SecurityFocus Linux Newsletter #297

Peter Laborge <[email protected]> Tue, 01 Aug 2006 16:06:44 -0600
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #297
----------------------------------------

This issue is Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas.
World renowned security experts reveal tomorrow's threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your
security environment. Featuring 36 hands-on training courses and 10 conference tracks, networking opportunities with over 2,500 delegates from 40+ nations.

http://www.blackhat.com

------------------------------------------------------------------
I.   FRONT AND CENTER
        1. E-mail privacy in the workplace
        2. After an Exploit: mitigation and remediation
II.  LINUX VULNERABILITY SUMMARY
        1. Freeciv Multiple Remote Denial of Service Vulnerabilities
        2. Opsware NAS Root Password Information Disclosure Vulnerability
        3. FBGS PostScript Filter Bypass Vulnerability
        4. KDE Desktop Screensaver Lock Activation Failure Vulnerability
        5. Mozilla Multiple Products Remote Vulnerabilities
        6. Linux-HA Heartbeat Insecure Default Permissions on Shared Memory Vulnerability
        7. MidiRecord2 MidiRecord.CC Local Buffer Overflow Vulnerability
        8. Mozilla Firefox Javascript Navigator Object Remote Code Execution Vulnerability
        9. Mozilla Foundation Products XPCOM Memory Corruption Vulnerability
        10. Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
        11. Osiris Logging.C Format String Vulnerability
        12. Symantec On-Demand Protection Encrypted Data Information Disclosure Vulnerability
        13. IBM Informix Dynamic Server Multiple Vulnerabilities
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. E-mail privacy in the workplace
By Mark Rasch
Even with a well-heeled corporate privacy policy stating that all employee communications may be monitored in the workplace, the legality of e-mail monitoring is not as clear cut as one might think.
http://www.securityfocus.com/columnists/412

2. After an Exploit: mitigation and remediation
By Jamie Riden
This article describes a few hardening and alerting methods for Unix servers that help block vectors for various attacks, including two web-based application attacks, DNS issues, and the brute-forcing of SSH passwords. The article then looks at steps to take and lessons learned post-compromise.
http://www.securityfocus.com/infocus/1871


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Freeciv Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 19117
Remote: Yes
Date Published: 2006-07-23
Relevant URL: http://www.securityfocus.com/bid/19117
Summary:
Freeciv server is prone to multiple remote denial-of-service vulnerabilities.

A remote attacker may exploit these issues to deny service to legitimate users by sending malicious packets to a server.

2.1.0-beta1 and prior versions are affected by these issues.

2. Opsware NAS Root Password Information Disclosure Vulnerability
BugTraq ID: 19126
Remote: No
Date Published: 2006-07-24
Relevant URL: http://www.securityfocus.com/bid/19126
Summary:
Opsware NAS is prone to a local information-disclosure vulnerability. This issue occurs because the application fails to protect sensitive information to unprivileged users.

An attacker can exploit this issue by gaining access to the root MySQL account and reveal authentication credentials for network devices. This issue could also lead to other attacks.

Opsware NAS 6.0 is vulnerable to this issue; other versions may also be affected.

3. FBGS PostScript Filter Bypass Vulnerability
BugTraq ID: 19131
Remote: No
Date Published: 2006-07-24
Relevant URL: http://www.securityfocus.com/bid/19131
Summary:
The 'fbgs' utility is prone to a filter-bypass vulnerability. This issue occurs because the application fails to filter malicious PostScript commands properly.

An attacker can exploit this issue by deleting user data while displaying a PostScript file.

4. KDE Desktop Screensaver Lock Activation Failure Vulnerability
BugTraq ID: 19152
Remote: No
Date Published: 2006-07-25
Relevant URL: http://www.securityfocus.com/bid/19152
Summary:
The KDE desktop is prone to a vulnerability that can cause the manual locking of the desktop to fail or can stop the screensaver from activating.

These issues could have a security impact if the user depends on the locking mechanism to secure their desktop.

5. Mozilla Multiple Products Remote Vulnerabilities
BugTraq ID: 19181
Remote: Yes
Date Published: 2006-07-26
Relevant URL: http://www.securityfocus.com/bid/19181
Summary:
The Mozilla Foundation has released thirteen security advisories specifying vulnerabilities in Mozilla Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- execute arbitrary machine code in the context of the vulnerable application
- crash affected applications
- run arbitrary script code with elevated privileges
- gain access to potentially sensitive information.
- carry out cross-domain scripting attacks

Other attacks may also be possible.

The issues described here will be split into individual BIDs as further information becomes available.

