SecurityFocus Linux Newsletter #304

Peter Laborge <[email protected]> Tue, 19 Sep 2006 16:23:51 -0600

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #304
----------------------------------------

This issue is Sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus

------------------------------------------------------------------
I. FRONT AND CENTER
1. Liar, Liar, and pretexting
2. Beginner's guide to wireless auditing
II. LINUX VULNERABILITY SUMMARY
1. Linux Kernel ULE Packet Handling Remote Denial of Service Vulnerability
2. RETIRED: Invision Power Board Index.PHP ST Parameter SQL Injection Vulnerability
3. CMS.R. Index.PHP SQL Injection Vulnerability
4. IBM Lotus Domino Web Access Session Hijacking Vulnerability
5. X.Org LibXfont CID Font File Multiple Integer Overflow Vulnerabilities
6. CCHost Index.PHP SQL Injection Vulnerability
7. Adobe Flash Player Multiple Remote Code Execution Vulnerabilities
8. FFmpeg Image File Unspecified Multiple Buffer Overflow Vulnerabilities
9. Novell Identity Manager Fan-Out Linux and UNIX Receiver Script Code Injection Vulnerability
10. Mailman Multiple Input Validation Vulnerabilities
11. Zope CSV_Table Information Disclosure Vulnerability
12. GNUTLS PKCS RSA Signature Forgery Vulnerability
13. Mozilla Firefox/Thunderbird/Seamonkey Multiple Remote Vulnerabilities
14. BusyBox HTTPD Directory Traversal Vulnerability
15. Linux Kernel SCTP SO_LINGER Local Denial of Service Vulnerability
16. GNU GZip Archive Handling Multiple Remote Vulnerabilities
III. LINUX FOCUS LIST SUMMARY
1. Write-protect sctors?
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Liar, Liar, and pretexting
By Mark Rasch
Mark Rasch details the legality of pretexting by putting it in context with how it used, comparing it with legal forms of lying, and by looking at previous court cases involving pretexting in the United States. Hewlett Packard's use of pretexting also brings up potential charges of criminal fraud, violations of consumer protection laws, issues of deception, and the use of spyware. Together these issues make for a very interesting legal situation at HP.
http://www.securityfocus.com/columnists/417

2. Beginner's guide to wireless auditing
By David Maynor
This article is designed as a beginner's guide to fuzzing wireless device drivers, starting with how to build an auditing environment, how to construct fuzzing tools and finally, how to interpret the results. This auditing environment can be used for WiFi as well as Bluetooth and infrared devices.
http://www.securityfocus.com/infocus/1877

II. LINUX VULNERABILITY SUMMARY
------------------------------------
1. Linux Kernel ULE Packet Handling Remote Denial of Service Vulnerability
BugTraq ID: 19939
Remote: Yes
Date Published: 2006-09-11
Relevant URL: http://www.securityfocus.com/bid/19939
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability.

This issue is triggered when the kernel handles a specially crafted ULE packet.

This issue allows remote attackers to trigger a denial of service for legitimate users.

Kernel version 2.6.17.8 is reported vulnerable to this issue; other versions may be affected as well.

2. RETIRED: Invision Power Board Index.PHP ST Parameter SQL Injection Vulnerability
BugTraq ID: 19946
Remote: Yes
Date Published: 2006-09-11
Relevant URL: http://www.securityfocus.com/bid/19946
Summary:
Invision Power Board is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Update: The vendor states that this is not a vulnerability, because the affected parameter is passed through PHP's 'intval' prior to its use. This BID is therefore being retired.

3. CMS.R. Index.PHP SQL Injection Vulnerability
BugTraq ID: 19950
Remote: Yes
Date Published: 2006-09-11
Relevant URL: http://www.securityfocus.com/bid/19950
Summary:
CMS.R. is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

4. IBM Lotus Domino Web Access Session Hijacking Vulnerability
BugTraq ID: 19966
Remote: Yes
Date Published: 2006-09-12
Relevant URL: http://www.securityfocus.com/bid/19966
Summary:
IBM Lotus Domino Web Access is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to authenticate to the application as any user provided that the user's authentication credentials are still on the server. This may lead to other attacks.

Version 7.0.1 is vulnerable to this issue; other versions may also be affected.

5. X.Org LibXfont CID Font File Multiple Integer Overflow Vulnerabilities
BugTraq ID: 19974
Remote: No
Date Published: 2006-09-12
Relevant URL: http://www.securityfocus.com/bid/19974
Summary:
The libXfont library is prone to multiple integer-overflow vulnerabilities.

Attackers can exploit this issue to execute arbitrary code with superuser privileges. A successful exploit will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial of service.

6. CCHost Index.PHP SQL Injection Vulnerability
BugTraq ID: 19978
Remote: Yes
Date Published: 2006-09-12
Relevant URL: http://www.securityfocus.com/bid/19978
Summary:
ccHost is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

7. Adobe Flash Player Multiple Remote Code Execution Vulnerabilities
BugTraq ID: 19980
Remote: Yes
Date Published: 2006-09-12
Relevant URL: http://www.securityfocus.com/bid/19980
Summary:
Adobe Flash Player is prone to multiple remote code-execution vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could exploit this issue by creating a media file containing large, dynamically generated string data and submitting it to be processed by the media player.

These issues allow remote attackers to execute arbitrary machine code in the context of the user running the application. Other attacks are also possible.

Adobe Flash Player 8.0.24.0 and prior, Adobe Flash Professional 8, Flash Basic, Adobe Flash MX, and 2004Adobe Flex 1.5 are affected.

