SecurityFocus Linux Newsletter #328

SecurityFocus Linux Newsletter #328
----------------------------------------

This Issue is Sponsored by: SPI Dynamics

Hacking With Ajax- On demand Webcast
While Ajax can greatly improve the usability of a Web application, it can=
 also=20
create several opportunities for possible attack if the application is no=
t=20
designed with security in mind. Watch this FREE  SPI Dynamics webcast for=
 tips on protecting your applications

https://download.spidynamics.com/1/ad/AJAXw.asp?Campaign_ID=3D70160000000=
CjtG


------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Blanket Discovery for Stolen Laptops
II.  LINUX VULNERABILITY SUMMARY
       1. GnuPG Signed Message Arbitrary Content Injection Weakness
       2. PHP WDDX_Deserialize Buffer Overflow Vulnerability
       3. PHP WDDX Session Deserialization Information Leak Vulnerability
       4. KDE Konqueror JavaScript IFrame Denial of Service Vulnerability
       5. Linux Kernel Sys_Tee Local Privilege Escalation Vulnerability
       6. Mozilla Firefox Javascript URI Remote Code Execution Vulnerabil=
ity
       7. Asterisk SIP Channel Driver Remote Denial of Service Vulnerabil=
ity
       8. Mozilla Thunderbird/Seamonkey Rich Text Integer Overflow Vulner=
ability
       9. Silc Server New Channel Remote Denial Of Service Vulnerability
       10. Apache mod_python Output Filter Mode Information Disclosure Vu=
lnerability
       11. Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerab=
ility
       12. Radscan Conquest Multiple Remote Vulnerabilities
       13. Linux Kernel Omnikey CardMan 4040 Driver Local Buffer Overflow=
 Vulnerability
       14. Snort Inline Fragmentation Denial of Service Vulnerability
       15. PHP Zip URL Wrapper Stack Buffer Overflow Vulnerability
       16. Plash Shell Command Injection Vulnerability
       17. Linux Kernel BINFMT_ELF PT_INTERP Local Information Disclosure=
 Vulnerability
       18. Linux Kernel IPV6_Getsockopt_Sticky Memory Leak Information Di=
sclosure Vulnerability
       19. KTorrent Multiple Remote Vulnerabilities
       20. Xine DirectShow Loader Remote Buffer Overflow Vulnerability
       21. Linux Kernel Netfilter NFNetLink_Log Multiple NULL Pointer Der=
eference Vulnerabilities
       22. PHProjekt Multiple SQL Injection Vulnerabilities
       23. PHProjekt Arbitrary File Upload Vulnerability
       24. Adobe JRun Unspecified Denial Of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Blanket Discovery for Stolen Laptops
By Mark Rasch
Mark Rasch discusses the legal issues behind the discovery and recovery o=
f stolen laptops that use LoJack-style homing devices to announce their l=
ocation, and the location of the thieves, anywhere in the world.
http://www.securityfocus.com/columnists/438


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. GnuPG Signed Message Arbitrary Content Injection Weakness
BugTraq ID: 22757
Remote: Yes
Date Published: 2007-03-05
Relevant URL: http://www.securityfocus.com/bid/22757
Summary:
GnuPG is prone to a weakness that may allow an attacker to add arbitrary =
content into a message without the end user knowing.

An attacker may be able to exploit this issue in applications using GnuPG=
 to add arbitrary content into a signed and/or encrypted message.

Exploiting this issue depends on the individual application's use of GnuP=
G. Individual records will be created detailing this issue in affected ap=
plications.

2. PHP WDDX_Deserialize Buffer Overflow Vulnerability
BugTraq ID: 22804
Remote: Yes
Date Published: 2007-03-04
Relevant URL: http://www.securityfocus.com/bid/22804
Summary:
PHP is prone to a remotely exploitable buffer-overflow vulnerability beca=
use it fails to properly check boundaries when processing client-supplied=
 WDDX packets.

An attacker can exploit this issue to execute malicious code.

NOTE: This issue affects only the latest CVS release of PHP. The vulnerab=
le code has not been released as part of an official PHP release at this =
time.

3. PHP WDDX Session Deserialization Information Leak Vulnerability
BugTraq ID: 22806
Remote: No
Date Published: 2007-03-05
Relevant URL: http://www.securityfocus.com/bid/22806
Summary:
PHP WDDX extension serialization handler is prone to a stack-information =
leak.

