SecurityFocus Linux Newsletter #321

SecurityFocus Linux Newsletter #321
----------------------------------------

This Issue is Sponsored by: SPI Dynamics

ALERT: Learn to Think Like a Hacker- Simulate a Hacker Breaking into Your=
 Web Apps=20
The speed with which Web Applications are developed make them prime targe=
ts for attackers, often these applications were developed so quickly that=
 they are not coded properly or subjected to any security testing. Hacker=
s know this and use it as their weapon. Download this *FREE* test guide f=
rom SPI Dynamics to check for Web application vulnerabilities.=20

https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=3D70160000000Cg=
th

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. iPhone Trademarks: the Real Issues
       2. Testing Fault Injection in Local Applications
II.  LINUX VULNERABILITY SUMMARY
       1. Libgtop2 Library Local Buffer Overflow Vulnerability
       2. FileZilla Multiple Remote Format String Vulnerabilities
       3. BlueZ HIDD Bluetooh HID Command Injection Vulnerability
       4. Squid Proxy FTP URI Remote Denial of Service Vulnerability
       5. MBSE-BBS MBSE_Root Multiple Local Privilege Escalation Vulnerab=
ilites
       6. GNU Ed Insecure Temporary File Creation Vulnerability
       7. Ulogd Unspecified Buffer Overflow Vulnerability
       8. SMF Index.PHP HTML Injection Vulnerability
       9. Wzdftpd Multiple Unspecified Remote Denial of Service Vulnerabi=
lities
       10. FishCart Olst Parameter SQL Injection Vulnerability
       11. Linux Kernel AIO_Setup_Ring Local Denial of Service Vulnerabil=
ity
       12. OpenLDAP Gentoo GenCert.SH Script Insecure Temporary File Crea=
tion Vulnerability
       13. Computer Associates BrightStor ARCServe BackUp Multiple Remote=
 Buffer Overflow Vulnerabilities
       14. Squid Proxy ACL Queue Overload Remote Denial of Service Vulner=
ability
       15. Linux-PAM Pam_Unix.SO Authentication Bypass Vulnerability
       16. GTK2 GDKPixBufLoader Remote Denial of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. iPhone Trademarks: the Real Issues
By Mark Rasch
Apple's iPhone announcement and Cisco's iPhone trademark lawsuit has brou=
ght the iPhone moniker into the spotlight. But other companies also own a=
nd use iPhone trademarks, and market and sell their iPhone products. Mark=
 Rasch explains how U.S. trademark law works and the real issues at play =
in this highly publicized trademark dispute.
http://www.securityfocus.com/columnists/430

2. Testing Fault Injection in Local Applications
By Chris Wysopal
This article is a book excerpt that looks at the approach and techniques =
used to test the security of local applications. It describes local resou=
rces and interprocess communication, how to enumerate the local resources=
 an application depends on, and then discusses methods of testing several=
 of those types of resources. It also describes how to test ActiveX objec=
ts, command-line programs, and applications' use of local files and share=
d memory.
http://www.securityfocus.com/infocus/1886


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Libgtop2 Library Local Buffer Overflow Vulnerability
BugTraq ID: 22054
Remote: No
Date Published: 2007-01-15
Relevant URL: http://www.securityfocus.com/bid/22054
Summary:
Libgtop2 library is prone to a local buffer-overflow vulnerability becaus=
e it fails to properly bounds-check user-supplied input before copying in=
to an insufficiently sized memory buffer.

An attacker may exploit this issue by enticing victims into viewing a mal=
iciously crafted system process with an application that uses the affecte=
d library.

Successful exploits may cause arbitrary code to run with the privileges o=
f the victim. Failed exploit attempts will likely cause denial-of-service=
 conditions.

Versions prior to 2.14.6 are reported vulnerable.

2. FileZilla Multiple Remote Format String Vulnerabilities
BugTraq ID: 22063
Remote: Yes
Date Published: 2007-01-15
Relevant URL: http://www.securityfocus.com/bid/22063
Summary:
FileZilla is prone to multiple remote format-string vulnerabilities becau=
se the application fails to properly sanitize user-supplied input before =
using it in the format-specifier argument to a formatted-printing functio=
n.

Exploiting these issues allows remote attackers to execute arbitrary mach=
ine code in the context of the affected application. Failed exploit attem=
pts will likely crash the application.

