SecurityFocus Linux Newsletter #74

John Boletta <[email protected]> Tue, 2 Apr 2002 06:37:02 -0700 (MST)

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #74
------------------------------------

This Issue Sponsored by: Alcatel

Did your IPSec run over your VPN?Tech buzz words got you spinning? We can
help.

Please visit us at:

http://alcatel.emark1.com/irc_intro.asp?form=irc_linux_4-1-02
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. No Stone Unturned, Part Two
2. Always On, Always Vulnerable: Security Broadband Connections
3. Beware the Kindness of Strangers: The Case Against Good...
II. LINUX VULNERABILITY SUMMARY
1. Squid Compressed DNS Buffer Overflow Vulnerability
2. Linux Directory Penguin Traceroute Perl Script Arbitrary...
3. VBulletin Cross-Site Scripting Vulnerability
4. Linux Directory Penguin NSLookup Perl Script Arbitrary File...
5. VNC HTTP Server Denial Of Service Vulnerability
6. Alguest Cookie Falsification Vulnerability
7. Instant Web Mail POP Command Execution Vulnerability
8. Etnus TotalView Insecure UID/GID Privilege Escalation...
9. PostNuke Cross Site Scripting Vulnerability
10. Apache Double-Reverse Lookup Log Entry Spoofing Vulnerability
11. CSSearch Remote Command Execution Vulnerability
12. Veridis OpenKeyServer Cross Site Scripting Vulnerability
13. Linux Kernel d_path() Path Truncation Vulnerability
14. Webmin Plaintext Authentication Credentials Disclosure...
15. ht://Dig Configuration File Path Disclosure Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. SecurID and FreeS/WAN GW (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. SecureNet PRO
2. Dragon Monitoring System
3. CaptIO
V. NEW TOOLS FOR LINUX PLATFORMS
1. Sentry Firewall CD-ROM v1.2.0
2. Astaro Security Linux (Sun Cobalt) v2.023
3. Syslog2 v1.0.2
4. DataSAFE Command Line Encryption LINUX
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. No Stone Unturned, Part Two
by H. Carvey

This is the second installment of a 5-part series describing the
(mis)adventures of a sys admin named Eliot and his haphazard journey in
discovering The Way of Incident Response.

http://online.securityfocus.com/infocus/1561

2. Always On, Always Vulnerable: Securing Broadband Connections
by Matthew Tanase

You finally got it. No more late nights at the office wasted on
downloading sprees. No more screeching modems or constant busy signals.
Streaming media, lightning quick file transfers and online gaming, all
within your reach. Yes - you finally have broadband Internet access!

http://online.securityfocus.com/infocus/1560

3. Beware the Kindness of Strangers: The Case Against Good Samaritan
Hackers
by Richard Forno

The debate around Good Samaritan hackers has merits on both sides.
However, according to the author, the answer to the answer is cut and
dried.

http://online.securityfocus.com/columnists/70

II. BUGTRAQ SUMMARY
-------------------
1. Squid Compressed DNS Buffer Overflow Vulnerability
BugTraq ID: 4363
Remote: Yes
Date Published: Mar 26 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4363
Summary:

Squid is a high performance web cache and proxy. Squid was initially
developed for the Unix platform, and is available for Linux and most major
Unix like operating systems. Recent versions of Squid may function under
Windows.

A boundary condition error exists in the internal DNS implementation
included with the Squid web proxy. If a malicious DNS server returns a
malformed compressed DNS answer message, Squid may exit with a SIGSEGV
error.

There have been reports that this vulnerability is the result of heap
memory corruption. Successful exploitation of this vulnerability may allow
a remote attacker to execute arbitrary code on the vulnerable system. This
possibility has not yet been confirmed.

Internal DNS queries are enabled by default.

2. Linux Directory Penguin Traceroute Perl Script Arbitrary Command Execution Vulnerability
BugTraq ID: 4332
Remote: Yes
Date Published: Mar 21 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4332
Summary:

Penguin traceroute.pl is a freely available, open source script for
tracing network hops from a web server. It is distributed by Linux
Directory.