The vulnerability arises because of an improper initialization of a 'key_=
length' variable. A local attacker can exploit this issue to obtain sensi=
tive information (such as stack offsets, variables, and canaries) that ma=
y aid in other attacks.

These versions are reported affected:

PHP4 versions prior to 4.4.5
PHP5 versions prior to 5.2.1

Updates are available.

NOTE: This issue was previously  discussed in BID 22496, but has been ass=
igned its own record because new  information has become available.

4. KDE Konqueror JavaScript IFrame Denial of Service Vulnerability
BugTraq ID: 22814
Remote: Yes
Date Published: 2007-03-05
Relevant URL: http://www.securityfocus.com/bid/22814
Summary:
KDE Konqueror is prone to a remote denial-of-service vulnerability becaus=
e of an error in KDE's JavaScript implementation.=20

An attacker may exploit this vulnerability to cause Konquerer to crash, r=
esulting in denial-of-service conditions.

Konqueror included with KDE version 3.5.5 is vulnerable; other versions m=
ay also be affected.

5. Linux Kernel Sys_Tee Local Privilege Escalation Vulnerability
BugTraq ID: 22823
Remote: No
Date Published: 2007-03-05
Relevant URL: http://www.securityfocus.com/bid/22823
Summary:
The Linux kernel is prone to a local privilege-escalation vulnerability.

Exploiting this issue allows local attackers to gain superuser privileges=
, facilitating the complete compromise of affected computers.

6. Mozilla Firefox Javascript URI Remote Code Execution Vulnerability
BugTraq ID: 22826
Remote: Yes
Date Published: 2007-03-05
Relevant URL: http://www.securityfocus.com/bid/22826
Summary:
Mozilla Firefox is prone to a remote code-execution vulnerability due to =
a design error.

Attackers may exploit this issue by enticing victims into visiting a mali=
cious site.

Successful exploits may allow an attacker to crash the application or exe=
cute arbitrary code in the context of the affected application.

7. Asterisk SIP Channel Driver Remote Denial of Service Vulnerability
BugTraq ID: 22838
Remote: Yes
Date Published: 2007-03-06
Relevant URL: http://www.securityfocus.com/bid/22838
Summary:
Asterisk is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to cause the application to=
 crash, effectively denying service to legitimate users.=20

Asterisk versions prior to 1.2.16 and 1.4.1 are vulnerable to this issue.

8. Mozilla Thunderbird/Seamonkey Rich Text Integer Overflow Vulnerability
BugTraq ID: 22845
Remote: Yes
Date Published: 2007-03-06
Relevant URL: http://www.securityfocus.com/bid/22845
Summary:
Thunderbird and Seamonkey are prone to an integer-overflow vulnerability =
because they fail to handle excessively large specially formatted email m=
essages.

A remote attacker can exploit this issue to execute arbitrary code; faile=
d exploit attempts will likely result in denial-of-service conditions.

This issue affects Thunderbird versions prior to 1.5.0.10 and Seamonkey v=
ersions prior to 1.0.8.

9. Silc Server New Channel Remote Denial Of Service Vulnerability
BugTraq ID: 22846
Remote: Yes
Date Published: 2007-03-06
Relevant URL: http://www.securityfocus.com/bid/22846
Summary:
SILC Server is prone to a denial-of-service vulnerability because the app=
lication fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected server, effectiv=
ely denying service to legitimate users.=20
=20
This issue affects version 1.0.2; other versions may also be affected.

10. Apache mod_python Output Filter Mode Information Disclosure Vulnerabi=
lity
BugTraq ID: 22849
Remote: Yes
Date Published: 2007-03-06
Relevant URL: http://www.securityfocus.com/bid/22849
Summary:
The Apache mod_python module is prone to an information-disclosure vulner=
ability because of a design error in the affected application.=20

An attacker can exploit this issue to gain access to sensitive informatio=
n that may lead to further attacks.

11. Util-Linux Umount Filesystem NULL Pointer Dereference Vulnerability
BugTraq ID: 22850
Remote: No
Date Published: 2007-03-07
Relevant URL: http://www.securityfocus.com/bid/22850
Summary:
Util-Linux 'umount' is prone to a NULL-pointer dereference vulnerability.

