SecurityFocus Linux Newsletter #301

Peter Laborge <[email protected]> Tue, 29 Aug 2006 15:44:28 -0600
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #301
----------------------------------------

This issue is Sponsored by: SPI Dynamics

FREE Webcast: "Building a Web Application Assessment Program"
During this Webcast, you will learn; key challenges to implementing a Web application assessment program, how to limit false positives and increase  accuracy and why engaging developers is critical to the security process.

https://download.spidynamics.com/1/ad/AMPw.asp?Campaign_ID=70160000000CaZH

------------------------------------------------------------------
I.   FRONT AND CENTER
        1. Anonymous No More
II.  LINUX VULNERABILITY SUMMARY
        1. Linux Kernel PPC970 Systems Local Denial of Service Vulnerability
        2. PHProjekt Content Management Module Multiple Remote File Include Vulnerabilities
        3. Linux Kernel Non-Hugemem Support Local Denial of Service Vulnerability
        4. Linux Kernel s/io.c/IO.C Local Denial of Service Vulnerability
        5. Linux Kernel SCTP_Make_Abort_User Function Buffer Overflow Vulnerability
        6. Drupal E-commerce Module Multiple Cross-Site Scripting Vulnerabilities
        7. Asterisk Multiple Remote Vulnerabilities
        8. CScope Cscope.Lists Multiple Buffer Overflow Vulnerabilities
        9. CScope Reffile Local Buffer Overflow Vulnerability
        10. Wireshark Multiple Vulnerabilities
        11. ImageMagick XCF Image File Remote Unspecified Buffer Overflow Vulnerability
        12. ImageMagick Sun Bitmap Image File Remote Unspecified Buffer Overflow Vulnerability
        13. Linux Kernel ELF File Cross Region Mapping Local Denial of Service Vulnerability
        14. Streamripper HTTP Header Parsing Buffer Overflow Vulnerability
        15. Cybozu Garoon Multiple SQL Injection Vulnerabilities
III. LINUX FOCUS LIST SUMMARY
        1. Write-protect sctors?
        2. Write-protect sctors?
        3. Linux Audit
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Anonymous No More
By Mark Rasch
In early August, officials at America Online released information about searches being conducted by AOL members and users of the AOL search tool.
http://www.securityfocus.com/columnists/414


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Linux Kernel PPC970 Systems Local Denial of Service Vulnerability
BugTraq ID: 19615
Remote: No
Date Published: 2006-08-21
Relevant URL: http://www.securityfocus.com/bid/19615
Summary:
The Linux kernel is prone to a local denial-of-service.

An attacker can exploit this issue to crash the kernel, denying further service to legitimate users.

2. PHProjekt Content Management Module Multiple Remote File Include Vulnerabilities
BugTraq ID: 19628
Remote: Yes
Date Published: 2006-08-21
Relevant URL: http://www.securityfocus.com/bid/19628
Summary:
Multiple remote file-include vulnerabilities affect the Content Management module for PHProjekt because the application fails to properly sanitize user-supplied input before using it in a PHP 'include()' function call.

An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process.

These issues affect version 0.6.1; earlier versions may also be vulnerable.

3. Linux Kernel Non-Hugemem Support Local Denial of Service Vulnerability
BugTraq ID: 19664
Remote: No
Date Published: 2006-08-22
Relevant URL: http://www.securityfocus.com/bid/19664
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a design error in the code which handles support for 'non-hugemem' kernels.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

4. Linux Kernel s/io.c/IO.C Local Denial of Service Vulnerability
BugTraq ID: 19665
Remote: No
Date Published: 2006-08-22
Relevant URL: http://www.securityfocus.com/bid/19665
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue is due to a design error in the direct IO driver.

This vulnerability allows local users to cause a kernel panic, denying further service to legitimate users.

This issue affects the Linux kernel 2.6 series prior to 2.6.10.

5. Linux Kernel SCTP_Make_Abort_User Function Buffer Overflow Vulnerability
BugTraq ID: 19666
Remote: No
Date Published: 2006-08-22
Relevant URL: http://www.securityfocus.com/bid/19666
Summary:
The Linux kernel is prone to a buffer-overflow vulnerability. This issue is due to the kernel's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

  A local attacker can exploit this issue to execute arbitrary codel. Successfully exploiting this issue would cause the complete compromise of the affected computer.

6. Drupal E-commerce Module Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 19675
Remote: Yes
Date Published: 2006-08-22
Relevant URL: http://www.securityfocus.com/bid/19675
Summary:
Drupal E-commerce Module is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Versions prior to 4.7 revision 1.37.2.4 are vulnerable to these issues.

