SecurityFocus Linux Newsletter #291

SecurityFocus Linux Newsletter #291
----------------------------------------

This issue is sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Cross-Site Scripting Attack" - White Paper
Cross-site scripting vulnerabilities in web apps allow hackers to compromise confidential information, steal cookies and create requests that can be mistaken for those of a valid user!! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=70160000000CY4R

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Phishing with Rachna Dhamija
       2. Ajax security basics
II.  LINUX VULNERABILITY SUMMARY
       1. WordPress Username Remote PHP Code Injection Vulnerability
       2. Nullsoft SHOUTcast Multiple HTML Injection Vulnerabilities
       3. IBM DB2 Universal Database Multiple Denial of Service Vulnerabilities
       4. KDE ArtsWrapper Local Privilege Escalation Vulnerability
       5. KDE KDM Session Type Symbolic Link Vulnerability
       6. Sendmail Malformed MIME Message Denial Of Service Vulnerability
       7.  Horde Application Framework Multiple Cross-Site Scripting Vulnerabilities
       8. wv2 Remote Buffer Overflow Vulnerability
       9. Invision Power Board Admin.PHP Cross-site Scripting Vulnerability 
       10. DHCDBD Remote Denial of Service Vulnerability
       11. Linux Kernel XT_SCTP-netfilter Remote Denial of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Phishing with Rachna Dhamija
By Federico Biancuzzi
Federico Biancuzzi interviews Rachna Dhamija, co-author of the paper "Why Phishing Works" and creator of Dynamic Security Skins. They discuss the human factor, how easy it is to recreate a credible browser window made with images, some new anti-phishing features included in the upcoming version of some popular browsers, and the power of letting a user personalize his interface. 
http://www.securityfocus.com/columnists/407

2. Ajax security basics
Jaswinder S. Hayre and Jayasankar Kelath
Ajax technologies have been very visible on the web over the past year, due to their interactive nature. Companies are now thinking of how they too can leverage it, web developers are trying to learn it, security professionals are thinking of how to secure it, and penetration testers are thinking of how to hack it.


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. WordPress Username Remote PHP Code Injection Vulnerability
BugTraq ID: 18372
Remote: Yes
Date Published: 2006-06-12
Relevant URL: http://www.securityfocus.com/bid/18372
Summary:
WordPress is prone to a remote PHP code-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to facilitate a compromise of the application and the underlying system; other attacks are also possible.

For a successful exploit of this issue, the MySQL password used in the application must be either blank or trivial to guess.

2. Nullsoft SHOUTcast Multiple HTML Injection Vulnerabilities
BugTraq ID: 18376
Remote: Yes
Date Published: 2006-06-12
Relevant URL: http://www.securityfocus.com/bid/18376
Summary:
Nullsoft SHOUTcast is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

These issues affect version 1.9.5; other versions may also be vulnerable.

3. IBM DB2 Universal Database Multiple Denial of Service Vulnerabilities
BugTraq ID: 18428
Remote: Yes
Date Published: 2006-06-14
Relevant URL: http://www.securityfocus.com/bid/18428
Summary:
IBM DB2 Universal Database is prone to multiple denial-of-service vulnerabilities. 

An attacker may be able to exploit these issues to cause the database to crash or hang, effectively denying service to legitimate users.

These issues affect DB2 versions prior to 8 FixPak 12 also known as version 8.2 FixPak 5.

4. KDE ArtsWrapper Local Privilege Escalation Vulnerability
BugTraq ID: 18429
Remote: No
Date Published: 2006-06-14
Relevant URL: http://www.securityfocus.com/bid/18429
Summary:
KDE's artswrapper utility is susceptible to a local privilege-escalation vulnerability because it fails to properly implement privilege-dropping functionality when used in conjunction with Linux 2.6 kernels.

This issue allows local attackers to gain superuser privileges, facilitating the complete compromise of affected computers.

5. KDE KDM Session Type Symbolic Link Vulnerability
BugTraq ID: 18431
Remote: No
Date Published: 2006-06-14
Relevant URL: http://www.securityfocus.com/bid/18431
Summary:
KDM is prone to a vulnerability that may permit symbolic-link attacks when processing the user's session type.

An attacker with local access could potentially exploit this issue to view files and obtain privileged information.

A successful attack would most likely result in the loss of confidentiality and the theft of privileged information.

6. Sendmail Malformed MIME Message Denial Of Service Vulnerability
BugTraq ID: 18433
Remote: Yes
Date Published: 2006-06-14
Relevant URL: http://www.securityfocus.com/bid/18433
Summary:
Sendmail is prone to a denial-of-service vulnerability. This issue is due to a failure in the application to properly handle malformed multi-part MIME messages.

An attacker can exploit this issue to crash the sendmail process during delivery.

7.  Horde Application Framework Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 18436
Remote: Yes
Date Published: 2006-06-14
Relevant URL: http://www.securityfocus.com/bid/18436
Summary:
Horde is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

8. wv2 Remote Buffer Overflow Vulnerability
BugTraq ID: 18437
Remote: Yes
Date Published: 2006-06-14
Relevant URL: http://www.securityfocus.com/bid/18437
Summary:
The wv2 library is prone to a remote buffer-overflow vulnerability. This issue is due to the library's failure to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue allows remote attackers to execute arbitrary machine code in the context of applications that use the affected library to parse malicious Microsoft Word files.

Version 0.2.2 of the wv2 library is vulnerable to this issue; other versions may also be affected.

9. Invision Power Board Admin.PHP Cross-site Scripting Vulnerability 
BugTraq ID: 18450
Remote: Yes
Date Published: 2006-06-15
Relevant URL: http://www.securityfocus.com/bid/18450
Summary:
Invision Power Board is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may use this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie credentials; other attacks are also possible.

10. DHCDBD Remote Denial of Service Vulnerability
BugTraq ID: 18459
Remote: Yes
Date Published: 2006-06-15
Relevant URL: http://www.securityfocus.com/bid/18459
Summary:
DHCDBD is prone to a remote denial-of-service vulnerability. 

The issue presents itself when the application handles malformed data and accesses out-of-bounds memory. 

DHCDBD 1.10 and 1.22 are vulnerable to this issue; other versions may also be affected.

11. Linux Kernel XT_SCTP-netfilter Remote Denial of Service Vulnerability
BugTraq ID: 18550
Remote: Yes
Date Published: 2006-06-20
Relevant URL: http://www.securityfocus.com/bid/18550
Summary:
The Linux kernel SCTP netfilter module is susceptible to a remote denial-of-service vulnerability. 

This issue allows remote attackers to cause affected kernels to enter into an infinite-loop condition, denying service to legitimate users. 

Kernel versions prior to 2.6.17.1 are vulnerable to this issue.

This issue is reportedly similar to the one documented in BID 17806 (Linux Kernel SCTP-netfilter Remote Denial of Service Vulnerability).

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website. 

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Cross-Site Scripting Attack" - White Paper
Cross-site scripting vulnerabilities in web apps allow hackers to compromise confidential information, steal cookies and create requests that can be mistaken for those of a valid user!! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=70160000000CY4R