A local attacker can exploit this issue to crash the affected application=
, denying service to legitimate users. The attacker may also be able to o=
btain sensitive information, including the contents of core files.

Util-Linux Umount implemented on Linux kernel 2.6.15 is reported vulnerab=
le to this issue.

12. Radscan Conquest Multiple Remote Vulnerabilities
BugTraq ID: 22855
Remote: Yes
Date Published: 2007-03-07
Relevant URL: http://www.securityfocus.com/bid/22855
Summary:
Conquest is prone to multiple remotely exploitable vulnerabilities, inclu=
ding a stack-based buffer-overflow vulnerability and a memory-corruption =
vulnerability.=20

An attacker can exploit these issues to execute arbitrary code within the=
 context of the affected application or cause the affected application to=
 crash, denying service to legitimate users.=20
=20
These issues affect version 8.2a; prior versions may also be affected.

13. Linux Kernel Omnikey CardMan 4040 Driver Local Buffer Overflow Vulner=
ability
BugTraq ID: 22870
Remote: No
Date Published: 2007-03-08
Relevant URL: http://www.securityfocus.com/bid/22870
Summary:
The Linux kernel is prone to a local buffer-overflow vulnerability becaus=
e it fails to properly bounds-check user-supplied input before using it i=
n a memory copy operation.

This issue allows local attackers to overwrite kernel memory with arbitra=
ry data, potentially allowing them to execute malicious machine code in t=
he context of affected kernels. Exploiting this vulnerability facilitates=
 the complete compromise of affected computers.

Linux kernel versions prior to 2.6.21-rc3 are affected by this issue.

14. Snort Inline Fragmentation Denial of Service Vulnerability
BugTraq ID: 22872
Remote: Yes
Date Published: 2007-03-08
Relevant URL: http://www.securityfocus.com/bid/22872
Summary:
Snort is prone to a denial-of-service vulnerability because the network i=
ntrusion-detection (NID) system fails to handle specially crafted network=
 packets.=20

 An attacker can exploit this issue to crash the application, allowing ma=
licious network traffic to bypass the NID system.

This issue affects versions 2.6.1.1, 2.6.1.2, and 2.7.0(beta); other vers=
ions may also be affected.

NOTE: Reportedly, for this vulnerability to occur, Snort must be running =
Inline on Linux, with Frag3 enabled and ip_conntrack disabled.

15. PHP Zip URL Wrapper Stack Buffer Overflow Vulnerability
BugTraq ID: 22883
Remote: Yes
Date Published: 2007-03-08
Relevant URL: http://www.securityfocus.com/bid/22883
Summary:
PHP is prone to a remote stack-based buffer-overflow vulnerability becaus=
e the application fails to properly bounds-check user-supplied input befo=
re copying it to an insufficiently sized memory buffer.

Exploiting this issue may allow attackers to execute arbitrary machine co=
de in the context of the affected application. Failed exploit attempts wi=
ll likely result in a denial-of-service condition.

This issue affects PHP 5.2.0 and PHP with PECL ZIP <=3D 1.8.3.

16. Plash Shell Command Injection Vulnerability
BugTraq ID: 22892
Remote: Yes
Date Published: 2007-03-09
Relevant URL: http://www.securityfocus.com/bid/22892
Summary:
Plash is prone to a shell-command-injection vulnerability because the app=
lication fails to properly isolate executing binaries.

Successfully exploiting this issue allows attackers to escape the applica=
tion's sandbox, potentially facilitating the remote compromise of targete=
d computers.

Plash version 1.17 is vulnerable to this issue; other versions may also b=
e affected.

17. Linux Kernel BINFMT_ELF PT_INTERP Local Information Disclosure Vulner=
ability
BugTraq ID: 22903
Remote: No
Date Published: 2007-03-09
Relevant URL: http://www.securityfocus.com/bid/22903
Summary:
The Linux kernel is prone to a vulnerability in the Linux ELF binary load=
er. Exploiting this issue can allow local attackers to gain access to pri=
vileged information.

An attacker may be able to obtain sensitive data that can potentially be =
used to gain elevated privileges.

 This issue is a variant of the vulnerability assigned CVE candidate ID C=
AN-2004-1073, which is documented in BID 11646.

