SecurityFocus Linux Newsletter #298

Peter Laborge <[email protected]> Tue, 08 Aug 2006 15:27:39 -0600
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #298
----------------------------------------

This issue is Sponsored by: SPI Dynamics

ALERT: Ajax Security Dangers- How Hackers are attacking Ajax Web Apps
While Ajax can greatly improve the usability of a Web application, it can also create several opportunities for possible attack if the application is not designed with security in mind. Download this SPI Dynamics white paper.

https://download.spidynamics.com/1/ad/AJAX.asp?Campaign_ID=70160000000CZBn

------------------------------------------------------------------
I.   FRONT AND CENTER
        1. Dynamic linking in Linux and Windows, part one
        2. E-mail privacy in the workplace
II.  LINUX VULNERABILITY SUMMARY
        1. Symantec On-Demand Protection Encrypted Data Information Disclosure Vulnerability
        2. IBM Informix Dynamic Server Multiple Vulnerabilities
        3.  MySQL MERGE Priviledge Revoke Bypass Vulnerability
        4. Libtiff Next RLE Decoder Remote Heap Buffer Overflow Vulnerability
        5. LibTIFF TiffFetchShortPair Remote Buffer Overflow Vulnerability
        6. LibTiff EstimateStripByteCounts() Denial of Service Vulnerability
        7. LibTiff Sanity Checks Multiple Denial of Service Vulnerabilities
        8. Libtiff Library Anonymous Field Merging Denial of Service Vulnerability
        9. LibTIFF TiffScanLineSize Remote Buffer Overflow Vulnerability
        10. LibTIFF PixarLog Decoder Remote Heap Buffer Overflow Vulnerability
        11. Imendio Planner Filename Remote Format String Vulnerability
        12. Cryptographic Filesystem Daemon Local Denial Of Service Vulnerability
        13. ISC Memory.C DHCP Server Denial Of Service Vulnerability
        14. DConnect Daemon Listen Thread UDP Remote Buffer Overflow Vulnerability
        15. DConnect Daemon DC Chat Denial of Service Vulnerability
        16. DConnect Daemon Multiple Format String Vulnerabilities
        17. Clam Anti-Virus ClamAV UPX Compressed PE File Heap Buffer Overflow Vulnerability
        18. Linux Kernel NFS and EXT3 Combination Remote Denial of Service Vulnerability
        19. XChat Remote Denial of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Dynamic linking in Linux and Windows, part one
By Reji Thomas, and Bhasker Reddy
This article discusses shared libraries in both Windows and Linux, and offers a walk through various data structures to explain how dynamic linking is done in these operating systems. The paper will be useful for developers interested in the security implications and the relative speed of dynamic linking, and assumes some prior knowledge of static and shared libraries.
http://www.securityfocus.com/infocus/1872

2. E-mail privacy in the workplace
By Mark Rasch
Even with a well-heeled corporate privacy policy stating that all employee communications may be monitored in the workplace, the legality of e-mail monitoring is not as clear cut as one might think.
http://www.securityfocus.com/columnists/412


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Symantec On-Demand Protection Encrypted Data Information Disclosure Vulnerability
BugTraq ID: 19248
Remote: No
Date Published: 2006-07-31
Relevant URL: http://www.securityfocus.com/bid/19248
Summary:
Symantec On-Demand Protection (SODP) and On-Demand Agent (SODA) are prone to a vulnerability that could disclose potentially sensitive information.

An attacker may be able to decrypt the files saved by the applications. The impact of this issue will depend on the information disclosed.

This issue affects:

- SODA versions 2.5 MR2 (build 2156) and earlier
- SODP versions 2.6 (build 2232) and earlier.

Note that this issue affects only the Microsoft Windows versions of the applications.

2. IBM Informix Dynamic Server Multiple Vulnerabilities
BugTraq ID: 19264
Remote: Yes
Date Published: 2006-07-31
Relevant URL: http://www.securityfocus.com/bid/19264
Summary:
IBM Informix Dynamic Server is prone to fourteen vulnerabilities. These issues can allow attackers to execute arbitrary code and compromise a vulnerable computer, gain elevated privileges, retrieve sensitive information, and trigger denial-of-service conditions.

Presumably, some of these issues are remote in nature, while others may present a local threat.

IBM Informix Dynamic Server versions 7.3, 9.4, 10.0 for Windows and Linux are reported vulnerable; other versions may be affected as well.

3.  MySQL MERGE Priviledge Revoke Bypass Vulnerability
BugTraq ID: 19279
Remote: Yes
Date Published: 2006-08-01
Relevant URL: http://www.securityfocus.com/bid/19279
Summary:
MySQL is prone to a vulnerability that allows users with revoked privileges to a particular table to access these tables without permission.

