SecurityFocus Linux Newsletter #91

SecurityFocus Linux Newsletter #91
----------------------------------

This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!
http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml

-------------------------------------------------------------------------------


I. FRONT AND CENTER
     1. Filtering E-Mail with Postfix and Procmail, Part Four
     2. Detecting and Removing Malicious Code
     3. High-Flying Schmidt
     4. Black Hat Briefings & Training
     5. Secure i-World
     6. SecurityFocus DPP Program
II. LINUX VULNERABILITY SUMMARY
     1. Multiple Vendor Dump File Locking Denial Of Service Vulnerability
     2. Geeklog HTML Attribute Cross Site Scripting Vulnerability
     3. Geeklog Email Composition CRLF Injection Vulnerability
     4. PHP HTTP POST Incorrect MIME Header Parsing Vulnerability
     5. GNU Mailman Subscribe Cross-Site Scripting Vulnerability
     6. GNU Mailman Admin Login Variant Cross-Site Scripting Vulnerability
     7. Pine Empty MIME Boundary Denial Of Service Vulnerability
     8. Andrew Bishop WWWOFFLE Negative Content-Length Buffer Overflow...
     19. Sun Java Web Start JNLP Predictable File Location Vulnerability
     10. Tip File Locking Denial Of Service Vulnerability
     11. DansGuardian Hex Encoding URL Content Filter Bypass Vulnerability
     12. Mozilla JavaScript URL Host Spoofing Arbitrary Cookie Access...
     13. TightVNC Repeated Challenge Replay Attack Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. Rootkit Info (Thread)
     2. Security by hiding processes (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. DbEncrypt for Oracle
     2. iBroker SecureWeb Application Firewall
     3. Guardian Digital Linux Lockbox
V. NEW TOOLS FOR LINUX PLATFORMS
     1. Pachyderm-fw v0.91
     2. Maillog View v1.02.6
     3. Linux Firewall v2.0rc2
VI. SPONSORSHIP INFORMATION




I. FRONT AND CENTER
-------------------
1. Filtering E-Mail with Postfix and Procmail, Part Four
By Brian Hatch

This is the fourth and final installment in a series on filtering e-mail
with Postfix and Procmail. This installment will discuss two tools that
are available for use with Procmail: Razor, an automated spam tagging and
filtering tool, and SpamAssassin, a mail filter that contains hundreds of
different spam tests.

http://online.securityfocus.com/infocus/1611

2. Detecting and Removing Malicious Code
by Matthew Tanase

Has it happened yet? The phone call, the e-mail, the page, or maybe you
discovered it yourself. Something wasn't right: sluggish performance, too
much network activity, a missing file. After a little investigating, the
realization - you've been cracked. If this isn't familiar to you yet, odds
are it will be in the future. Crackers have access to countless variations
of malicious code: automated rootkits, trojans, viruses and specific
exploits, all designed to breach your security. Detecting and removing
these programs can be a daunting task, with little room for wasted time or
error. In this article, I'll explain techniques readers can use to get
their system back on-line and prevent it from happening again.

http://online.securityfocus.com/infocus/1610

3. High-Flying Schmidt
By George Smith

Unstoppable viruses, massive blackouts, hacked pacemakers? The
government's number two cyber security guy wasn't this apocalyptic when he
worked for Microsoft.

http://online.securityfocus.com/columnists/97

4. Black Hat Briefings & Training

Attend Black Hat Briefings & Training, July 29 - August 1, Las Vegas, the
world's premier technical security event! 8 tracks, 12 training sessions,
Richard Clarke keynote, 1500 delegates from 30 nations, with a near cult
following of both CSOs and "underground" security experts.  See for
yourself what the buzz is all about.

Visit us at: http://www.blackhat.com

5. WebSec 2002, the Online Privacy Conference

MIS Training Institute presents Secure i-World, featuring WebSec 2002, the
Online Privacy Conference, and Secure i-World Expo -- two innovative
conferences and an outstanding expo, all in one blockbuster event.
Secure i-World will be held in San Diego, CA on August 19-21, 2002, with
optional workshops August 17, 18, 21, and 22.  The vendor expo will be
August 19 and 20.