These issues are fixed in:
- Mozilla Firefox version 1.5.0.5
- Mozilla Thunderbird version 1.5.0.5
- Mozilla SeaMonkey version 1.0.3

6. Linux-HA Heartbeat Insecure Default Permissions on Shared Memory Vulnerability
BugTraq ID: 19186
Remote: No
Date Published: 2006-07-27
Relevant URL: http://www.securityfocus.com/bid/19186
Summary:
Since Linux-HA Heartbeat has insecure default permissions set on shared memory, local attackers may be able to cause a denial of service.

Exploitation would most likely result in a system crash, loss of data, and resource exhaustion, leading to a denial of service if critical files are accessed improperly or overwritten in the attack. Other attacks may be possible as well.

7. MidiRecord2 MidiRecord.CC Local Buffer Overflow Vulnerability
BugTraq ID: 19190
Remote: No
Date Published: 2006-07-27
Relevant URL: http://www.securityfocus.com/bid/19190
Summary:
Midirecord is prone to a local buffer-overflow vulnerability because it fails to do proper bounds checking on user-supplied data before using it in a finite-sized buffer.

An attacker can exploit this issue to execute arbitrary code in the context of the victim running the affected application.

Version 2.0 is vulnerable to this issue; other versions may also be affected.

8. Mozilla Firefox Javascript Navigator Object Remote Code Execution Vulnerability
BugTraq ID: 19192
Remote: Yes
Date Published: 2006-07-26
Relevant URL: http://www.securityfocus.com/bid/19192
Summary:
Mozilla Firefox is prone to a remote code execution vulnerability because the application fails to properly sanitize user-supplied input before using it to create new Javascript objects.

Successful exploits may allow an attacker to crash the application or execute arbitrary machine code in the context of the affected application.

This issue was previously discussed in BID 19181 (Mozilla Multiple Products Remote Vulnerabilities).
It has been assigned a separate BID as new information has become available.

9. Mozilla Foundation Products XPCOM Memory Corruption Vulnerability
BugTraq ID: 19197
Remote: Yes
Date Published: 2006-07-26
Relevant URL: http://www.securityfocus.com/bid/19197
Summary:
Various Mozilla Foundation products are prone to a memory corruption vulnerability.

This issue occurs because the applications fails to handle simultaneous XPCOM events that would cause the deletion of the timer object.

An attacker can exploit this issue to execute arbitrary code.

This issue was previously discussed in BID 19181 (Mozilla Multiple Products Remote Vulnerabilities). It has been assigned a seperate BID as new information has become available.

10. Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
BugTraq ID: 19204
Remote: Yes
Date Published: 2006-07-28
Relevant URL: http://www.securityfocus.com/bid/19204
Summary:
Apache mod_rewrite is prone to an off-by-one buffer-overflow condition.

The vulnerability arising in the mod_rewrite module's ldap scheme handling allows for potential memory corruption when an attacker exploits certain rewrite rules.

An attacker may exploit this issue to trigger a denial-of-service condition. Reportedly, arbitrary code execution may be possible as well.

11. Osiris Logging.C Format String Vulnerability
BugTraq ID: 19213
Remote: Yes
Date Published: 2006-07-28
Relevant URL: http://www.securityfocus.com/bid/19213
Summary:
Osiris is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before using it in a formatted-printing function.

A successful exploit could allow an attacker to execute arbitrary code or to crash the application.

Version 4.2.0 is vulnerable to this issue; other versions may also be affected.

12. Symantec On-Demand Protection Encrypted Data Information Disclosure Vulnerability
BugTraq ID: 19248
Remote: No
Date Published: 2006-07-31
Relevant URL: http://www.securityfocus.com/bid/19248
Summary:
Symantec On-Demand Protection (SODP) and On-Demand Agent (SODA) are prone to a vulnerability that could disclose potentially sensitive information.

An attacker may be able to decrypt the files saved by the applications. The impact of this issue will depend on the information disclosed.

This issue affects SODA versions 2.5 MR2 (build 2156) and earlier, and SODP versions 2.6 (build 2232) and earlier. This issue only affects the Microsoft Windows versions of the applications.

13. IBM Informix Dynamic Server Multiple Vulnerabilities
BugTraq ID: 19264
Remote: Yes
Date Published: 2006-07-31
Relevant URL: http://www.securityfocus.com/bid/19264
Summary:
IBM Informix Dynamic Server is prone to fourteen vulnerabilities. These issues can allow attackers to execute arbitrary code and compromise a vulnerable computer, gain elevated privileges, retrieve sensitive information, and trigger denial-of-service conditions.

Presumably, some of these issues are remote in nature, while others may present a local threat.

IBM Informix Dynamic Server versions 7.3, 9.4, 10.0 for Windows and Linux are reported vulnerable; other versions may be affected as well.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas.
World renowned security experts reveal tomorrow's threats today. Free of vendor pitches, the Briefings are designed to be pragmatic regardless of your
security environment. Featuring 36 hands-on training courses and 10 conference tracks, networking opportunities with over 2,500 delegates from 40+ nations.

http://www.blackhat.com