This issue allows attackers to gain access to data when access privileges have been revoked. The specific impact of this issue depends on the data that the attacker may retrieve.

4. Libtiff Next RLE Decoder Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 19282
Remote: Yes
Date Published: 2006-08-01
Relevant URL: http://www.securityfocus.com/bid/19282
Summary:
The Next RLE Decoder for libTIFF is prone to a remote heap buffer-overflow vulnerability.

This issue occurs because the application fails to check boundary conditions on certain RLE decoding operations.

This issue may allow attackers to execute arbitrary machine code within the context of the vulnerable application or to cause a denial of service.

5. LibTIFF TiffFetchShortPair Remote Buffer Overflow Vulnerability
BugTraq ID: 19283
Remote: Yes
Date Published: 2006-08-01
Relevant URL: http://www.securityfocus.com/bid/19283
Summary:
LibTIFF is prone to a buffer-overflow vulnerability because the library fails to do proper boundary checks before copying user-supplied data into a finite-sized buffer.

This issue allows remote attackers to execute arbitrary machine code in the context of appications using the affected library. Failed exploit attempts will likely crash the application, denying service to legitimate users.

6. LibTiff EstimateStripByteCounts() Denial of Service Vulnerability
BugTraq ID: 19284
Remote: Yes
Date Published: 2006-08-01
Relevant URL: http://www.securityfocus.com/bid/19284
Summary:
LibTIFF is affected by a denial-of-service vulnerability.

An attacker can exploit this vulnerability to cause a denial of service in applications using the affected library.

7. LibTiff Sanity Checks Multiple Denial of Service Vulnerabilities
BugTraq ID: 19286
Remote: Yes
Date Published: 2006-08-01
Relevant URL: http://www.securityfocus.com/bid/19286
Summary:
LibTIFF is affected by multiple denial-of-service vulnerabilities.

An attacker can exploit these vulnerabilities to cause a denial of service in applications using the affected library.

8. Libtiff Library Anonymous Field Merging Denial of Service Vulnerability
BugTraq ID: 19287
Remote: Yes
Date Published: 2006-08-01
Relevant URL: http://www.securityfocus.com/bid/19287
Summary:
The 'libtiff' library is prone to a denial-of-service vulnerability.

An attacker can exploit this issue by submitting malformed image files.

When the libtiff library routines process a malicious TIFF file, this could result in abnormal behavior, cause the application to become unresponsive, or possibly allow malicious code to execute.

9. LibTIFF TiffScanLineSize Remote Buffer Overflow Vulnerability
BugTraq ID: 19288
Remote: Yes
Date Published: 2006-08-01
Relevant URL: http://www.securityfocus.com/bid/19288
Summary:
LibTIFF is prone to a buffer-overflow vulnerability because the library fails to do proper boundary checks before copying user-supplied data into a finite-sized buffer.

This issue allows remote attackers to execute arbitrary machine code in the context of applications using the affected library. Failed exploit attempts will likely crash the application, denying service to legitimate users.

10. LibTIFF PixarLog Decoder Remote Heap Buffer Overflow Vulnerability
BugTraq ID: 19290
Remote: Yes
Date Published: 2006-08-01
Relevant URL: http://www.securityfocus.com/bid/19290
Summary:
The PixarLog Decoder for libTIFF is prone to a remote heap buffer-overflow vulnerability.

This issue may allow attackers to execute arbitrary machine code within the context of the vulnerable application or to cause a denial-of-service.

11. Imendio Planner Filename Remote Format String Vulnerability
BugTraq ID: 19307
Remote: Yes
Date Published: 2006-08-02
Relevant URL: http://www.securityfocus.com/bid/19307
Summary:
Imendio Planner is prone to a remote format-string vulnerability.

This issue arises when the application handles specially crafted filenames. An attacker can exploit this vulnerability by crafting a malicious filename that contains format specifiers and then entice unsuspecting users to open the malicious file with the affected application.

A successful attack may crash the application or lead to arbitrary code execution.

Version 0.13 is vulnerable to this issue; other versions may also be affected.

12. Cryptographic Filesystem Daemon Local Denial Of Service Vulnerability
BugTraq ID: 19320
Remote: No
Date Published: 2006-08-02
Relevant URL: http://www.securityfocus.com/bid/19320
Summary:
Cryptographic Filesystem (CFS) is prone to a local denial-of-service vulnerability.

A local attacker may crash the encryption daemon, resulting in denial-of-service conditions to legitimate users.

