SecurityFocus Linux Newsletter #303

Peter Laborge <[email protected]> Fri, 15 Sep 2006 09:34:41 -0600

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #303
----------------------------------------

This issue is Sponsored by: SPI Dynamics

ALERT: Test and assess your Web Applications- FREE WebInspect Trial
Hackers are exploiting web apps with attacks such as; SQL Injection,XSS and Session Hijacking, all undetectable by Firewalls and IDS!
Are you vulnerable? Run a FREE Test of your Web Apps via our FREE 15 Day Product Trial that delivers a comprehensive Vulnerability Report

https://download.spidynamics.com/1/ad/fwi.asp?Campaign_ID=70160000000Cb6B

------------------------------------------------------------------
I. FRONT AND CENTER
1. Disclosure survey
2. Analyzing malicious SSH login attempts
II. LINUX VULNERABILITY SUMMARY
1. OpenSSL PKCS Padding RSA Signature Forgery Vulnerability
2. ISC BIND Multiple Remote Denial of Service Vulnerabilities
3. IBM Director Redirect.bat Directory Traversal Vulnerability
4. X.Org X Window Server LibX11 XKEYBOARD Extension Local Buffer Overflow Vulnerability
5. DokuWiki Multiple Input Validation Vulnerabilities
6. IBM Director Multiple Remote Input Validation Vulnerabilities
7. Mono XSP Unspecified Directory Traversal Vulnerability
8. Linux Kernel ULE Packet Handling Remote Denial of Service Vulnerability
9. RETIRED: Invision Power Board Index.PHP ST Parameter SQL Injection Vulnerability
10. CMS.R. Index.PHP SQL Injection Vulnerability
11. IBM Lotus Domino Web Access Session Hijacking Vulnerability
12. X.Org LibXfont CID Font File Multiple Integer Overflow Vulnerabilities
13. CCHost Index.PHP SQL Injection Vulnerability
14. Adobe Flash Player Multiple Remote Code Execution Vulnerabilities
15. FFmpeg Image File Unspecified Multiple Buffer Overflow Vulnerabilities
16. Novell Identity Manager Fan-Out Linux and UNIX Receiver Script Code Injection Vulnerability
17. Mailman Multiple Input Validation Vulnerabilities
18. Zope CSV_Table Information Disclosure Vulnerability
19. GNUTLS PKCS RSA Signature Forgery Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. Write-protect sctors?
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Disclosure survey
By Federico Biancuzzi
Federico Biancuzzi surveys statements from some of the world's largest software companies about vulnerability disclosure, interviews two security companies who pay for vulnerabilities, and then talks with three prominent, independent researchers about their thoughts on choosing a responsible disclosure process. In three parts.
http://www.securityfocus.com/columnists/415

2. Analyzing malicious SSH login attempts
By Christian Seifert
Malicious SSH login attempts have been appearing in some administrators' logs for several years. This article takes a new look at the use of honeypots to analyze malicious SSH login attempts and see what can be learned about this activity. The article then offers recommendations on how to secure one's system against these attacks.
http://www.securityfocus.com/infocus/1876

II. LINUX VULNERABILITY SUMMARY
------------------------------------
1. OpenSSL PKCS Padding RSA Signature Forgery Vulnerability
BugTraq ID: 19849
Remote: Yes
Date Published: 2006-09-05
Relevant URL: http://www.securityfocus.com/bid/19849
Summary:
OpenSSL is prone to a vulnerability that may allow an attacker to forge an RSA signature. The attacker may be able to forge a PKCS #1 v1.5 signature when an RSA key with exponent 3 is used.

An attacker may exploit this issue to sign digital certificates or RSA keys and take advantage of trust relationships that depend on these credentials, possibly posing as a trusted party and signing a certificate or key.

All versions of OpenSSL prior to and including 0.9.7j and 0.9.8b are affected by this vulnerability. Updates are available.

2. ISC BIND Multiple Remote Denial of Service Vulnerabilities
BugTraq ID: 19859
Remote: Yes
Date Published: 2006-09-05
Relevant URL: http://www.securityfocus.com/bid/19859
Summary:
ISC BIND is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to cause denial-of-service conditions, effectively denying service to legitimate users.