A problem with the script could make it possible for a remote user to
execute arbitrary commands. The problem is in the filtering of special
characters.

The Penguin traceroute script does not adequately filter special
characters. This makes it possible for a remote user to embed commands
into a request using special characters such as the ';' or '|' characters.
The embedded command would be executed with the permissions of the web
browser.

This problem makes it possible for a remote user to execute arbitrary
commands as the web user, and potentially gain remote access to a system
using the vulnerable script.

3. VBulletin Cross-Site Scripting Vulnerability
BugTraq ID: 4349
Remote: Yes
Date Published: Mar 21 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4349
Summary:

vBulletin is commercial web forum software written in PHP and back-ended
by a MySQL database. It will run on most Linux and Unix variants, as well
as Microsoft operating systems.

vBulletin does not filter HTML tags from URL parameters, making it prone
to cross-site scripting attacks.

As a result, it is possible for a remote attacker to create a malicious
link containing script code which will be executed in the browser of a
legitimate user, in the context of the website running vBulletin.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. Cookie-based authentication credentials may be used by the
attacker to hijack the session of the legitimate user.

4. Linux Directory Penguin NSLookup Perl Script Arbitrary File Reading Vulnerability
BugTraq ID: 4353
Remote: Yes
Date Published: Mar 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4353
Summary:

Penguin nslookup.pl is a freely available, open source script for tracing
network hops from a web server. It is distributed by Linux Directory.

A problem with the script could make it possible for a remote user to view
arbitrary files, and execute arbitrary commands. The problem is in the
filtering of special characters.

The Penguin nslookup script does not adequately filter special characters.
This makes it possible for a remote user to access specific files on the
local system. The attacker may read files that are accessible by the web
server. Additionally, the attacker may be able to execute arbitrary
commands with the permissions of the web server by encapsulating commands
in special characters.

This problem makes it possible for a remote user to gain access to
potentially sensitive information, and potentially local access to the
system with the permissions of the web server.

5. VNC HTTP Server Denial Of Service Vulnerability
BugTraq ID: 4345
Remote: Yes
Date Published: Mar 21 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4345
Summary:

VNC is the Virtual Network Computing software package, freely available
from AT&T. The software package is designed to allow remote desktop access
to a user that has sufficient privileges. It is available for Unix and
Linux variants, as well as Microsoft operating systems.

It has been discovered that a vulnerability exists in Red Hat VNC
packages. The VNC server includes a small HTTP server implementation. It
has been discovered that a condition exists which has the potential to
deny service to legitimate VNC users. It is possible to cause the HTTP
server implementation to wait indefinitely for input, effectively
disrupting an active VNC session.

If such a condition is to occur, the VNC server will need to be restarted
to regain normal functionality.

It is not currently known whether other versions of VNC are affected by
this issue.

6. Alguest Cookie Falsification Vulnerability
BugTraq ID: 4355
Remote: Yes
Date Published: Mar 24 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4355
Summary:

Alguest is a guestbook program, written in PHP and back-ended by a MySQL
database. It will run on most Unix and Linux variants, as well as
Microsoft Windows operating systems.

Alguest allows administrators to authenticate via cookie-based
authentication credentials. However, Alguest administrative cookies are
not properly checked for administrative rights (via a shared secret,
credentials such as username/password, etc.). Alguest only checks that an
administrative cookie exists. As a result, it is trivial for a remote
attacker to falsify an administrative cookie.

7. Instant Web Mail POP Command Execution Vulnerability
BugTraq ID: 4361
Remote: Yes
Date Published: Mar 23 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4361
Summary:

Instant Web Mail is a free, web based POP email client. It is implemented
in PHP, and can be expected to run under Windows, Linux and most Unix
systems.

