SecurityFocus Linux Newsletter #322

SecurityFocus Linux Newsletter #322
----------------------------------------

This Issue is Sponsored by: Black Hat

Black Hat Europe, March 27-30 in Amsterdam, is Europe's premier technical=
 event for ICT security experts.=20
Featuring 10 hands-on training courses and 30 Briefings presentations wit=
h lots of new content-the best of Black Hat focused on Europe's infosec c=
hallenges. Network with 400 delegates from 25 nations, and see solutions =
from major sponsors. =20

http://www.blackhat.com

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Testing Fault Injection in Local Applications
II.  LINUX VULNERABILITY SUMMARY
       1. SMF Index.PHP HTML Injection Vulnerability
       2. FishCart Olst Parameter SQL Injection Vulnerability
       3. Linux Kernel AIO_Setup_Ring Local Denial of Service Vulnerabili=
ty
       4. OpenLDAP Gentoo GenCert.SH Script Insecure Temporary File Creat=
ion Vulnerability
       5. Computer Associates BrightStor ARCServe BackUp Multiple Remote =
Buffer Overflow Vulnerabilities
       6. Squid Proxy ACL Queue Overload Remote Denial of Service Vulnera=
bility
       7. Linux-PAM Pam_Unix.SO Authentication Bypass Vulnerability
       8. GTK2 GDKPixBufLoader Remote Denial of Service Vulnerability
       9. ISC BIND Remote Fetch Context Denial of Service Vulnerability
       10. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerabil=
ity
       11. Trend Micro InterScan VirusWall VSAPI Module Buffer Overflow V=
ulnerability
       12. Xine M3U Remote Format String Vulnerability
       13. MPG123 HTTP_Open() Connection Handling Denial of Service Vulne=
rability
       14. GD Graphics Library JIS-Encoded Font Buffer Overflow Vulnerabi=
lity
       15. NoMachine NX Server NXCONFIGURE.SH Remote Denial Of Service Vu=
lnerability
       16. Linux Kernel ListXATTR Local Denial of Service Vulnerability
       17. Linux Kernel Dev_Queue_XMIT Local Denial of Service Vulnerabil=
ity
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Testing Fault Injection in Local Applications
By Chris Wysopal
This article is a book excerpt that looks at the approach and techniques =
used to test the security of local applications. It describes local resou=
rces and interprocess communication, how to enumerate the local resources=
 an application depends on, and then discusses methods of testing several=
 of those types of resources. It also describes how to test ActiveX objec=
ts, command-line programs, and applications' use of local files and share=
d memory.
http://www.securityfocus.com/infocus/1886


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. SMF Index.PHP HTML Injection Vulnerability
BugTraq ID: 22143
Remote: Yes
Date Published: 2007-01-20
Relevant URL: http://www.securityfocus.com/bid/22143
Summary:
SMF is prone to an HTML-injection vulnerability because it fails to prope=
rly sanitize user-supplied input before using it in dynamically generated=
 content.=20

Attacker-supplied HTML and script code would execute in the context of th=
e affected website, potentially allowing an attacker to steal cookie-base=
d authentication credentials or to control how the site is rendered to th=
e user; other attacks are also possible.

NOTE: To trigger this vulnerability, the attacker must log in with a vali=
d account.

2. FishCart Olst Parameter SQL Injection Vulnerability
BugTraq ID: 22166
Remote: Yes
Date Published: 2007-01-22
Relevant URL: http://www.securityfocus.com/bid/22166
Summary:
FishCart is prone to an SQL-injection vulnerability because the applicati=
on fails to properly sanitize user-supplied input before using it in an S=
QL query.=20

A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase implementation.

3. Linux Kernel AIO_Setup_Ring Local Denial of Service Vulnerability
BugTraq ID: 22193
Remote: No
Date Published: 2007-01-23
Relevant URL: http://www.securityfocus.com/bid/22193
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability beca=
use the kernel fails to properly initialize a variable.