7. Asterisk Multiple Remote Vulnerabilities
BugTraq ID: 19683
Remote: Yes
Date Published: 2006-08-23
Relevant URL: http://www.securityfocus.com/bid/19683
Summary:
Asterisk is prone to remote buffer-overflow, format-string and directory traversal vulnerabilities. These issues are due to the application's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer, and a failure to sanitize user-supplied input.

These vulnerabilities allow remote attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely crash the server, denying further service to legitimate users.

8. CScope Cscope.Lists Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 19686
Remote: Yes
Date Published: 2006-08-24
Relevant URL: http://www.securityfocus.com/bid/19686
Summary:
Cscope is prone to multiple buffer-overflow vulnerabilities. The issues are due to a failure in the application to properly validate the size of attacker-supplied data before copying it into a finite-sized buffer.

These issues allow remote attackers to execute arbitrary machine code in the context of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.

Cscope 15.x is affected by these vulnerabilities. Previous versions may be affected as well.

9. CScope Reffile Local Buffer Overflow Vulnerability
BugTraq ID: 19687
Remote: No
Date Published: 2006-08-24
Relevant URL: http://www.securityfocus.com/bid/19687
Summary:
Cscope is prone to a local buffer-overflow vulnerability. The issue is due to a failure in the application to properly validate the size of attacker-supplied data before copying it into a finite-sized buffer.

The issue allows local attackers to execute arbitrary machine code in the context of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.

Cscope 15.x is affected by this vulnerability. Previous versions may be affected as well.

10. Wireshark Multiple Vulnerabilities
BugTraq ID: 19690
Remote: Yes
Date Published: 2006-08-24
Relevant URL: http://www.securityfocus.com/bid/19690
Summary:
Wireshark is prone to multiple vulnerabilities:

- Multiple denial-of-service vulnerabilities.
- Multiple off-by-one vulnerabilities.

These may permit attackers to execute arbitrary code, which can facilitate a compromise of an affected computer or cause a denial-of-service condition to legitimate users of the application.

11. ImageMagick XCF Image File Remote Unspecified Buffer Overflow Vulnerability
BugTraq ID: 19697
Remote: Yes
Date Published: 2006-08-24
Relevant URL: http://www.securityfocus.com/bid/19697
Summary:
ImageMagick is prone to an unspecified remote buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue allows attackers to execute arbitrary machine code in the context of applications that use the ImageMagick library.

This BID will be updated as further information is disclosed.

Versions of ImageMagick prior to 6.2.9-2 are vulnerable to this issue.

12. ImageMagick Sun Bitmap Image File Remote Unspecified Buffer Overflow Vulnerability
BugTraq ID: 19699
Remote: Yes
Date Published: 2006-08-24
Relevant URL: http://www.securityfocus.com/bid/19699
Summary:
ImageMagick is prone to an unspecified remote buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue allows attackers to execute arbitrary machine code in the context of applications that use the ImageMagick library.

This BID will be updated as further information is disclosed.

Versions of ImageMagick prior to 6.2.9-2 are vulnerable to this issue.

13. Linux Kernel ELF File Cross Region Mapping Local Denial of Service Vulnerability
BugTraq ID: 19702
Remote: No
Date Published: 2006-08-24
Relevant URL: http://www.securityfocus.com/bid/19702
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue could cause an affected computer to crash.

14. Streamripper HTTP Header Parsing Buffer Overflow Vulnerability
BugTraq ID: 19707
Remote: Yes
Date Published: 2006-08-25
Relevant URL: http://www.securityfocus.com/bid/19707
Summary:
Streamripper is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input data before copying it to an insufficiently sized memory buffer.

An attacker may cause malicious code to execute by forcing the application to parse malformed HTTP headers, with the privileges of the user running the application.

15. Cybozu Garoon Multiple SQL Injection Vulnerabilities
BugTraq ID: 19731
Remote: Yes
Date Published: 2006-08-28
Relevant URL: http://www.securityfocus.com/bid/19731
Summary:
Cybozu Garoon is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful attack could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. An attacker can gain administrative access to the application by carrying out a successful attack.

These issues affect versions prior to 2.1.1.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Write-protect sctors?
http://www.securityfocus.com/archive/91/444603

2. Write-protect sctors?
http://www.securityfocus.com/archive/91/444500

3. Linux Audit
http://www.securityfocus.com/archive/91/443621

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is Sponsored by: SPI Dynamics

FREE Webcast: "Building a Web Application Assessment Program"
During this Webcast, you will learn; key challenges to implementing a Web application assessment program, how to limit false positives and increase  accuracy and why engaging developers is critical to the security process.

https://download.spidynamics.com/1/ad/AMPw.asp?Campaign_ID=70160000000CaZH