A vulnerability has been reported in some versions of Instant Web Mail. An
attacker may create links to vulnerable scripts including arbitrary POP
commands, and send an email including these links to a user of the system.
If the link is followed, the command will be executed. This may result in
lost email or more subtle attacks.

In addition, Instant Web Mail allows the inclusion of additional POP
commands. This is possible when CR/LF characters are included in attacker
supplied data used to build the expected POP commands. This may allow the
above attack to pass undetected, as the results will not be immediately
displayed to the vulnerable user.

8. Etnus TotalView Insecure UID/GID Privilege Escalation Vulnerability
BugTraq ID: 4365
Remote: No
Date Published: Mar 26 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4365
Summary:

TotalView is a debugger for programs written in the C, C++, and Fortran.
It is maintained by Etnus and is available for a number of Linux and Unix
variants.

A flaw in the installation of TotalView may circumstantially enable a
local attacker to elevate privileges on the host running the vulnerable
software.

TotalView, when installed, fails to create a number of files and
directories with the correct UID/GID. These files/directories are created
with write permissions for UID 5039/GID 59. Normally, these files and
directories would be created with a UID/GID of root. A local attacker who
has access to an account with UID 5039 or GID 59 may be able to backdoor
the affected files, which will result in an elevation of privleges when
the affected files are executed through TotalView by the root user.

This vulnerability has been reported for version 5.0.0-4 on the Linux
platform. Other versions/platforms may also be affected.

9. PostNuke Cross Site Scripting Vulnerability
BugTraq ID: 4350
Remote: Yes
Date Published: Mar 22 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4350
Summary:

PostNuke is a content management system originally forked from the
PHP-Nuke project. It is implemented in PHP, and available for Windows,
Linux and other Unix based systems.

Cross site scripting vulnerabilites have been reported in some versions of
PostNuke. User supplied input may be inserted into the HTML produced by
both the index.php and modules.php scripts. The script will then execute
within the context of the vulnerable site.

Exploitation of this vulnerability may result in the theft of cookie data
and, with it, session authentication data. More subtle attacks such as
information subversion may also be attempted.

The reported consequences of exploitation suggest that this vulnerability
may be a result of a SQL injection problem. This has, however, not been
confirmed. Additionally, exploitation of this vulnerability may be related
to web based error reporting, as controlled by the local PHP
configuration. This is also unconfirmed at this time.

10. Apache Double-Reverse Lookup Log Entry Spoofing Vulnerability
BugTraq ID: 4358
Remote: Yes
Date Published: Mar 25 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4358
Summary:

Apache is a freely available webserver for Unix and Linux variants, as
well as Microsoft operating systems.

A vulnerability has been discovered in the way Apache logs double-reverse
DNS lookups. This may cause Apache to log invalid hostname information.

A double-reverse DNS lookup is a security measure where an IP address is
translated to a hostname and then the hostname is translated back to the
IP address.

If a double-reverse DNS lookup is performed but fails, then an invalid
hostname may appear in the logs. For example, this may occur if the
hostname does not properly resolve to the IP address in the double-reverse
DNS lookup. This problem occurs because Apache logs the (potentially
falsified) hostname instead of the numeric IP address.

A remote attacker may deliberately exploit this issue to cause spoofed
information to be logged by the webserver.

11. CSSearch Remote Command Execution Vulnerability
BugTraq ID: 4368
Remote: Yes
Date Published: Mar 26 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4368
Summary:

csSearch is a website search script, written in Perl. It will run on most
Unix and Linux variants, as well as Microsoft operating systems.

csSearch is prone to an issue which may enable an attacker to execute Perl
code with the privileges of the webserver process.

It is possible to craft a web request which is capable of passing
arbitrary data to the configuration script, including attacker-supplied
Perl code. Perl code passed in this manner will be interpreted by the
vulnerable script, effectively allowing a remote attacker to execute
arbitrary Perl code with the privileges of the webserver process.