For more information and to register for the industry's premier security
event visit http://www.secureiworld.com/07/sw02nl21inf.html.

6. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!!
Sign-up now for preferred pricing on the only global early-warning system
for cyber attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml


II. BUGTRAQ SUMMARY
-------------------
1. Multiple Vendor Dump File Locking Denial Of Service Vulnerability
BugTraq ID: 5264
Remote: No
Date Published: Jul 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5264
Summary:

dump is a file backup utility for Unix and Linux variants.

It is possible for local attackers to create a denial of service by
creating a file lock on files that the dump utility requires for normal
operation.  It is possible to exploit this condition by placing a file
lock on '/etc/dumpdates'.

This may be exploited to effectively prevent dump from backing up files.

The process holding the file lock must be killed to resume normal
operation.

This issue has been reported in dump implementations supplied with various
Unix and Linux distributions.

2. Geeklog HTML Attribute Cross Site Scripting Vulnerability
BugTraq ID: 5270
Remote: Yes
Date Published: Jul 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5270
Summary:

Geeklog is freely available, open-source weblog software. It is written in
PHP and will run on most Unix and Linux variants, as well as Microsoft
Windows NT/2000. Geeklog is backended by MySQL.

A cross site scripting vulnerability has been reported for Geeklog
1.3.5sr1. Reportedly, Geeklog does not properly sanitize user supplied
input before being included when posting comments or writing stories.

Geeklog makes efforts to sanitize some malicious user supplied input by
stripping out HTML elements that are used for scripting. However, Geeklog
does not properly remove HTML attributes that are used for the same
purpose.

It is possible for an attacker to include malicious HTML code using the
HTML attributes. As an example, if an attacker were to supply malicious
HTML code as part of an onMouseOver JavaScript event, the malicious code
would not be properly sanitized.

An attacker may construct a link containing dangerous HTML code and send
it to a vulnerable user. If a user of the site follows this link, the
script code will be rendered, and execute within the context of the
vulnerable site. It may be possible to access sensitive data such as
authentication credentials, or to take actions as a validated user on the
hosted forum.

This issue may potentially be exploited to hijack web content or steal
cookie-based authentication credentials from legitimate users.

3. Geeklog Email Composition CRLF Injection Vulnerability
BugTraq ID: 5271
Remote: Yes
Date Published: Jul 19 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5271
Summary:

Geeklog is freely available, open-source weblog software. It is written in
PHP and will run on most Unix and Linux variants, as well as Microsoft
Windows NT/2000. Geeklog is backended by MySQL.

A vulnerability has been reported for Geeklog that may allow an attacker
to include extra email headers when composing email to other Geeklog
users.

Geeklog prevents the disclosure of a user's real email address for privacy
reasons. However an attacker is able to obtain a user's real email address
by including extra headers when composing an email using Geeklog's 'Send
Email' facility.

It is possible for an attacker to include extra email header fields when
composing an email. An attacker does this by appending a CRLF sequence
followed by an email header field to the subject field.

An attacker can use this method to obtain a user's real email address.

4. PHP HTTP POST Incorrect MIME Header Parsing Vulnerability
BugTraq ID: 5278
Remote: Yes
Date Published: Jul 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5278
Summary:

PHP is a general purpose scripting language that is used for Web
development. It is available for various platforms including Linux and
Unix variants as well as Microsoft Windows operating systems.

A vulnerability has been reported for PHP versions 4.2.0 and 4.2.1. It is
possible for a remote attacker to cause the PHP interpreter to crash the
web server on a vulnerable system and execute malicious, attacker supplied
code.

The vulnerability is the result of the PHP interpreter incorrectly parsing
MIME headers when HTTP POST commands are received. When PHP receives a
malformed POST request, it generates an error condition that is improperly
handled.

When a HTTP POST command is received, a memory structure is appended to a
linked list of MIME headers. The memory allocated for this structure is
freed when the POST command is successful. When a malformed POST request
is made, an uninitialised memory structure is appended to the list of MIME
headers. Attempting to free this memory will have negative consequences
for a vulnerable system.

This vulnerability has different effects on different architectures. It
has been reported that PHP will crash when it tries to free the memory
structure on an IA32 (x86) architecture. The IA32 architecture has been
verified to be safe from the execution of arbitrary code. However, it is
still possible to crash PHP as well as the web server on vulnerable
systems.

