SecurityFocus Linux Newsletter #307

SecurityFocus Linux Newsletter #307
----------------------------------------

This Issue is Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Cross-Site Scripting Attack" - White Paper
Cross-site scripting vulnerabilities in web apps allow hackers to 
compromise confidential information, steal cookies and create requests 
that can be mistaken
https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=70160000000Cc5Y

------------------------------------------------------------------
I.   FRONT AND CENTER
        1. Hacking Web 2.0 Applications with Firefox
        2. Recent Security Enhancements in NetBSD
II.  LINUX VULNERABILITY SUMMARY
        1. Invision Gallery Index.PHP SQL Injection Vulnerability
        2. Invision Gallery Index.PHP Directory Traversal Vulnerability
        3. Mono System.CodeDom.Compiler Class Insecure Temporary File 
Creation Vulnerability
        4. PHP ZendEngine ECalloc Integer Overflow Vulnerability
        5. Linux Kernel ATM SkBuff Dereference Remote Denial of Service 
Vulnerability
        6. Python Repr() Function Remote Code Execution Vulnerability
        7. Linux Kernel S/390 Copy_From_User Local Information 
Disclosure Vulnerability
        8. X.Org XDM XSession Script Race Condition Vulnerability
        9. OpenSSH-Portable Existing Password Remote Information 
Disclosure Weakness
        10. Red Hat Fedora Core Libtool-LTDL Relative Path Arbitrary 
Code Execution Vulnerability
III. LINUX FOCUS LIST SUMMARY
        1. Dynamic firewall based on bandwidth usage ?
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Hacking Web 2.0 Applications with Firefox
By Shreeraj Shah
This article looks at some of the methods, tools and tricks to dissect 
web 2.0 applications (including Ajax) and discover security holes using 
Firefox and ithttp://www.securityfocus.com/infocus/1879

2. Recent Security Enhancements in NetBSD
By Elad Efrat
NetBSD is renowned for its focus on portability, but great care is also 
given to security. This paper presents the NetBSD philosophy on 
security, major desighttp://www.securityfocus.com/infocus/1878


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Invision Gallery Index.PHP SQL Injection Vulnerability
BugTraq ID: 20327
Remote: Yes
Date Published: 2006-10-03
Relevant URL: http://www.securityfocus.com/bid/20327
Summary:
Invision Gallery is prone to an SQL-injection vulnerability because the 
application fails to properly sanitize user-supplied input before using 
it in an SQL query.

A successful exploit could allow an attacker to compromise the 
application, access or modify data, or exploit vulnerabilities in the 
underlying database implementation.

2. Invision Gallery Index.PHP Directory Traversal Vulnerability
BugTraq ID: 20328
Remote: Yes
Date Published: 2006-10-03
Relevant URL: http://www.securityfocus.com/bid/20328
Summary:
Invision Gallery is prone to a directory-traversal vulnerability because 
the application fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files 
from the vulnerable system in the context of the affected application. 
Information obtained may aid attackers in further attacks.

3. Mono System.CodeDom.Compiler Class Insecure Temporary File Creation 
Vulnerability
BugTraq ID: 20340
Remote: No
Date Published: 2006-10-04
Relevant URL: http://www.securityfocus.com/bid/20340
Summary:
The Mono 'System.CodeDom.Compiler' class creates temporary files in an 
insecure manner.

An attacker with local access could potentially exploit this issue to 
perform symlink attacks, overwriting arbitrary files in the context of 
the affected application.

Successfully exploiting a symlink attack may allow an attacker to 
overwrite or corrupt sensitive files. This may result in a denial of 
service; other attacks may also be possible.

Versions 1.0 and 2.0 are vulnerable; other versions may also be affected.

4. PHP ZendEngine ECalloc Integer Overflow Vulnerability
BugTraq ID: 20349
Remote: Yes
Date Published: 2006-10-05
Relevant URL: http://www.securityfocus.com/bid/20349
Summary:
PHP is prone to an integer-overflow vulnerability because the 
application fails to do proper bounds checking on user-supplied data.

An attacker can exploit this vulnerability to execute arbitrary code in 
the context of the affected application. Failed exploit attempts will 
likely cause denial-of-service conditions.