For exploitation to be successful, the attacker must pass properly URL
encoded Perl code in CGI parameters via a web request. For example:

http://host/cgi-bin/csSearch.cgi?command=savesetup&setup=PERL_CODE_HERE

This issue may enable a remote attacker to gain local, interactive access
to the host running the vulnerable software.

12. Veridis OpenKeyServer Cross Site Scripting Vulnerability
BugTraq ID: 4369
Remote: Yes
Date Published: Mar 26 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4369
Summary:

Veridis OpenKeyServer is a public key repository for PGP based encryption.
It supports a web interface for clients and synchronization with other key
servers. It is available for Linux, FreeBSD, Solaris and Mac OS X.

A vulnerablity has been reported in the web interface used by
OpenKeyServer. Certain pages are constructed which include user supplied
data, opening a cross site scripting vulnerability. It has been
demonstrated that this can be used to insert an IFRAME object referencing
an arbitrary external site. It may also be possible to insert malicious
script code.

Cross site scripting attacks generally open the possibility to subvert the
information and interface provided by the vulnerable service. The nature
of OpenKeyServer suggests that the data provided is extremely sensitive.
Exploitation of this vulnerability may allow an attacker to attempt a
man-in-the-middle attack against encrypted communication, through
substitution of public key data.

13. Linux Kernel d_path() Path Truncation Vulnerability
BugTraq ID: 4367
Remote: No
Date Published: Mar 26 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4367
Summary:

The Linux kernel d_path() function converts a dentry structure into an
ASCII path name. The full path to the specified dentry is returned in a
fixed length buffer of size PAGE_SIZE bytes.

Reportedly, if a dentry structure is passed with a path which exceeds this
length, an erroneous value is returned. The path which is returned has
leading entries truncated, and no error is reported.

Multiple higher level functions are dependent on d_path(), including
getcwd(2) and readlink(2). As such, exploitation of this vulnerability may
have security implications in programs that use these functions. Under
some circumstances, a privileged process may perform operations within an
inappropriate directory, possibly on incorrect files. This may result in
security checks specific to an application failing.

14. Webmin Plaintext Authentication Credentials Disclosure Vulnerability
BugTraq ID: 4351
Remote: No
Date Published: Mar 22 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4351
Summary:

Webmin is a web-based interface for system administration of Unix and
Linux operating systems.

A vulnerability has been discovered that may potentially cause
authentication credentials for remote Webmin servers to be disclosed to a
local attacker.

It has been reported that authentication credentials for remote servers
are stored in plaintext by Webmin. These credentials are stored in the
'/etc/webmin/servers/' directory. The filename associated with each host
is derived from the system time at the point when the host was first
discovered by the local Webmin server. Though the directory is
unreadable, the execute bit enabled. The consistent naming based on system
time allows for an attacker to search for existing files.

A clever attacker may exploit this to disclose authentication credentials
for remote hosts on the network which are running Webmin.

15. ht://Dig Configuration File Path Disclosure Vulnerability
BugTraq ID: 4366
Remote: Yes
Date Published: Mar 26 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4366
Summary:

ht://Dig is a freely available, open source search engine. It is
developed and maintained by the ht://Dig project, and functions on the
Unix and Linux operating systems.

A problem with ht://Dig could make it possible for a local user to gain
access to potentially sensitive information. The problem is in the
generation of error messages.

An error page will be returned when a request is made via the htsearch
component and the value for the 'config' variable is erroneous or
non-sensical. The error page will contain the full path of the
configuration file directory for ht://Dig. Additionally, the 'config'
variable being accessible by any user may allow the ht://Dig program to
load arbitrary files as configuration.