It has also been reported that on Sparc architectures, an attacker may
have greater control about how memory is freed. Arbitrary code execution
on the Sparc architecture is possible.

An attacker may take advantage of this vulnerability to cause the PHP
interpreter to crash leading to a denial of service or cause the
vulnerable web server to execute malicious, attacker supplied code. It may
also be possible for the attacker to gain elevated privileges.

5. GNU Mailman Subscribe Cross-Site Scripting Vulnerability
BugTraq ID: 5298
Remote: Yes
Date Published: Jul 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5298
Summary:

GNU Mailman is a freely available, open-source mailing list manager
written in Python and C.  It runs on Linux and other Unix-based systems.

GNU Mailman is prone to a cross-site scripting vulnerability.  Arbitrary
HTML and script code are not sanitized from the URI parameters of mailing
list subscribe scripts.

An attacker may exploit this issue by creating a malicious link containing
arbitrary script code and enticing a web user to visit the link.  A user
visiting the link will have the attacker's script code executed in their
web browser in the context of the site running the vulnerable software.

The attacker may potentially exploit this condition to steal cookie-based
authentication credentials.

6. Pyramid BenHur Default Firewall Weakness
BugTraq ID: 5279
Remote: Yes
Date Published: Jul 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5279
Summary:

Pyramid BenHur is a firewall appliance. It is based on Debian Linux using
Linux kernel 2.2.x and ipchains firewalling capabilites.

A vulnerability has been reported for the BenHur device. Reportedly, the
device has a weak default firewall configuration ruleset. It is possible
for an attacker to connect to any port between 1024 and 65096 on the
device provided the source port is TCP port 20.  This is due to a poorly
designed rule that was put in place to support FTP data connections.

Attackers may exploit this vulnerability to connect to potentially
sensitive/vulnerable ports on the device such as the administration port
(8888) or the the web proxy server.

7. GNU Mailman Admin Login Variant Cross-Site Scripting Vulnerability
BugTraq ID: 5299
Remote: Yes
Date Published: Jul 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5299
Summary:

GNU Mailman is a freely available, open-source mailing list manager
written in Python and C. It runs on Linux and other Unix-based systems.

GNU Mailman is prone to a cross-site scripting vulnerability. An attacker
may construct a malicious link to the administrative login page, which
could allow the execution of arbitrary HTML and script code.

Visiting the link would result in the execution of an attacker's script
code in the web browser of a user.  This code would be executed in the
context of the site running the vulnerable software.

The attacker may potentially exploit this condition to steal cookie-based
authentication credentials.

This is a variation of the vulnerability described in Bugtraq ID 4825 "GNU
Mailman Admin Login Cross-Site Scripting Vulnerability".  This variation
affects version 2.0.11 of GNU Mailman as well.

8. Pine Empty MIME Boundary Denial Of Service Vulnerability
BugTraq ID: 5301
Remote: Yes
Date Published: Jul 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5301
Summary:

Pine is an open source mail user agent distributed by the University of
Washington.  It is freely available for Unix, Linux, and Microsoft
Operating Systems.

A problem with the mail client could make it possible to crash pine
sessions.

A typical email containing MIME content declares the boundary of the
content using a field of the following type:

Content-Type: multipart/mixed; boundary="boundaryid" Mime-Version: 1.0

Where boundaryid is a hex value generated by the client sending the email.
The number contained in the boundaryid field signals the receiving mail
user agent that when this value is parsed, the data to the end of the
boundary is to be decoded.

When a mail is received by pine that contains MIME content, and the value
of the MIME boundary is blank, pine becomes unstable.  This vulnerability
has been discovered to cause a core dump in the pine client, and could be
used to deny service to legitimate users of the client.

It is unknown whether this vulnerability may be exploited to potentially
execute arbitrary code.  If this does prove to be an issue, an attacker
may be able to execute code with the privileges of the pine user.

9. Andrew Bishop WWWOFFLE Negative Content-Length Buffer Overflow Vulnerability
BugTraq ID: 5260
Remote: Yes
Date Published: Jul 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5260
Summary:

WWWOFFLE is a simple proxy server with special features for use with
dial-up internet links. It is designed for use with Linux and Unix variant
operating systems.