FileZilla 3 versions prior to beta 5 are vulnerable to these issues.

3. BlueZ HIDD Bluetooh HID Command Injection Vulnerability
BugTraq ID: 22076
Remote: Yes
Date Published: 2007-01-16
Relevant URL: http://www.securityfocus.com/bid/22076
Summary:
BlueZ hidd is prone to a device-command-injection vulnerability.

A remote attacker can exploit this issue to gain control of mouse and key=
board HIDs (human interface device). This will allow the attacker to inte=
ract with the targeted computer in the context of the currently logged-in=
 user.

Versions prior to 2.25 are vulnerable.

4. Squid Proxy FTP URI Remote Denial of Service Vulnerability
BugTraq ID: 22079
Remote: Yes
Date Published: 2007-01-16
Relevant URL: http://www.securityfocus.com/bid/22079
Summary:
Squid is prone to a remote denial-of-service vulnerability because the pr=
oxy server fails to handle certain FTP requests.

Successfully exploiting this issue allows remote attackers to crash affec=
ted proxy applications, denying futher service to legitimate users.

Squid versions from 2.5.STABLE11 to 2.6.STABLE6 are vulnerable to this is=
sue.

5. MBSE-BBS MBSE_Root Multiple Local Privilege Escalation Vulnerabilites
BugTraq ID: 22112
Remote: No
Date Published: 2007-01-18
Relevant URL: http://www.securityfocus.com/bid/22112
Summary:
The 'mbse-bbs' application is prone to a local privilege-escalation vulne=
rability because it fails to bounds-check user-supplied data before copyi=
ng it into an insufficiently sized buffer.=20

An attacker can exploit these issues to execute arbitrary code with super=
user privileges, completely compromising affected computers. Failed explo=
it attempts will result in a denial of service.

These issues affect 'mbse-bbs' 0.70.0 and prior versions.

6. GNU Ed Insecure Temporary File Creation Vulnerability
BugTraq ID: 22129
Remote: No
Date Published: 2007-01-19
Relevant URL: http://www.securityfocus.com/bid/22129
Summary:
GNU ed creates temporary files in an insecure way.=20

An attacker with local access could potentially exploit this issue to per=
form symlink attacks, overwriting arbitrary files in the context of the a=
ffected application.=20

Successfully exploiting a symlink attack may allow an attacker to overwri=
te or corrupt sensitive files. This may result in a denial of service; ot=
her attacks may also be possible.

GNU ed 0.3 and prior versions are vulnerable to this issue.

7. Ulogd Unspecified Buffer Overflow Vulnerability
BugTraq ID: 22139
Remote: No
Date Published: 2007-01-19
Relevant URL: http://www.securityfocus.com/bid/22139
Summary:
Ulogd is prone to a buffer-overflow vulnerability because it fails to pro=
perly bounds-check user-supplied data before copying it into an insuffici=
ently sized memory buffer.=20

Exploiting this issue allows attackers to execute arbitrary machine code =
in the context of the affected daemon. Failed attempts will likely result=
 in denial-of-service conditions.

8. SMF Index.PHP HTML Injection Vulnerability
BugTraq ID: 22143
Remote: Yes
Date Published: 2007-01-20
Relevant URL: http://www.securityfocus.com/bid/22143
Summary:
SMF is prone to an HTML-injection vulnerability because it fails to prope=
rly sanitize user-supplied input before using it in dynamically generated=
 content.=20

Attacker-supplied HTML and script code would execute in the context of th=
e affected website, potentially allowing an attacker to steal cookie-base=
d authentication credentials or to control how the site is rendered to th=
e user; other attacks are also possible.

NOTE: To trigger this vulnerability, the attacker must log in with a vali=
d account.

SMF version 1.1 RC3 is vulnerable to this issue.

9. Wzdftpd Multiple Unspecified Remote Denial of Service Vulnerabilities
BugTraq ID: 22152
Remote: Yes
Date Published: 2007-01-19
Relevant URL: http://www.securityfocus.com/bid/22152
Summary:
The 'wzdftpd' program is prone to multiple remote denial-of-service vulne=
rabilities.
=20
Exploiting these issues allows remote attackers to crash the application,=
 denying further service to legitimate users.=20

These issues reportedly affect versions prior to 0.8.1.

