SecurityFocus Linux Newsletter #327

SecurityFocus Linux Newsletter #327
----------------------------------------

This Issue is Sponsored by: Watchfire

As web applications become increasingly complex, tremendous amounts of se=
nsitive data - personal, medical and financial - are exchanged, and store=
d. Consumers expect and demand security for this information. This whitep=
aper examines a few vulnerability detection methods - specifically compar=
ing and contrasting manual penetration testing with automated scanning to=
ols. Download "Automated Scanning or Manual Penetration Testing?" today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=3D701500000008fG=
D


------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Zero Day Patches
       2. Building Secure Applications: Consistent Logging
II.  LINUX VULNERABILITY SUMMARY
       1. IBM DB2 Fenced UserID Unspecified Authentication Bypass Vulnera=
bility
       2. Debian Apache Root Shell Local Privilege Escalation Vulnerabili=
ties
       3. Linux Kernel Audit Subsystems Local Denial of Service Vulnerabi=
lity
       4. Nullsoft Shoutcast Logfile HTML Injection Vulnerability
       5. GnuPG Signed Message Arbitrary Content Injection Weakness
       6. MPlayer DMO File Parsing Buffer Overflow Vulnerability
       7. TCPDump IEEE802.11 printer Remote Buffer Overflow Vulnerability
       8. WebMod Content Length Stack Buffer Overflow Vulnerability
       9. Kaspersky AntiVirus UPX File Decompression Remote Denial of Ser=
vice Vulnerability
       10. PHP PHPInfo Cross-Site Scripting Variant Vulnerability
       11. PHP WDDX_Deserialize Buffer Overflow Vulnerability
       12. PHP WDDX Session Deserialization Information Leak Vulnerabilit=
y
       13. Linux Kernel Sys_Tee Local Privilege Escalation Vulnerability
       14. Mozilla Firefox Javascript URI Remote Code Execution Vulnerabi=
lity
       15. Asterisk SIP Channel Driver Remote Denial of Service Vulnerabi=
lity
       16. Mozilla Thunderbird/Seamonkey Rich Text Integer Overflow Vulne=
rability
       17. Apache mod_python Output Filter Mode Information Disclosure Vu=
lnerability
       18. Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerab=
ility
       19. Avaya System Products Shell Command Injection Vulnerabilities
       20. Radscan Conquest Multiple Remote Vulnerabilities
III. LINUX FOCUS LIST SUMMARY
       1. Did I get hacked?
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Zero Day Patches
By Federico Biancuzzi
Zero day exploits were once the realm of just underground and elite hacke=
rs, but their increased prevalence is bringing a positive new trend: unof=
ficial patches from members of the community, offered for protection befo=
re official vendor patches appear. Federico Biancuzzi interviewed Landon =
Fuller, who wrote Mac OS X patches for recent Month of Apple Bugs vulnera=
bilities, and the ZERT team, which has offered patches for critical Micro=
soft Windows zero-days that were actively exploited.
http://www.securityfocus.com/columnists/437

2. Building Secure Applications: Consistent Logging
By Rohit Sethi and Nish Bhalla
This article focuses on developers and discusses how to use consistent ap=
plication-layer logging along with Log4J or Log4net for the real-time det=
ection of attacks.=20
http://www.securityfocus.com/infocus/1888


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. IBM DB2 Fenced UserID Unspecified Authentication Bypass Vulnerability
BugTraq ID: 22729
Remote: No
Date Published: 2007-02-26
Relevant URL: http://www.securityfocus.com/bid/22729
Summary:
IBM DB2 is prone to an unspecified authentication-bypass vulnerability be=
cause it fails to effectively restrict access to certain directories.

An attacker could exploit this issue to gain unauthorized access to privi=
leged directories.=20

Versions prior to 8.1 FixPak 14 and 9.1 FixPak 2 are vulnerable.

2. Debian Apache Root Shell Local Privilege Escalation Vulnerabilities
BugTraq ID: 22732
Remote: No
Date Published: 2007-02-26
Relevant URL: http://www.securityfocus.com/bid/22732
Summary:
The Debian Apache distribution is prone to a local privilege-escalation v=
ulnerability.

A local attacker can exploit this issue to execute abritrary commands wit=
h superuser privileges. This can result in a complete compromise of the a=
ffected computer.

This issue affects Debian Apache version 1.3.34-4.

3. Linux Kernel Audit Subsystems Local Denial of Service Vulnerability
BugTraq ID: 22737
Remote: No
Date Published: 2007-02-27
Relevant URL: http://www.securityfocus.com/bid/22737
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability.

A local attacker can exploit this issue to crash the kernel.

Linux kernel versions 2.6.x are vulnerable to this issue.

4. Nullsoft Shoutcast Logfile HTML Injection Vulnerability
BugTraq ID: 22742
Remote: Yes
Date Published: 2007-02-27
Relevant URL: http://www.securityfocus.com/bid/22742
Summary:
Nullsoft SHOUTcast is prone to an HTML-injection vulnerability because it=
 fails to properly sanitize user-supplied input before using it in dynami=
cally generated content.=20

Attacker-supplied HTML and script code would run in the context of the af=
fected website, potentially allowing an attacker to steal cookie-based au=
thentication credentials or to control how the site is rendered to the us=
er; other attacks are also possible.