A buffer overflow vulnerability has been reported for version 2.7b of
WWWOFFLE. Reportedly, when wwwoffled receives a negative value for the
Content-Length of a response, it will crash.

When wwwoffle receives a negative value for the Content-Length, it will
accept the data as a signed integer. This value is then passed to
memcpy(), which expects an unsigned integer. As a result, an extremely
large amount of memory is allocated, exhausting process resources and
resulting in a crash.

A malicious web server may misrepresent the Content-length of a response,
and will cause wwwoffle to crash. It may be possible to exploit this
vulnerability to execute arbitrary code as the wwwoffle process. This has
not, however, been confirmed.

10. Sun Java Web Start JNLP Predictable File Location Vulnerability
BugTraq ID: 5263
Remote: Yes
Date Published: Jul 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5263
Summary:

Sun's Java Web Start is a platform for deploying Java applications through
the web. Web Start is implemented in Java, and thus available for most
major platforms, including Microsoft Windows and Linux.

Java applications deployed through Web Start may be described by a Java
Network Launching Protocol (JNLP) file, an XML document which describes
the application and provides references to additional resources such as
image files. An error has been reported in the way Java Web Start handles
JNLP files.

Image files referenced in a JNLP file are stored in a predictable
location. An attacker may create a malicious JNLP file which will place
arbitrary files in a known location. A URL reference to the file may then
cause malicious content or code to be executed within local context.

It has been demonstrated that a .mht file may be renamed as a .gif file
and deposited in this way. If referenced through some browsers with the
protocol specified as mhtml, attached executable content may be
automatically dropped to a defined directory on the local system, and then
referenced in turn.

This behavior has been reported on Web Start installed under Microsoft
Windows. Other versions may share this behavior.

The ability to plant a file on the victim filesystem may also be leveraged
in conjunction with other vulnerabilities such as that described by
Bugtraq ID 3867.

11. Tip File Locking Denial Of Service Vulnerability
BugTraq ID: 5265
Remote: No
Date Published: Jul 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5265
Summary:

tip is a Unix and Linux utility for using a modem or a serial connection
to connect to other systems.

It is possible for local attackers to create a denial of service by
creating a file lock on files that the tip utility requires for normal
operation.  It is possible to exploit this condition by placing a file
lock on the 'ACCULOG' file, which is normally stored in the '/var/log'
directory.

This issue may be exploited to prevent users from using tip to communicate
with serial devices, connect with remote hosts, etc.  The tip utility may
be invoked by other applications.

The process holding the file lock must be killed to resume normal
operation.

12. DansGuardian Hex Encoding URL Content Filter Bypass Vulnerability
BugTraq ID: 5291
Remote: Yes
Date Published: Jul 23 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5291
Summary:

DansGuardian is a web content filter based on the Squid HTTP proxy server.
It is available for various Unix based operating systems, including Linux.

A vulnerability in DansGuardian may allow malicious users to bypass some
filter rules. URLs which contain hex encoded characers are not processed
before the URL is checked against patterns. A user may specify a URL
including several such characters in an attempt to bypass restrictions
impossed by DansGuardian.

Under some installations, this may violate security policy, or allow users
to inadvertantly access malicious web content.

13. Mozilla JavaScript URL Host Spoofing Arbitrary Cookie Access Vulnerability
BugTraq ID: 5293
Remote: Yes
Date Published: Jul 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5293
Summary:

Mozilla is an open source web browser available for a number of platforms,
including Microsoft Windows and Linux. An issue has been reported in the
Mozilla web browser which may allow script code to access cookie data
associated with arbitrary domains.

Mozilla supports javascript: URLs, which can be used to execute JavaScript
functions directly. Normally the domain of such functions is restricted,
and cookie data associated with other sites may not be accessed.

It has been reported possible to create a javascript: URL which appears to
start with a valid domain. Malicious script code may specify an arbitrary
domain, and will be able to access cookie data associated with that
domain.

It is possible to exploit this vulnerability by creating a javascript: URL
which starts with a javascript comment of the form '//host\n', followed by
arbitrary script code. Other avenues of exploitation may, however, be
possible.

