multiple unspecified format-string vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input before including it in the format-specifier argument of formatted-printing functions.

A successful attack may crash the application or lead to arbitrary code execution.

Specific information regarding affected versions of Dia is not currently available; this BID will be updated as further information is disclosed.

15. Linux Kernel Invalid Proc Memory Access Local Denial of Service Vulnerability
BugTraq ID: 18173
Remote: No
Date Published: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18173
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a flaw in the 'proc' filesystem.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.4.27.

16. Linux Kernel ELF Loader Mismatched Architecture Local Denial of Service Vulnerability
BugTraq ID: 18174
Remote: No
Date Published: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18174
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a flaw in the ELF object file loader.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.4.25.

17. Linux Kernel MIPS Ptrace Local Privilege Escalation Vulnerability
BugTraq ID: 18176
Remote: No
Date Published: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18176
Summary:
The Linux kernel is susceptible to a local privilege-escalation vulnerability. This issue occurs only on MIPS architectures.

This issue allows local attackers to gain superuser privileges, facilitating the complete compromise of affected computers.

Specific information regarding affected versions is not currently available; this BID will be updated as further information is disclosed.

18. Linux Kernel MREMAP Local Privilege Escalation Vulnerability
BugTraq ID: 18177
Remote: No
Date Published: 2006-05-30
Relevant URL: http://www.securityfocus.com/bid/18177
Summary:
The Linux kernel is susceptible to a local privilege-escalation vulnerability. This issue occurs due to an unspecified flaw in 'mremap'.

This issue allows local attackers to gain superuser privileges, facilitating the complete compromise of affected computers.

Linux kernel versions prior to 2.4.25 are vulnerable to this issue.

19. Linux Kernel Proc dentry_unused Corruption Local Denial of Service Vulnerability
BugTraq ID: 18183
Remote: No
Date Published: 2006-05-31
Relevant URL: http://www.securityfocus.com/bid/18183
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a flaw in the 'proc' filesystem.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

This issue affects Linux kernel versions 2.6.15 through 2.6.17-rc5 on multiprocessor computers running SMP kernels. Other kernel versions may also be affected.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is sponsored by: SPI Dynamics

EASY TARGETS: Hacking Web Applications- A Step-by-Step Attack Analysis
The speed with which Web Applications are developed make them prime targets for attackers, often these applications were developed so quickly that they are not coded properly or subjected to any security testing. Hackers know this and use it as their weapon. Download *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/web.asp?cs1_ContSupRef=70130000000CRxF