3. IBM Director Redirect.bat Directory Traversal Vulnerability
BugTraq ID: 19898
Remote: Yes
Date Published: 2006-09-07
Relevant URL: http://www.securityfocus.com/bid/19898
Summary:
IBM Director is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

Versions prior to 5.10 are vulnerable to this issue.

4. X.Org X Window Server LibX11 XKEYBOARD Extension Local Buffer Overflow Vulnerability
BugTraq ID: 19905
Remote: No
Date Published: 2006-09-07
Relevant URL: http://www.securityfocus.com/bid/19905
Summary:
X.Org X Window Server libX11 library is prone to a local buffer-overflow vulnerability because it fails to properly validate the size of attacker-supplied data before copying it into a finite-sized buffer.

The issue allows local attackers to execute arbitrary machine code in the context of a user running an application that is dynamically linked against the library. Failed exploit attempts will likely crash the application, denying service to legitimate users.

X11R6 4.0 and prior versions are reported affected by this vulnerability.

5. DokuWiki Multiple Input Validation Vulnerabilities
BugTraq ID: 19911
Remote: Yes
Date Published: 2006-09-08
Relevant URL: http://www.securityfocus.com/bid/19911
Summary:
DokuWiki is prone to multiple input-validation vulnerabilities that may allow remote attackers to inject arbitrary PHP code into scripts and to run it in the context of the webserver process.

A successful attack may result in unauthorized access.

6. IBM Director Multiple Remote Input Validation Vulnerabilities
BugTraq ID: 19915
Remote: Yes
Date Published: 2006-09-08
Relevant URL: http://www.securityfocus.com/bid/19915
Summary:
IBM Director is prone to multiple input-validation vulnerabilities.

An attacker can exploit these issues to cause denial-of-service conditions, effectively denying service to legitimate users, and to access cookie and authentication data that may aid in further attacks.

7. Mono XSP Unspecified Directory Traversal Vulnerability
BugTraq ID: 19929
Remote: Yes
Date Published: 2006-09-08
Relevant URL: http://www.securityfocus.com/bid/19929
Summary:
XSP is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

8. Linux Kernel ULE Packet Handling Remote Denial of Service Vulnerability
BugTraq ID: 19939
Remote: Yes
Date Published: 2006-09-11
Relevant URL: http://www.securityfocus.com/bid/19939
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability.

This issue is triggered when the kernel handles a specially crafted ULE packet.

This issue allows remote attackers to trigger a denial of service for legitimate users.

Kernel version 2.6.17.8 is reported vulnerable to this issue; other versions may be affected as well.

9. RETIRED: Invision Power Board Index.PHP ST Parameter SQL Injection Vulnerability
BugTraq ID: 19946
Remote: Yes
Date Published: 2006-09-11
Relevant URL: http://www.securityfocus.com/bid/19946
Summary:
Invision Power Board is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Update: The vendor states that this is not a vulnerability, because the affected parameter is passed through PHP's 'intval' prior to its use. This BID is therefore being retired.

10. CMS.R. Index.PHP SQL Injection Vulnerability
BugTraq ID: 19950
Remote: Yes
Date Published: 2006-09-11
Relevant URL: http://www.securityfocus.com/bid/19950
Summary:
CMS.R. is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

11. IBM Lotus Domino Web Access Session Hijacking Vulnerability
BugTraq ID: 19966
Remote: Yes
Date Published: 2006-09-12
Relevant URL: http://www.securityfocus.com/bid/19966
Summary:
IBM Lotus Domino Web Access is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to authenticate to the application as any user provided that the user's authentication credentials are still on the server. This may lead to other attacks.

Version 7.0.1 is vulnerable to this issue; other versions may also be affected.

12. X.Org LibXfont CID Font File Multiple Integer Overflow Vulnerabilities
BugTraq ID: 19974
Remote: No
Date Published: 2006-09-12
Relevant URL: http://www.securityfocus.com/bid/19974
Summary:
libXfont is prone to multiple integer-overflow vulnerabilities.

