SecurityFocus Linux Newsletter #93

SecurityFocus Linux Newsletter #93
----------------------------------

This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!
http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml
-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Malware Infection Vectors: Past, Present, and Future
     2. Time for Open-Source to Grow Up
     3. Post to Bugtraq -- Go to Jail
     4. InfowarCon 2000
     5. SecurityFocus DPP Program
II. LINUX VULNERABILITY SUMMARY
     1. Gaim Jabber Plug-In Buffer Overflow Vulnerability
     2. Nullsoft SHOUTCast Insecure Permissions Information Disclosure..
     3. Ensim Webppliance Unauthorized Email Access Vulnerability
     4. iSCSI Insecure Configuration File Permissions Information...
     5. Macromedia Flash Malformed Header Buffer Overflow Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. LDAP Auth? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. DbEncrypt for Oracle
     2. iBroker SecureWeb Application Firewall
     3. CryptaCom
V. NEW TOOLS FOR LINUX PLATFORMS
     1. single-honeypot v0.1
     2. nefu v0.7.0
     3. Wireless Tools/Howto v24
VI. SPONSORSHIP INFORMATION




I. FRONT AND CENTER
-------------------
1. Malware Infection Vectors: Past, Present, and Future
By Paul Schmehl

The vectors that malicious software use to invade systems are constantly
evolving: adapting to new technologies, changing to avoid defense
mechanisms and adding on to attack new weaknesses. This article will look
at what infection vectors have been historically effective, how they've
changed over time and what they probably will do in the future.

http://online.securityfocus.com/infocus/1615

2. Time for Open-Source to Grow Up
By Jon Lasser

The OpenSSH backdoor demonstrates that the community must get pragmatic
about package verification, and fast.

http://online.securityfocus.com/columnists/101

3. Post to Bugtraq -- Go to Jail
By Mark Rasch

Imagine discovering a flaw in an operating system that would permit you to
obtain root privileges. Imagine then posting information about this
vulnerability to a message board dedicated to information security, along
with a link to an exploit that could be assembled to take advantage of the
vulnerability. Does the vendor of the OS congratulate you?

http://online.securityfocus.com/columnists/100

4. InforwarCon 2002

InforwarCon 2002: Homeland Defense and Cyber-Terrorism, Washington, DC
September 4-5, 2002, optional workshops September 3 & 6. Presented by MIS
Training Institute and Interpact, Inc. Proven strategies for protecting
against threats to critical infrastructures and government systems.

Go to: http://www.misti.com/08/iw02nl26inf.html

5. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml


II. BUGTRAQ SUMMARY
-------------------
1. Gaim Jabber Plug-In Buffer Overflow Vulnerability
BugTraq ID: 5406
Remote: Yes
Date Published: Aug 06 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5406
Summary:

Gaim is an instant messaging client that supports numerous protocols.  It
is available for Unix and Linux variants.

The Gaim client Jabber messaging plug-in is prone to a buffer overflow
condition.  The exact details of this issue are not currently known.
However, it is possible that an attacker may leverage this condition to
cause memory to be corrupted with attacker-supplied values, resulting in
execution of arbitrary code as the user running the vulnerable client.

2. Nullsoft SHOUTCast Insecure Permissions Information Disclosure Vulnerability
BugTraq ID: 5414
Remote: No
Date Published: Aug 06 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5414
Summary:

Nullsoft SHOUTCast Server is used to broadcast Shoutcast music.  It is
available for Unix and Linux operating systems, as well as Microsoft
Windows.

Nullsoft SHOUTCast may, under some circumstances, leave administrative
credentials stored in a world-readable logfile.

When failed authentication requests (specifically a GET / request) are
made to the SHOUTCast server via TCP port 8001, the real authentication
credentials will be logged to a SHOUTCast server logfile (sc_serv.log),
which is located in the SHOUTCast directory.  Local attackers may
trivially gain access to these credentials since the logfile by default
has world-readable permissions.

This issue was reported for versions of the software running and Unix and
Linux platforms.  Other versions may also be affected.

3. Ensim Webppliance Unauthorized Email Access Vulnerability
BugTraq ID: 5418
Remote: Yes
Date Published: Aug 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5418
Summary:

Webppliance is a webhosting solution provided by Ensim. It is developed
for use with Linux and Unix variant as well as Microsoft Windows operating
environments.

A vulnerability has been reported for Ensim Webppliance. Reportedly, it is
possible for malicious users of Webppliance to receive other users'
emails.

The vulnerability is the result of Webppliance incorrectly processing an
existing user's email alias. Reportedly, users that are allocated email
and user accounts can intercept another user's email.

An attacker can exploit this vulnerability by selecting to add a valid
email account as an alias. Once this alias has been established, any
emails that arrive for the victim user will be intercepted by the attacker
and arrive in the attacker's inbox.

This vulnerability was reported for Ensim Webppliance 3.0 and 3.1. It is
not known whether other versions are affected.

4. iSCSI Insecure Configuration File Permissions Information Disclosure Vulnerability
BugTraq ID: 5423
Remote: No
Date Published: Aug 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5423
Summary:

The iSCSI (Internet Small Computer System Interface) protocol is an
Internet Protocol (IP) based storage networking standard for linking data
storage facilities.

iSCSI leaves administrative credentials stored in a world-readable
configuration file.