This issue affects version 1.9.7 for Microsoft Windows; other versions ma=
y also be vulnerable.

5. GnuPG Signed Message Arbitrary Content Injection Weakness
BugTraq ID: 22757
Remote: Yes
Date Published: 2007-03-05
Relevant URL: http://www.securityfocus.com/bid/22757
Summary:
GnuPG is prone to a weakness that may allow an attacker to add arbitrary =
content into a message without the end user knowing.

An attacker may be able to exploit this issue in applications using GnuPG=
 to add arbitrary content into a signed and/or encrypted message.

Exploiting this issue depends on the individual application's use of GnuP=
G. Individual records will be created detailing this issue in affected ap=
plications.

6. MPlayer DMO File Parsing Buffer Overflow Vulnerability
BugTraq ID: 22771
Remote: Yes
Date Published: 2007-03-01
Relevant URL: http://www.securityfocus.com/bid/22771
Summary:
MPlayer is susceptible to a buffer-overflow vulnerability when it attempt=
s to process malformed video files. This issue occurs because the applica=
tion fails to perform proper bounds-checking on user-supplied data before=
 copying it to an insufficiently sized memory buffer.

An attacker may exploit this issue to execute arbitrary code with the pri=
vileges of the user that activated the vulnerable application. This may f=
acilitate unauthorized access or privilege escalation.

MPlayer version 1.0rc1 is vulnerable to this issue; previous versions may=
 also be affected.

7. TCPDump IEEE802.11 printer Remote Buffer Overflow Vulnerability
BugTraq ID: 22772
Remote: Yes
Date Published: 2007-03-01
Relevant URL: http://www.securityfocus.com/bid/22772
Summary:
The 'tcpdump' utility is prone to a heap-based buffer-overflow vulnerabil=
ity because it fails to bounds-check user-supplied input before copying i=
t into an insufficiently sized memory buffer.

 An attacker can exploit this issue to execute arbitrary malicious code i=
n the context of the user running the affected application. Failed exploi=
t attempts will likely crash the affected application.
=20
This issue affects tcpdump 3.9.5 and prior versions.

8. WebMod Content Length Stack Buffer Overflow Vulnerability
BugTraq ID: 22788
Remote: Yes
Date Published: 2007-03-02
Relevant URL: http://www.securityfocus.com/bid/22788
Summary:
WebMod is prone to a remote stack-based buffer-overflow vulnerability bec=
ause the application fails to properly bounds-check user-supplied input b=
efore copying it to an insufficiently sized memory buffer.

Exploiting this issue may allow attackers to execute arbitrary machine co=
de in the context of the affected application. Failed exploit attempts wi=
ll likely result in a denial-of-service condition.

This issue affects version 0.48; other versions may also be affected.

9. Kaspersky AntiVirus UPX File Decompression Remote Denial of Service Vu=
lnerability
BugTraq ID: 22795
Remote: Yes
Date Published: 2007-03-02
Relevant URL: http://www.securityfocus.com/bid/22795
Summary:
Kaspersky AntiVirus is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause the application to fall into =
an infinite loop, denying further service to legitimate users.

This issue affects Kaspersky Labs Antivirus Engine version 6.0.1.411 for =
Windows and 5.5-10 for Linux.

10. PHP PHPInfo Cross-Site Scripting Variant Vulnerability
BugTraq ID: 22803
Remote: Yes
Date Published: 2007-03-03
Relevant URL: http://www.securityfocus.com/bid/22803
Summary:
PHP is prone to a cross-site scripting vulnerability because it fails to =
properly sanitize user-supplied input.=20

An attacker may leverage this issue to execute arbitrary script code in t=
he browser of an unsuspecting user in the context of the affected site. T=
his may help the attacker steal cookie-based authentication credentials a=
nd launch other attacks.

This is a variant of the vulnerability described in BID 15428. This varia=
nt was reintroduced into PHP versions 4.4.3 through 4.4.6.

11. PHP WDDX_Deserialize Buffer Overflow Vulnerability
BugTraq ID: 22804
Remote: Yes
Date Published: 2007-03-04
Relevant URL: http://www.securityfocus.com/bid/22804
Summary:
PHP is prone to a remotely exploitable buffer-overflow vulnerability beca=
use it fails to properly check boundaries when processing client-supplied=
 WDDX packets.

An attacker can exploit this issue to execute malicious code.

NOTE: This issue affects only the latest CVS release of PHP. The vulnerab=
le code has not been released as part of an official PHP release at this =
time.

12. PHP WDDX Session Deserialization Information Leak Vulnerability
BugTraq ID: 22806
Remote: No
Date Published: 2007-03-05
Relevant URL: http://www.securityfocus.com/bid/22806
Summary:
PHP WDDX extension serialization handler is prone to a stack-information =
leak.

The vulnerability arises because of an improper initialization of a 'key_=
length' variable. A local attacker can exploit this issue to obtain sensi=
tive information (such as stack offsets, variables, and canaries) that ma=
y aid in other attacks.