8. FFmpeg Image File Unspecified Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 20009
Remote: Yes
Date Published: 2006-09-13
Relevant URL: http://www.securityfocus.com/bid/20009
Summary:
FFmpeg is prone to multiple unspecified remote buffer-overflow vulnerabilities because the application using this library fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

These issues allow attackers to execute arbitrary machine code within the context of the affected application.

This BID will be updated as more information is disclosed.

Versions prior to 0.4.9_p20060530 are vulnerable to this issue.

9. Novell Identity Manager Fan-Out Linux and UNIX Receiver Script Code Injection Vulnerability
BugTraq ID: 20016
Remote: No
Date Published: 2006-09-14
Relevant URL: http://www.securityfocus.com/bid/20016
Summary:
Novell Identity Manager is prone to a code-injection vulnerability.

A local attacker with administrative rights to the Identity Manager can exploit this issue to completely compromise an affected computer.

The vulnerability affects version 3.0.1; previous versions may be affected as well.

10. Mailman Multiple Input Validation Vulnerabilities
BugTraq ID: 20021
Remote: Yes
Date Published: 2006-09-14
Relevant URL: http://www.securityfocus.com/bid/20021
Summary:
Mailman is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-input. These issues include multiple cross-site scripting vulnerabilities and a CRLF-injection vulnerability.

A successful exploit of these issues could allow an attacker to steal cookie-based authentication credentials, add additional content to the log file, possibly hide current attacks, or launch phishing-style attacks; other attacks may also be possible.

Versions between 2.1.0 and 2.1.8 are vulnerable to this issue; other versions prior to 2.1.0 may also be affected.

11. Zope CSV_Table Information Disclosure Vulnerability
BugTraq ID: 20022
Remote: Yes
Date Published: 2006-09-14
Relevant URL: http://www.securityfocus.com/bid/20022
Summary:
Zope is prone to an information-disclosure vulnerability because the application fails to properly secure potentially sensitive information.

A remote attacker can exploit this issue to retrieve potentially sensitive information that may aid the attacker in further attacks.

12. GNUTLS PKCS RSA Signature Forgery Vulnerability
BugTraq ID: 20027
Remote: Yes
Date Published: 2006-09-14
Relevant URL: http://www.securityfocus.com/bid/20027
Summary:
GnuTLS is prone to a vulnerability that may allow an attacker to forge an RSA signature. The attacker may be able to forge a PKCS #1 v1.5 signature when verifying a X.509 certificate.

An attacker may exploit this issue to sign digital certificates or RSA keys and take advantage of trust relationships that depend on these credentials, possibly posing as a trusted party and signing a certificate or key.

This vulnerability is a variant of the issue discussed in BID 19849 (OpenSSL PKCS Padding RSA Signature Forgery Vulnerability) and affects GnuTLS versions prior to version 1.4.3.

13. Mozilla Firefox/Thunderbird/Seamonkey Multiple Remote Vulnerabilities
BugTraq ID: 20042
Remote: Yes
Date Published: 2006-09-15
Relevant URL: http://www.securityfocus.com/bid/20042
Summary:
The Mozilla Foundation has released six security advisories specifying vulnerabilities in Mozilla Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- execute arbitrary code
- perform cross-site scripting attacks
- supply malicious data through updates
- inject arbitrary content
- execute arbitrary JavaScript
- crash affected applications and potentially execute arbitrary code.

Other attacks may also be possible.

The issues described here will be split into individual BIDs as more information becomes available.

These issues are fixed in:

- Mozilla Firefox version 1.5.0.7
- Mozilla Thunderbird version 1.5.0.7
- Mozilla SeaMonkey version 1.0.5

14. BusyBox HTTPD Directory Traversal Vulnerability
BugTraq ID: 20067
Remote: Yes
Date Published: 2006-09-16
Relevant URL: http://www.securityfocus.com/bid/20067
Summary:
The httpd daemon of BusyBox is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

This issue affects version 1.01; other versions may also be vulnerable.

15. Linux Kernel SCTP SO_LINGER Local Denial of Service Vulnerability
BugTraq ID: 20087
Remote: No
Date Published: 2006-09-18
Relevant URL: http://www.securityfocus.com/bid/20087
Summary:
The Linux kernel SCTP module is prone to a local denial-of-service vulnerability.

This issue allows local attackers to cause kernel crashes, denying service to legitimate users.

Specific information regarding affected versions of the Linux kernel is currently unavailable. This BID will be updated as further information is disclosed.

16. GNU GZip Archive Handling Multiple Remote Vulnerabilities
BugTraq ID: 20101
Remote: Yes
Date Published: 2006-09-19
Relevant URL: http://www.securityfocus.com/bid/20101
Summary:
The gzip utility is prone to multiple remote buffer-overflow and denial-of-service vulnerabilities when handling malicious archive files.

Successful exploits may allow a remote attacker to corrupt process memory by triggering an overflow condition. This may lead to arbitrary code execution in the context of an affected user and facilitate a remote compromise. Attackers may also trigger denial-of-service conditions by crashing or hanging the application.

Specific information regarding affected versions of gzip is currently unavailable. This BID will be updated as more information is released.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Write-protect sctors?
http://www.securityfocus.com/archive/91/444500

IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to [email protected] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and ask to be manually removed.

V. SPONSOR INFORMATION
------------------------
This issue is Sponsored by: Norwich University

http://www.msia.norwich.edu/secfocus