SecurityFocus Linux Newsletter #291

Peter Laborge <[email protected]> Tue, 27 Jun 2006 15:59:01 -0600
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #291
----------------------------------------

This issue is sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Cross-Site Scripting Attack" - White Paper
Cross-site scripting vulnerabilities in web apps allow hackers to compromise confidential information, steal cookies and create requests that can be mistaken for those of a valid user!! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=70160000000CY4R

------------------------------------------------------------------
I.   FRONT AND CENTER
        1. Phishing with Rachna Dhamija
II.  LINUX VULNERABILITY SUMMARY
        1. NetPBM Pamtofits Remote Off-By-One Buffer Overflow Vulnerability
        2. Linux Kernel XT_SCTP-netfilter Remote Denial of Service Vulnerability
        3. GnuPG Parse_User_ID Remote Buffer Overflow Vulnerability
        4. Usermin Change User Details Remote Denial of Service Vulnerability
        5. Webmin Remote Directory Traversal Vulnerability
        6. Linux Kernel POSIX-CPU-TIMERS.C Local Denial of Service Vulnerability
        7. Linux Kernel Signal_32.C Local Denial of Service Vulnerability
        8. BitchX BX_Do_Hook Remote Denial of Service Vulnerability
        9. Algorithmic Research PrivateWire Online Registration Remote Buffer Overflow Vulnerability
        10. Hashcash Remote Heap Buffer Overflow Vulnerability
        11. EnergyMech CTCP Notice Denial of Service Vulnerability
        12. Spread Insecure Socket File Creation Denial Of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Phishing with Rachna Dhamija
By Federico Biancuzzi
Federico Biancuzzi interviews Rachna Dhamija, co-author of the paper "Why Phishing Works" and creator of Dynamic Security Skins. They discuss the human factor, how easy it is to recreate a credible browser window made with images, some new anti-phishing features included in the upcoming version of some popular browsers, and the power of letting a user personalize his interface.
http://www.securityfocus.com/columnists/407


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. NetPBM Pamtofits Remote Off-By-One Buffer Overflow Vulnerability
BugTraq ID: 18525
Remote: Yes
Date Published: 2006-06-20
Relevant URL: http://www.securityfocus.com/bid/18525
Summary:
Netpbm 'pnmtofits' is prone to an off-by-one buffer-overflow vulnerability.

The issue presents itself when the application processes a malicious file. A remote attacker may exploit this issue to trigger a denial-of-service condition. The attacker might also be able to execute arbitrary code, but this has not been confirmed.

Netpbm versions 10.30 to 10.33 are vulnerable to this issue.

2. Linux Kernel XT_SCTP-netfilter Remote Denial of Service Vulnerability
BugTraq ID: 18550
Remote: Yes
Date Published: 2006-06-20
Relevant URL: http://www.securityfocus.com/bid/18550
Summary:
The Linux kernel SCTP netfilter module is prone to a remote denial-of-service vulnerability.

This issue allows remote attackers to cause affected kernels to enter into an infinite-loop condition, denying service to legitimate users.

Kernel versions prior to 2.6.17.1 are vulnerable to this issue.

This issue is reportedly similar to the one documented in BID 17806 (Linux Kernel SCTP-netfilter Remote Denial of Service Vulnerability).

3. GnuPG Parse_User_ID Remote Buffer Overflow Vulnerability
BugTraq ID: 18554
Remote: Yes
Date Published: 2006-06-20
Relevant URL: http://www.securityfocus.com/bid/18554
Summary:
GnuPG is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue may allow remote attackers to execute arbitrary machine code in the context of the affected application, but this has not been confirmed.

GnuPG versions 1.4.3 and 1.9.20 are vulnerable to this issue; previous versions may also be affected.

4. Usermin Change User Details Remote Denial of Service Vulnerability
BugTraq ID: 18574
Remote: Yes
Date Published: 2006-06-21
Relevant URL: http://www.securityfocus.com/bid/18574
Summary:
Usermin is prone to a remote denial-of-service vulnerability. This issue is due to a design error in the application when setting the user's shell.