Exploiting this issue allows local attackers to cause kernel crashes, den=
ying service to legitimate users.

4. OpenLDAP Gentoo GenCert.SH Script Insecure Temporary File Creation Vul=
nerability
BugTraq ID: 22195
Remote: No
Date Published: 2007-01-23
Relevant URL: http://www.securityfocus.com/bid/22195
Summary:
OpenLDAP is creates temporary files in an insecure way.=20

An attacker with local access could potentially exploit this issue to per=
form symbolic-link attacks, overwriting arbitrary files in the context of=
 the affected application.=20

Successfully exploiting a symlink attack may allow an attacker to overwri=
te or corrupt sensitive files. This may result in a denial of service; ot=
her attacks may also be possible.

This issue affects Gentoo ebuild for OpenLDAP.

5. Computer Associates BrightStor ARCServe BackUp Multiple Remote Buffer =
Overflow Vulnerabilities
BugTraq ID: 22199
Remote: Yes
Date Published: 2007-01-23
Relevant URL: http://www.securityfocus.com/bid/22199
Summary:
Computer Associates BrightStor ARCServe BackUp is prone to multiple unspe=
cified buffer-overflow vulnerabilities.

The vendor has reported that these vulnerabilities allow remote attackers=
 to execute arbitrary code with SYSTEM privileges facilitating a full com=
promise. Unsuccessful attacks may cause denial-of-service conditions as w=
ell.

These issues affect BrightStor ARCserve Backup for laptops and desktops r=
unning Microsoft Windows.

6. Squid Proxy ACL Queue Overload Remote Denial of Service Vulnerability
BugTraq ID: 22203
Remote: Yes
Date Published: 2007-01-24
Relevant URL: http://www.securityfocus.com/bid/22203
Summary:
Squid is prone to a remote denial-of-service vulnerability because the pr=
oxy server fails to handle excessive data.

Successfully exploiting this issue allows remote attackers to crash affec=
ted proxy applications, denying further service to legitimate users.

7. Linux-PAM Pam_Unix.SO Authentication Bypass Vulnerability
BugTraq ID: 22204
Remote: Yes
Date Published: 2007-01-24
Relevant URL: http://www.securityfocus.com/bid/22204
Summary:
Linux-PAM is prone to an authentication-bypass vulnerability because it f=
ails to effectively verify user passwords during the authentication proce=
ss.

Exploiting this issue could allow an attacker to gain unauthorized access=
 to an affected computer.

Version 0.99.7.0 is vulnerable.

8. GTK2 GDKPixBufLoader Remote Denial of Service Vulnerability
BugTraq ID: 22209
Remote: Yes
Date Published: 2007-01-24
Relevant URL: http://www.securityfocus.com/bid/22209
Summary:
Applications using the gtk2 library may be prone to a denial-of-service v=
ulnerability because the library fails to handle malformed image data.

An attacker can exploit this issue to crash applications on a victim's co=
mputer.

9. ISC BIND Remote Fetch Context Denial of Service Vulnerability
BugTraq ID: 22229
Remote: Yes
Date Published: 2007-01-25
Relevant URL: http://www.securityfocus.com/bid/22229
Summary:
ISC BIND is prone to a remote denial-of-service vulnerability because the=
 application fails to properly handle unexpected DNS requests.

Successfully exploiting this issue allows remote attackers to crash affec=
ted DNS servers, denying further service to legitimate users.

10. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerability
BugTraq ID: 22231
Remote: Yes
Date Published: 2007-01-25
Relevant URL: http://www.securityfocus.com/bid/22231
Summary:
ISC BIND is prone to a remote denial-of-service vulnerability because the=
 application fails to properly handle malformed DNSSEC validation request=
s.

Successfully exploiting this issue allows remote attackers to crash affec=
ted DNS servers, denying further service to legitimate users.