The configuration file that iSCSI uses is stored in /etc/iscsi.conf.
Reportedly, this file is installed, by default, with world readable and
possibly world writeable permissions enabled. This may have some
potentially serious consequences as the configuration file also stores
password information in plain text.

Reportedly, RedHat Linux Limbo Beta and SuSE ship with iSCSI. SuSE has
reported that proper permissions are enabled for iSCSI. RedHat has
confirmed that Limbo Beta ships with improper file permissions enabled and
will reportedly fix it in the next release of Limbo.

5. Macromedia Flash Malformed Header Buffer Overflow Vulnerability
BugTraq ID: 5430
Remote: Yes
Date Published: Aug 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5430
Summary:

Macromedia Flash is a modular package designed to enhance web browsing and
enables users to view various multimedia web content.

Macromedia Flash is prone to a buffer overflow condition.  This is due to
insufficient bounds checking of headers in Flash Shockwave movie files
(.SWF).  It is reportedly possible to exploit this issue by hand-editing
header information in a movie file with a hex editor.  When the movie with
the malformed header is processed by Flash, the condition will occur,
resulting in corruption of memory.  In particular, it is frame data in the
header which must be malformed for memory corruption to occur.  An
attacker may exploit this to overwrite function pointers with
attacker-supplied values.

Successful exploitation will allow an attacker to execute arbitrary code
on a client system running Macromedia Flash.  An attacker would have to
entice a user of the vulnerable software to load the malformed movie file.
This might be accomplished via a malicious webpage, e-mail, newsgroups or
any other means by which the malicious movie file may be transmitted to a
user.  Code execution will occur with the privileges of the user running
the player.

The Macromedia Flash plug-in is included in a number of web browsers.
This issue is known to affect Macromedia Flash on all platforms.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. LDAP Auth? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/286526


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. DbEncrypt for Oracle
by Application Security, Inc. (ASI)
Platforms: HP-UX, Linux, Solaris, SunOS, Windows 2000, Windows NT, Windows
XP
Relevant URL:
http://www.appsecinc.com/products/dbencrypt/oracle/
Summary:

DbEncrypt for Oracle is a flexible solution providing a means of
encrypting rows and columns in a database. DbEncrypt for Oracle provides
you a complete database encryption solution including a variety of strong
encryption algorithms to pick from, templates to build your own encryption
procedures from, as well as a point-and-click user interface for
installing and managing the encryption, all at an affordable price.
DbEncrypt for Oracle provides protection for your most valuable assets -
the information in your database.

2. iBroker SecureWeb Application Firewall
by Multinet, Inc.
Platforms: Linux, UNIX, Windows 2000, Windows NT
Relevant URL:
http://elitesecureweb.com/dta/products/solutions.html
Summary:

iBroker SecureWeb allows you to protect Web applications from all known
and unknown attacks. iBroker SecureWeb wraps around IIS and Apache Web
servers and works as plug-in within it, verifying and analyzing incoming
and outgoing Web server data for any possible security breaches. It
creates an application firewall, which overcomes limitations of Intrusion
Detection Systems and Conventional Network Firewalls. iBroker SecureWeb is
the most powerful proactive HTTP application firewall.

3. CryptaCom
by Motus Technologies
Platforms: Solaris, Windows 2000, Windows 95/98, Windows NT
Relebvant URL:
http://www.motus.com/produits/_cryptacom.html
Summary:

CryptaCom lets you secure communications circulating within a network from
A to Z. The network administrator can choose the components to be secured,
install the program, establish and apply the security policies himself
according to the security levels required by the organization and this,
without causing the network users any trouble. CryptaCom... - Verifies the
integrity of all incoming communications; - Authenticates the sender and
receiver of messages; - Encrypts the communications sent and decrypts it
when received so that only the addressee can read it .


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. single-honeypot v0.1
by Luis Wong [email protected]
Relevant URL:
http://sourceforge.net/projects/single-honeypot/
Platforms: POSIX
Summary:

single-honeypot simulates many services like SMTP, HTTP, shell, and FTP.
It can show many different faces, including those of Windows FTP systems,
Windows SMTP systems, different Linux distributions, and some Posix
distributions.

2. nefu v0.7.0
by Ed Colone
Relevant URL:
http://rsug.itd.umich.edu/software/nefu/
Platforms: FreeBSD, Linux, MacOS, OpenBSD, Solaris, SunOS, UNI
Summary:

nefu (network fidelity utility) is a Unix daemon that monitors services
over the network. It uses a "no false alarms" fault verification
algorithm, and understands network dependancies. Natively-monitored
protocols include ICMP echo (ping), DNS, HTTP, POP, NTP, IMAP, SMTP, and
LDAP, as well as having facilities to execute external programs. Status
pages are available via finger or the Web.

3. Wireless Tools/Howto v24
by Jean Tourrilhes
Relevant URL:
http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html
Platforms: Linux
Summary:

The Wireless Tools/HowTo provides a set of generic tools that can help you
set up and monitor Wireless LAN devices through the Wireless Extension
interface. This interface is available only under Linux 2.0.x and higher,
and supports both pre-802.11 features and 802.11-compliant features. It is
accompanied by the Linux Wireless LAN HowTo, which includes all the
information you need to set up any Wireless LAN under Linux.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!
http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml
-------------------------------------------------------------------------------