Exploitation of this vulnerability may result in a remote attacker gaining
access to sensitive cookie data, including authentication credentials.

14. TightVNC Repeated Challenge Replay Attack Vulnerability
BugTraq ID: 5296
Remote: Yes
Date Published: Jul 24 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5296
Summary:

TightVNC is a Virtual Network Computing (VNC) client and server, available
for a number of platforms including Microsoft Windows and Linux. An error
has been reported in some versions of the TightVNC server.

When a VNC connection is established, a DES challenge-response cycle is
used in order to prevent the transmission of plaintext password data. An
attacker able to view network traffic should not gain sufficient
information to authenticate as the valid user.

TightVNC, however, has been reported to repeat a given DES challenge if
multiple connections are initiated in rapid sequence. A network
eavesdropper may repeat a previously witnessed response, and authenticate
as a valid user. Exploitation will, however, be highly dependent on the
timing of an attack.

This behavior has been reported in version 1.2.1 of TightVNC for Unix.
Other versions may share this vulnerability, this has not however been
confirmed.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Rootkit Info (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/284509

2. Security by hiding processes (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/283872


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. DbEncrypt for Oracle
by Application Security, Inc. (ASI)
Platforms: HP-UX, Linux, Solaris, SunOS, Windows 2000, Windows NT, Windows
Relevant URL:
http://www.appsecinc.com/products/dbencrypt/oracle/
Summary:

DbEncrypt for Oracle is a flexible solution providing a means of
encrypting rows and columns in a database. DbEncrypt for Oracle provides
you a complete database encryption solution including a variety of strong
encryption algorithms to pick from, templates to build your own encryption
procedures from, as well as a point-and-click user interface for
installing and managing the encryption, all at an affordable price.
DbEncrypt for Oracle provides protection for your most valuable assets -
the information in your database.

2. iBroker SecureWeb Application Firewall
by Multinet, Inc.
Platforms: Linux, UNIX, Windows 2000, Windows NT
Relevant URL:
http://elitesecureweb.com/dta/products/solutions.html
Summary:

iBroker SecureWeb allows you to protect Web applications from all known
and unknown attacks. iBroker SecureWeb wraps around IIS and Apache Web
servers and works as plug-in within it, verifying and analyzing incoming
and outgoing Web server data for any possible security breaches. It
creates an application firewall, which overcomes limitations of Intrusion
Detection Systems and Conventional Network Firewalls. iBroker SecureWeb is
the most powerful proactive HTTP application firewall.

3. Guardian Digital Linux Lockbox
by Guardian Digital, Inc.
Platforms: Linux
Relevant URL:
http://www.guardiandigital.com/lockbox.html
Summary:

The Guardian Digital Linux Lockbox is the first open source network server
appliance designed to serve as a complete e-business solution. Powering
the Lockbox is EnGarde, Guardian Digital's Linux, engineered to achieve
the level of security required to conduct e-business.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Pachyderm-fw v0.91
by Pachyderm Firewall Management Software
Relevant URL:
http://pachyderm-fw.sourceforge.net
Platforms: Linux
Summary:

Pachyderm is graphical firewall management software for ipchains. It is
based on MySQL and PHP, easy to use, and has lots of configuration
abilities.

2. Maillog View v1.02.6
by Angelo 'Archie' Amoruso
Relevant URL:
http://cdrecwebmin.sf.net/
Platforms: Linux
Summary:

Maillog View is a Webmin module that allows you to easily view all your
/var/log/maillog.* files. It features autorefresh, message size
indication, ascending/descending view order, compressed file support, and
a full statistics page. Sendmail, Postfix, and Exim are supported

3. Linux Firewall v2.0rc2
by Scott Bartlett
Relevant URL:
http://projectfiles.com/firewall/
Platforms: Linux
Summary:

Projectfiles.com Linux Firewall is a robust, well-designed firewall for
Linux 2.4 based on netfilter/iptables. It supports advanced features for
both servers and routers such as port forwarding and connection logging.
It has verbose success and failure messages, and is easy to install and
configure.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!
http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml
-------------------------------------------------------------------------------