An attacker can exploit this issue to change the shell of the superuser account, effectively denying service.

This issue affects version 1.110-3; other versions may also be vulnerable.

5. Webmin Remote Directory Traversal Vulnerability
BugTraq ID: 18613
Remote: Yes
Date Published: 2006-06-23
Relevant URL: http://www.securityfocus.com/bid/18613
Summary:
It is reported that Webmin may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. This issue is only reported to present itself in Webmin running on Windows platforms. A remote attacker may traverse outside the server root directory by using encoded '\..' character sequences.

6. Linux Kernel POSIX-CPU-TIMERS.C Local Denial of Service Vulnerability
BugTraq ID: 18615
Remote: No
Date Published: 2006-06-20
Relevant URL: http://www.securityfocus.com/bid/18615
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a race condition arising in 'posix-cpu-timers.c'.

This vulnerability allows local users to crash the kernel, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.6.16.21.

7. Linux Kernel Signal_32.C Local Denial of Service Vulnerability
BugTraq ID: 18616
Remote: No
Date Published: 2006-06-20
Relevant URL: http://www.securityfocus.com/bid/18616
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a design error in 'signal_32.c'.

This vulnerability allows local users to panic the kernel, denying further service to legitimate users.

This issue affects Linux kernel versions prior to 2.6.16.21.

8. BitchX BX_Do_Hook Remote Denial of Service Vulnerability
BugTraq ID: 18634
Remote: Yes
Date Published: 2006-06-24
Relevant URL: http://www.securityfocus.com/bid/18634
Summary:
BitchX is prone to a remote denial-of-service vulnerability because it fails to properly handle excessive data from malicious IRC servers.

This issue allows remote attackers to crash affected IRC clients, denying service to legitimate users. To exploit this issue, attackers must coerce users of affected clients to connect to a malicious server.

BitchX version 1.1-final is vulnerable to this issue; previous versions may also be affected.

9. Algorithmic Research PrivateWire Online Registration Remote Buffer Overflow Vulnerability
BugTraq ID: 18647
Remote: Yes
Date Published: 2006-06-26
Relevant URL: http://www.securityfocus.com/bid/18647
Summary:
PrivateWire online registration is prone to a remote buffer-overflow vulnerability.

The application fails to properly check boundary conditions when handling GET requests.

This issue allows attackers to execute arbitrary machine code in the context of the affected application software.

Version 3.7 is vulnerable to this issue; previous versions may also be affected.

10. Hashcash Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 18659
Remote: Yes
Date Published: 2006-06-26
Relevant URL: http://www.securityfocus.com/bid/18659
Summary:
A buffer-overflow vulnerability exists in the generic C implementation of Hashcash. This issue is due to the software's failure to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue may allow attackers to execute arbitrary machine code in the context of the affected application. This may facilitate the remote compromise of affected computers.

Hashcash versions prior to 1.21 are vulnerable to this issue.

11. EnergyMech CTCP Notice Denial of Service Vulnerability
BugTraq ID: 18664
Remote: Yes
Date Published: 2006-06-26
Relevant URL: http://www.securityfocus.com/bid/18664
Summary:
EnergyMech is prone to a denial-of-service vulnerability. Successful exploits will cause the application to crash, effectively denying service.

This issue affects versions prior to 3.0.2.

12. Spread Insecure Socket File Creation Denial Of Service Vulnerability
BugTraq ID: 18675
Remote: No
Date Published: 2006-06-27
Relevant URL: http://www.securityfocus.com/bid/18675
Summary:
Spread creates temporary files in an insecure manner.

Successful exploits would most likely result in loss of data or a denial of service. Other attacks may also be possible.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is sponsored by: SPI Dynamics
ALERT: "How A Hacker Launches A Cross-Site Scripting Attack" - White Paper
Cross-site scripting vulnerabilities in web apps allow hackers to compromise confidential information, steal cookies and create requests that can be mistaken for those of a valid user!! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=70160000000CY4R