The problem makes it possible for a remote user to gain knowledge of the
directory structure and ht://Dig configuration file directory. It may
additionally result in the loading of arbitrary ht://Dig configuration
files.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. SecurID and FreeS/WAN GW (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

IV.NEW PRODUCTS FOR LINUX PLATFORMS
-----------------------------------
1. SecureNet PRO
by Intrusion.com
Platforms: Linux, Solaris, FreeBSD, BSDI
Relevant URL:
http://www.mimestar.com/products/
Summary:

SecureNet PRO is a complete network security system, monitoring your
network 24 hours a day, 7 days a week. It is the only system available
that combines several key technologies, including session monitoring,
firewalling, hijacking, and keyword-based intrusion detection.

2. Dragon Monitoring System
by Enterasys Networks
Platforms: Linux, Solaris, FreeBSD, OpenBSD
Relevant URL:
http://www.enterasys.com/ids/monitoring_system.pdf
Summary:

Dragon is a high speed IDS that can detect a wide variety of suspicious
network activities such as probes, attacks, compromised systems, network
misuse and even system vulnerabilities.

3. CaptIO
by Captus Networks Corp.
Platforms: Linux
Relevant URL:
http://www.captusnetworks.com/captio.htm
Summary:

The CaptIO combines the functions of: -a firewall to manage access to
resources -an Intrusion Detection System to prevent attempts to intrude on
or shut down your systems -a high performance switch router network load
balancing to even out traffic across a network Protection from security
attacks originating from: -outside the network -inside the network where
most security breaches occur An adaptive firewall that: -works with the
dynamic Intrusion Detection System to continuously update against new
attacks in near real-time

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Sentry Firewall CD-ROM v1.2.0
by Obsid
Relevant URL:
http://www.SentryFirewall.com/
Platforms: Linux
Summary:

Sentry Firewall CD-ROM Version 1.0 is a Linux based bootable CD-ROM
suitable for use as an inexpensive and easy to maintain Firewall or
IDS(Intrusion Detection System) Node. The system is designed to be
immediately configurable for a variety of different operating environments
via a configuration file located on a floppy disk or a local hard drive.

2. Astaro Security Linux (Sun Cobalt) v2.023
by astaro
Relevant URL:
http://www.astaro.com/products/index.html
Platforms: Linux, POSIX
Summary:

Astaro Security Linux is a firewall solution. It does stateful packet
inspection filtering, content filtering, user authentication, virus
scanning, VPN with IPSec and PPTP, and much more. With its Web-based
management tool, WebAdmin, and the ability to pull updates via the
Internet, it is pretty easy to manage. It is based on a special hardened
Linux 2.4 distribution where most daemons are running in change-roots and
are protected by kernel capabilities.

3. Syslog2 v1.0.2
by Alex S. Yemelyanov [email protected]
Relevant URL:
http://freshmeat.net/projects/syslog2/
Platforms: Linux
Summary:

Syslog2 is a realtime parser and event handler for syslogd. An event is a
message from some service. It uses a simple plugin system to add event
handlers. Syslog2 is written in Perl. A plugin is simply a Perl script
which invokes the "register_handler" or "unregister_handler" subroutines.
By default, the package uses the included script "default.pl", which logs
all messages from the syslog daemon in sorted order. More scripts are
available from the homepage.

4. DataSAFE Command Line Encryption LINUX
by Regnoc Software Inc, [email protected]
Relevant URL:
http://www.regnoc.com/dscmd.htm
Platforms: Linux
Summary:

DSCMD is a free utility program intended for use by LAN and Internet
server administrators. DSCMD allows you to encrypt source files for secure
transmission via Internet downloads, direct FTP, and e-mail attachments.
Only someone who knows the eight-character locking combination can recover
the contents of the encrypted file. DSCMD is completely command-line
driven, and simple to integrate into your web server's scripts on both
Windows NT and Linux servers.

VI. SPONSORSHIP INFORMATION
---------------------------
This Issue Sponsored by: Alcatel

Did your IPSec run over your VPN? Tech buzz words got you spinning? We can
help.

Please visit us at:

http://alcatel.emark1.com/irc_intro.asp?form=irc_linux_4-1-02
-------------------------------------------------------------------------------