13. ISC Memory.C DHCP Server Denial Of Service Vulnerability
BugTraq ID: 19348
Remote: Yes
Date Published: 2006-08-04
Relevant URL: http://www.securityfocus.com/bid/19348
Summary:
ISC DHCP server is prone to a denial-of-service vulnerability. This issue occurs when an automatic IP address is assigned to a system.

An attacker can exploit this issue to crash the DHCP server, causing a denial-of-service condititon.

This issue affects version 2 releases of DHCP; version 3 releases are reportedly not affected.

14. DConnect Daemon Listen Thread UDP Remote Buffer Overflow Vulnerability
BugTraq ID: 19369
Remote: Yes
Date Published: 2006-08-06
Relevant URL: http://www.securityfocus.com/bid/19369
Summary:
DConnect Daemon is prone to a buffer-overflow vulnerability because the library fails to do proper boundary checks before copying user-supplied data into a finite-sized buffer.

This issue allows remote attackers to execute arbitrary code within the context of the application or cause the application to crash causing a denial of service.

Version 0.7.0, CVS July 30th 2006 and prior versions are vulnerable to this issue.

15. DConnect Daemon DC Chat Denial of Service Vulnerability
BugTraq ID: 19370
Remote: Yes
Date Published: 2006-08-06
Relevant URL: http://www.securityfocus.com/bid/19370
Summary:
DConnect Daemon is prone to a denial-of-service vulnerability.

This issue occurs because the application fails to handle null-pointer exceptions properly.

An attacker can exploit this issue to crash the server, causing a denial-of-service.

Version 0.7.0, CVS July 30th 2006 and prior versions are vulnerable to this issue.

16. DConnect Daemon Multiple Format String Vulnerabilities
BugTraq ID: 19371
Remote: Yes
Date Published: 2006-08-06
Relevant URL: http://www.securityfocus.com/bid/19371
Summary:
DConnect Daemon is prone to multiple remote format-string because the application fails to sanitize user-supplied input before passing it to a formatted-output function.

An attacker can exploit these issues to execute arbitrary code within the context of the server.

Version 0.7.0, CVS July 30, 2006 and prior versions are vulnerable to this issue.

17. Clam Anti-Virus ClamAV UPX Compressed PE File Heap Buffer Overflow Vulnerability
BugTraq ID: 19381
Remote: Yes
Date Published: 2006-08-07
Relevant URL: http://www.securityfocus.com/bid/19381
Summary:
ClamAV is prone to a heap buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

This issue occurs when the application attempts to handle compressed UPX files.

Exploiting this issue could allow attacker-supplied machine code to be executed in the context of the affected application. The issue would occur when the malformed file is scanned manually or automatically in deployments such as email gateways.

ClamAV versions 0.88.2 and 0.88.3 are vulnerable to this issue; prior versions may also be affected.

18. Linux Kernel NFS and EXT3 Combination Remote Denial of Service Vulnerability
BugTraq ID: 19396
Remote: No
Date Published: 2006-08-07
Relevant URL: http://www.securityfocus.com/bid/19396
Summary:
The Linux kernel is susceptible to a remote denial-of-service vulnerability because the EXT3 filesystem code fails to properly handle unexpected conditions.

Remote attackers may trigger this issue by sending crafted UDP datagrams to affected computers that are configured as NFS servers, causing filesystem errors. Depending on the mount-time options of affected filesystems, this may result in remounting filesystems as read-only or cause a kernel panic.

Linux kernel versions 2.6.14.4, 2.6.17.6, and 2.6.17.7 are vulnerable to this issue; other versions in the 2.6 series are also likely affected.

19. XChat Remote Denial of Service Vulnerability
BugTraq ID: 19398
Remote: Yes
Date Published: 2006-08-07
Relevant URL: http://www.securityfocus.com/bid/19398
Summary:
XChat is prone to a remote denial-of-service vulnerability because it fails to properly handle unexpected data from malicious IRC users.

This issue allows remote attackers to crash affected IRC clients, denying service to legitimate users. To exploit this issue, attackers send malformed data to unsuspecting users.

XChat version 2.6.7 for Windows is vulnerable to this issue; other versions and platforms may also be affected.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is Sponsored by: SPI Dynamics

ALERT: Ajax Security Dangers- How Hackers are attacking Ajax Web Apps
While Ajax can greatly improve the usability of a Web application, it can also create several opportunities for possible attack if the application is not designed with security in mind. Download this SPI Dynamics white paper.

https://download.spidynamics.com/1/ad/AJAX.asp?Campaign_ID=70160000000CZBn