Attackers can exploit this issue to execute arbitrary code with superuser privileges. A successful exploit will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial of service.

13. CCHost Index.PHP SQL Injection Vulnerability
BugTraq ID: 19978
Remote: Yes
Date Published: 2006-09-12
Relevant URL: http://www.securityfocus.com/bid/19978
Summary:
ccHost is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

14. Adobe Flash Player Multiple Remote Code Execution Vulnerabilities
BugTraq ID: 19980
Remote: Yes
Date Published: 2006-09-12
Relevant URL: http://www.securityfocus.com/bid/19980
Summary:
Adobe Flash Player is prone to multiple remote code-execution vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could exploit this issue by creating a media file containing large, dynamically generated string data and submitting it to be processed by the media player.

These issues allow remote attackers to execute arbitrary machine code in the context of the user running the application. Other attacks are also possible.

Adobe Flash Player 8.0.24.0 and prior, Adobe Flash Professional 8, Flash Basic, Adobe Flash MX, and 2004Adobe Flex 1.5 are affected.

15. FFmpeg Image File Unspecified Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 20009
Remote: Yes
Date Published: 2006-09-13
Relevant URL: http://www.securityfocus.com/bid/20009
Summary:
FFmpeg is prone to multiple unspecified remote buffer-overflow vulnerabilities because the application using this library fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

These issues allow attackers to execute arbitrary machine code within the context of the affected application.

This BID will be updated as more information is disclosed.

Versions prior to 0.4.9_p20060530 are vulnerable to this issue.

16. Novell Identity Manager Fan-Out Linux and UNIX Receiver Script Code Injection Vulnerability
BugTraq ID: 20016
Remote: No
Date Published: 2006-09-14
Relevant URL: http://www.securityfocus.com/bid/20016
Summary:
Novell Identity Manager is prone to a code-injection vulnerability.

A local attacker with administrative rights to the Identity Manager can exploit this issue to completely compromise an affected computer.

The vulnerability affects version 3.0.1; previous versions may be affected as well.

17. Mailman Multiple Input Validation Vulnerabilities
BugTraq ID: 20021
Remote: Yes
Date Published: 2006-09-14
Relevant URL: http://www.securityfocus.com/bid/20021
Summary:
Mailman is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-input. These issues include multiple cross-site scripting vulnerabilities and a CRLF-injection vulnerability.

A successful exploit of these issues could allow an attacker to steal cookie-based authentication credentials, add additional content to the log file, possibly hide current attacks, or launch phishing-style attacks; other attacks may also be possible.

Versions between 2.1.0 and 2.1.8 are vulnerable to this issue; other versions prior to 2.1.0 may also be affected.

18. Zope CSV_Table Information Disclosure Vulnerability
BugTraq ID: 20022
Remote: Yes
Date Published: 2006-09-14
Relevant URL: http://www.securityfocus.com/bid/20022
Summary:
Zope is prone to an information-disclosure vulnerability because the application fails to properly secure potentially sensitive information.

A remote attacker can exploit this issue to retrieve potentially sensitive information that may aid the attacker in further attacks.

19. GNUTLS PKCS RSA Signature Forgery Vulnerability
BugTraq ID: 20027
Remote: Yes
Date Published: 2006-09-14
Relevant URL: http://www.securityfocus.com/bid/20027
Summary:
GnuTLS is prone to a vulnerability that may allow an attacker to forge an RSA signature. The attacker may be able to forge a PKCS #1 v1.5 signature when verifying a X.509 certificate.

This vulnerability is a variant of the issue discussed in BID 19849 (OpenSSL PKCS Padding RSA Signature Forgery Vulnerability) and affects GnuTLS versions prior to version 1.4.3.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Write-protect sctors?
http://www.securityfocus.com/archive/91/444500

IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V. SPONSOR INFORMATION
------------------------
This issue is Sponsored by: SPI Dynamics

https://download.spidynamics.com/1/ad/fwi.asp?Campaign_ID=70160000000Cb6B