10. FishCart Olst Parameter SQL Injection Vulnerability
BugTraq ID: 22166
Remote: Yes
Date Published: 2007-01-22
Relevant URL: http://www.securityfocus.com/bid/22166
Summary:
FishCart is prone to an SQL-injection vulnerability because the applicati=
on fails to properly sanitize user-supplied input before using it in an S=
QL query.=20

A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase implementation.

11. Linux Kernel AIO_Setup_Ring Local Denial of Service Vulnerability
BugTraq ID: 22193
Remote: No
Date Published: 2007-01-23
Relevant URL: http://www.securityfocus.com/bid/22193
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability beca=
use the kernel fails to properly initialize a variable.

Exploiting this issue allows local attackers to cause kernel crashes, den=
ying service to legitimate users.

12. OpenLDAP Gentoo GenCert.SH Script Insecure Temporary File Creation Vu=
lnerability
BugTraq ID: 22195
Remote: No
Date Published: 2007-01-23
Relevant URL: http://www.securityfocus.com/bid/22195
Summary:
OpenLDAP is creates temporary files in an insecure way.=20

An attacker with local access could potentially exploit this issue to per=
form symbolic-link attacks, overwriting arbitrary files in the context of=
 the affected application.=20

Successfully exploiting a symlink attack may allow an attacker to overwri=
te or corrupt sensitive files. This may result in a denial of service; ot=
her attacks may also be possible.

This issue affects Gentoo ebuild for OpenLDAP.

13. Computer Associates BrightStor ARCServe BackUp Multiple Remote Buffer=
 Overflow Vulnerabilities
BugTraq ID: 22199
Remote: Yes
Date Published: 2007-01-23
Relevant URL: http://www.securityfocus.com/bid/22199
Summary:
Computer Associates BrightStor ARCServe BackUp is prone to multiple unspe=
cified buffer-overflow vulnerabilities.

The vendor has reported that these vulnerabilities allow remote attackers=
 to execute arbitrary code with SYSTEM privileges facilitating a full com=
promise. Unsuccessful attacks may cause denial-of-service conditions as w=
ell.

These issues affect BrightStor ARCserve Backup for laptops and desktops r=
unning Microsoft Windows.

14. Squid Proxy ACL Queue Overload Remote Denial of Service Vulnerability
BugTraq ID: 22203
Remote: Yes
Date Published: 2007-01-24
Relevant URL: http://www.securityfocus.com/bid/22203
Summary:
Squid is prone to a remote denial-of-service vulnerability because the pr=
oxy server fails to handle excessive data.

Successfully exploiting this issue allows remote attackers to crash affec=
ted proxy applications, denying further service to legitimate users.

15. Linux-PAM Pam_Unix.SO Authentication Bypass Vulnerability
BugTraq ID: 22204
Remote: Yes
Date Published: 2007-01-24
Relevant URL: http://www.securityfocus.com/bid/22204
Summary:
Linux-PAM is prone to an authentication-bypass vulnerability because it f=
ails to effectively verify user passwords during the authentication proce=
ss.

Exploiting this issue could allow an attacker to gain unauthorized access=
 to an affected computer.

Version 0.99.7.0 is vulnerable.

16. GTK2 GDKPixBufLoader Remote Denial of Service Vulnerability
BugTraq ID: 22209
Remote: Yes
Date Published: 2007-01-24
Relevant URL: http://www.securityfocus.com/bid/22209
Summary:
Applications using the gtk2 library may be prone to a denial-of-service v=
ulnerability because the library fails to handle malformed image data.

An attacker can exploit this issue to crash applications on a victim's co=
mputer.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securi=
tyfocus.com from the subscribed address. The contents of the subject or m=
essage body do not matter. You will receive a confirmation request messag=
e to which you will have to answer. Alternatively you can also visit http=
://www.securityfocus.com/newsletters and unsubscribe via the website.=20

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: SPI Dynamics

ALERT: Learn to Think Like a Hacker- Simulate a Hacker Breaking into Your=
 Web Apps=20
The speed with which Web Applications are developed make them prime targe=
ts for attackers, often these applications were developed so quickly that=
 they are not coded properly or subjected to any security testing. Hacker=
s know this and use it as their weapon. Download this *FREE* test guide f=
rom SPI Dynamics to check for Web application vulnerabilities.=20

https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=3D70160000000Cg=
th