5. Linux Kernel ATM SkBuff Dereference Remote Denial of Service 
Vulnerability
BugTraq ID: 20363
Remote: Yes
Date Published: 2006-10-05
Relevant URL: http://www.securityfocus.com/bid/20363
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability.

This issue is triggered when the kernel processes incoming ATM data.

Exploiting this vulnerability may allow remote attackers to crash the 
affected kernel, resulting in denial-of-service conditions.

This issue affects only systems that have ATM hardware and are 
configured for ATM kernel support.

Kernel versions from 2.6.0 up to and including 2.6.17 are vulnerable to 
this issue.

6. Python Repr() Function Remote Code Execution Vulnerability
BugTraq ID: 20376
Remote: Yes
Date Published: 2006-10-06
Relevant URL: http://www.securityfocus.com/bid/20376
Summary:
Python is susceptible to a remote code-execution vulnerability because 
the application fails to properly handle UTF-32/UCS-4 strings.

This issue allows remote attackers to execute arbitrary machine code 
with the privileges of the python application.

7. Linux Kernel S/390 Copy_From_User Local Information Disclosure 
Vulnerability
BugTraq ID: 20379
Remote: No
Date Published: 2006-10-06
Relevant URL: http://www.securityfocus.com/bid/20379
Summary:
The Linux kernel is prone to a local information-disclosure 
vulnerability on the S/390 architecture because the kernel fails to 
properly initialize kernel memory before returning it to user-space 
programs.

Successfully exploiting this issue allows local attackers to gain access 
to potentially sensitive information contained in kernel memory, aiding 
them in further attacks.

Linux kernel versions prior to 2.6.19-rc1 on the S/390 architecture are 
vulnerable to this issue.

8. X.Org XDM XSession Script Race Condition Vulnerability
BugTraq ID: 20400
Remote: No
Date Published: 2006-10-06
Relevant URL: http://www.securityfocus.com/bid/20400
Summary:
The X.org XDM XSession script is prone to a race-condition vulnerability.

Local unprivileged attackers can exploit this issue to gain access to 
the primary or alternate 'xdm' error log files. A successful exploit 
will result in the unintended disclosure of sensitive information.

9. OpenSSH-Portable Existing Password Remote Information Disclosure Weakness
BugTraq ID: 20418
Remote: Yes
Date Published: 2006-10-09
Relevant URL: http://www.securityfocus.com/bid/20418
Summary:
It is reported that OpenSSH contains an information disclosure weakness. 
This issue exists in the portable version of OpenSSH. The portable 
version is the version that is distributed for operating systems other 
than its native OpenBSD platform.

This issue has been confirmed as not deriving from either the Pluggable 
Authentication Module (PAM) issue disclosed in BID 11781 in 2004, or the 
more recent Generic Security Services Application
Programming Interface (GSSAPI) based information leak outlined in BID 
20245. It is reported that it is possible to verify access credentials 
for users with an existing system password by measuring SSH 
authentication timing differences.

This weakness allows remote users to test for the existence of valid 
usernames with a password set. Knowledge of system users with 
established passwords may aid in further attacks.

10. Red Hat Fedora Core Libtool-LTDL Relative Path Arbitrary Code 
Execution Vulnerability
BugTraq ID: 20434
Remote: No
Date Published: 2006-10-10
Relevant URL: http://www.securityfocus.com/bid/20434
Summary:
The Red Hat Fedora Core Linux operating system is prone to an arbitrary 
code execution vulnerability.

An attacker can exploit this issue to potentially execute arbitrary code 
with the privileges of the user running the affected binary.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Dynamic firewall based on bandwidth usage ?
http://www.securityfocus.com/archive/91/448124

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to 
[email protected] from the subscribed address. 
The contents of the subject or message body do not matter. You will 
receive a confirmation request message to which you will have to answer. 
Alternatively you can also visit 
http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email [email protected] and 
ask to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Cross-Site Scripting Attack" - White Paper
Cross-site scripting vulnerabilities in web apps allow hackers to 
compromise confidential information, steal cookies and create requests 
that can be mistaken
https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=70160000000Cc5Y