11. Trend Micro InterScan VirusWall VSAPI Module Buffer Overflow Vulnerab=
ility
BugTraq ID: 22240
Remote: No
Date Published: 2007-01-25
Relevant URL: http://www.securityfocus.com/bid/22240
Summary:
Trend Micro InterScan VirusWall is prone to a buffer-overflow vulnerabili=
ty because the application fails to check the size of data before copying=
 it into a finite-sized internal memory buffer.

An attacker can exploit this issue to execute arbitrary code with superus=
er privileges. This may facilitate the complete compromise of affected co=
mputers.

This issue affects version 3.81; other versions may also be vulnerable.

12. Xine M3U Remote Format String Vulnerability
BugTraq ID: 22252
Remote: Yes
Date Published: 2007-01-26
Relevant URL: http://www.securityfocus.com/bid/22252
Summary:
The 'xine' program is prone to a remote format-string vulnerability becau=
se the application fails to properly sanitize user-supplied input before =
including it in the format-specifier argument of a formatted-printing fun=
ction.

Successfully exploiting this issue allows remote attackers to execute arb=
itrary machine code in the context of the application and to compromise a=
ffected computers.

This issue may be related to the vulnerability discussed in BID 21852 (Vi=
deoLan VLC Media Player Remote Format String Vulnerability); this has not=
 been confirmed.

13. MPG123 HTTP_Open() Connection Handling Denial of Service Vulnerabilit=
y
BugTraq ID: 22274
Remote: Yes
Date Published: 2007-01-27
Relevant URL: http://www.securityfocus.com/bid/22274
Summary:
The 'mpg123' media player is prone to a denial-of-service vulnerability w=
hen connecting to malicious servers.

An attacker can exploit this issue to cause the affected application to c=
rash, effectively denying service to legitimate users.

14. GD Graphics Library JIS-Encoded Font Buffer Overflow Vulnerability
BugTraq ID: 22289
Remote: Yes
Date Published: 2007-01-29
Relevant URL: http://www.securityfocus.com/bid/22289
Summary:
The GD graphics library is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to cause denial-of-service conditions =
in applications implementing the affected library. Arbitrary code executi=
on may also be possible; this has not been confirmed.

15. NoMachine NX Server NXCONFIGURE.SH Remote Denial Of Service Vulnerabi=
lity
BugTraq ID: 22308
Remote: Yes
Date Published: 2007-01-30
Relevant URL: http://www.securityfocus.com/bid/22308
Summary:
NX Server is prone to a denial-of-service vulnerability.
=20
An attacker can exploit this issue to crash the server, effectively denyi=
ng service to legitimate users.
=20
NX Server versions prior to 2.1.0-18 are vulnerable.

16. Linux Kernel ListXATTR Local Denial of Service Vulnerability
BugTraq ID: 22316
Remote: No
Date Published: 2007-01-30
Relevant URL: http://www.securityfocus.com/bid/22316
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability.

Successful exploits will result in denial-of-service conditions or potent=
ially privilege escalation.

17. Linux Kernel Dev_Queue_XMIT Local Denial of Service Vulnerability
BugTraq ID: 22317
Remote: No
Date Published: 2007-01-30
Relevant URL: http://www.securityfocus.com/bid/22317
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability.

A local attacker can exploit this issue to corrupt data and cause the ker=
nel to become unresponsive, denying further service to  legitimate users.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securi=
tyfocus.com from the subscribed address. The contents of the subject or m=
essage body do not matter. You will receive a confirmation request messag=
e to which you will have to answer. Alternatively you can also visit http=
://www.securityfocus.com/newsletters and unsubscribe via the website.=20

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: Black Hat

Black Hat Europe, March 27-30 in Amsterdam, is Europe's premier technical=
 event for ICT security experts.=20
Featuring 10 hands-on training courses and 30 Briefings presentations wit=
h lots of new content-the best of Black Hat focused on Europe's infosec c=
hallenges. Network with 400 delegates from 25 nations, and see solutions =
from major sponsors. =20

http://www.blackhat.com