These versions are reported affected:

PHP4 versions prior to 4.4.5
PHP5 versions prior to 5.2.1

Updates are available.

NOTE: This issue was previously  discussed in BID 22496, but has been ass=
igned its own record because new  information has become available.

13. Linux Kernel Sys_Tee Local Privilege Escalation Vulnerability
BugTraq ID: 22823
Remote: No
Date Published: 2007-03-05
Relevant URL: http://www.securityfocus.com/bid/22823
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability.

Exploiting this issue allows local attackers to gain superuser privileges=
, facilitating the complete compromise of affected computers.

14. Mozilla Firefox Javascript URI Remote Code Execution Vulnerability
BugTraq ID: 22826
Remote: Yes
Date Published: 2007-03-05
Relevant URL: http://www.securityfocus.com/bid/22826
Summary:
Mozilla Firefox is prone to a remote code-execution vulnerability due to =
a design error.

Attackers may exploit this issue by enticing victims into visiting a mali=
cious site.

Successful exploits may allow an attacker to crash the application or exe=
cute arbitrary code in the context of the affected application.

15. Asterisk SIP Channel Driver Remote Denial of Service Vulnerability
BugTraq ID: 22838
Remote: Yes
Date Published: 2007-03-06
Relevant URL: http://www.securityfocus.com/bid/22838
Summary:
Asterisk is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to cause the application to=
 crash, effectively denying service to legitimate users.=20

Asterisk versions prior to 1.2.16 and 1.4.1 are vulnerable to this issue.

16. Mozilla Thunderbird/Seamonkey Rich Text Integer Overflow Vulnerabilit=
y
BugTraq ID: 22845
Remote: Yes
Date Published: 2007-03-06
Relevant URL: http://www.securityfocus.com/bid/22845
Summary:
Thunderbird and Seamonkey are prone to an integer-overflow vulnerability =
because they fail to handle excessively large specially formatted email m=
essages.

A remote attacker can exploit this issue to execute arbitrary code; faile=
d exploit attempts will likely result in denial-of-service conditions.

This issue affects Thunderbird versions prior to 1.5.0.10 and Seamonkey v=
ersions prior to 1.0.8.

17. Apache mod_python Output Filter Mode Information Disclosure Vulnerabi=
lity
BugTraq ID: 22849
Remote: Yes
Date Published: 2007-03-06
Relevant URL: http://www.securityfocus.com/bid/22849
Summary:
The Apache mod_python module is prone to an information-disclosure vulner=
ability because of a design error in the affected application.=20

An attacker can exploit this issue to gain access to sensitive informatio=
n that may lead to further attacks.

18. Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerability
BugTraq ID: 22850
Remote: No
Date Published: 2007-03-07
Relevant URL: http://www.securityfocus.com/bid/22850
Summary:
Util-Linux 'umount' is prone to a NULL-pointer dereference vulnerability.

A local attacker can exploit this issue to crash the affected application=
, denying service to legitimate users. The attacker may also be able to o=
btain sensitive information, including the contents of core files.

Util-Linux Umount implemented on Linux kernel 2.6.15 is reported vulnerab=
le to this issue.

19. Avaya System Products Shell Command Injection Vulnerabilities
BugTraq ID: 22854
Remote: Yes
Date Published: 2007-03-06
Relevant URL: http://www.securityfocus.com/bid/22854
Summary:
Avaya System Products are prone to unspecified shell command-injection vu=
lnerabilities.

Specific Avaya products that contain maintenance web pages may allow auth=
enticated users to issue shell commands through their HTTP interface.

Commands executed through these vulnerabilities could permit an attacker =
to gain access to a vulnerable system. Commands are executed in the conte=
xt of the authenticated user.

20. Radscan Conquest Multiple Remote Vulnerabilities
BugTraq ID: 22855
Remote: Yes
Date Published: 2007-03-07
Relevant URL: http://www.securityfocus.com/bid/22855
Summary:
Conquest is prone to multiple remotely exploitable vulnerabilities, inclu=
ding a stack-based buffer-overflow vulnerability and a memory-corruption =
vulnerability.=20

An attacker can exploit these issues to execute arbitrary code within the=
 context of the affected application or cause the affected application to=
 crash, denying service to legitimate users.=20
=20
These issues affect version 8.2a; prior versions may also be affected.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Did I get hacked?
http://www.securityfocus.com/archive/91/459940

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securi=
tyfocus.com from the subscribed address. The contents of the subject or m=
essage body do not matter. You will receive a confirmation request messag=
e to which you will have to answer. Alternatively you can also visit http=
://www.securityfocus.com/newsletters and unsubscribe via the website.=20

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: Watchfire

As web applications become increasingly complex, tremendous amounts of se=
nsitive data - personal, medical and financial - are exchanged, and store=
d. Consumers expect and demand security for this information. This whitep=
aper examines a few vulnerability detection methods - specifically compar=
ing and contrasting manual penetration testing with automated scanning to=
ols. Download "Automated Scanning or Manual Penetration Testing?" today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=3D701500000008fG=
D