Linux Kernel versions in the 2.6.0 branch prior to 2.6.20 are vulnerable;=
 versions in the 2.4.0 branch may also be affected.

18. Linux Kernel IPV6_Getsockopt_Sticky Memory Leak Information Disclosur=
e Vulnerability
BugTraq ID: 22904
Remote: No
Date Published: 2007-03-09
Relevant URL: http://www.securityfocus.com/bid/22904
Summary:
Linux Kernel is prone to an information-disclosure vulnerability because =
it fails to handle unexpected user-supplied input.

Successful exploits will allow attackers to obtain portions of kernel mem=
ory. Information harvested may be used in further attacks.

Kernel versions 2.6.0 up to 2.6.20.1 are vulnerable to this issue.

19. KTorrent Multiple Remote Vulnerabilities
BugTraq ID: 22930
Remote: Yes
Date Published: 2007-03-12
Relevant URL: http://www.securityfocus.com/bid/22930
Summary:
KTorrent is prone to multiple remote vulnerabilities, including a directo=
ry-traversal vulnerability and an unspecified vulnerability when processi=
ng messages with invalid chunk indexes.=20

Very little information is known about one of these issues. This BID will=
 be updated as soon as more information becomes available.

An attacker can exploit the directory-traversal issue to overwrite arbitr=
ary files on the user's system. Presumably, the unspecified vulnerability=
 when processing messages with invalid chunk indexes will allow attackers=
 to execute arbitrary code or to cause a denial of service, but this has =
not been confirmed.

Versions prior to 2.1.2 are vulnerable to these issues.

20. Xine DirectShow Loader Remote Buffer Overflow Vulnerability
BugTraq ID: 22933
Remote: Yes
Date Published: 2007-03-12
Relevant URL: http://www.securityfocus.com/bid/22933
Summary:
Xine is prone to a remote buffer-overflow vulnerability because the appli=
cation fails to perform boundary checks before copying user-supplied inpu=
t into finite-sized buffers.

Successfully exploiting this issue allows remote attackers to execute arb=
itrary machine code in the context of the application and to compromise a=
ffected computers.

21. Linux Kernel Netfilter NFNetLink_Log Multiple NULL Pointer Dereferenc=
e Vulnerabilities
BugTraq ID: 22946
Remote: No
Date Published: 2007-03-13
Relevant URL: http://www.securityfocus.com/bid/22946
Summary:
The Linux kernel is prone to multiple NULL-pointer dereference vulnerabil=
ities.

A local attacker can exploit these issues to crash the affected kernel, d=
enying service to legitimate users.

22. PHProjekt Multiple SQL Injection Vulnerabilities
BugTraq ID: 22955
Remote: Yes
Date Published: 2007-03-14
Relevant URL: http://www.securityfocus.com/bid/22955
Summary:
PHProjekt is prone to multiple SQL-injection vulnerabilities because the =
application failso properly sanitize user-supplied input before using it =
in an SQL query.=20

A successful exploit could allow an attacker to compromise the applicatio=
n, access or modify data, or exploit vulnerabilities in the underlying da=
tabase implementation.
=20
PHProjekt versions 5.2.0 and prior are vulnerable to these issues.

23. PHProjekt Arbitrary File Upload Vulnerability
BugTraq ID: 22956
Remote: Yes
Date Published: 2007-03-14
Relevant URL: http://www.securityfocus.com/bid/22956
Summary:
PHProjekt is prone to an arbitrary file-upload vulnerability.
=20
Exploiting this issue could allow an attacker to upload and execute arbit=
rary script code in the context of the affected webserver process. This m=
ay help the attacker compromise the application; other attacks are possib=
le.

Versions prior to 5.2.1 are vulnerable to this issue.

24. Adobe JRun Unspecified Denial Of Service Vulnerability
BugTraq ID: 22958
Remote: Yes
Date Published: 2007-03-13
Relevant URL: http://www.securityfocus.com/bid/22958
Summary:
Adobe JRun is prone to a denial-of-service vulnerability. This issue occu=
rs because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected application, den=
ying service to legitimate to legitimate users.

This issue affects Microsoft IIS 6 installations running JRun 4 Updater 6=
.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securi=
tyfocus.com from the subscribed address. The contents of the subject or m=
essage body do not matter. You will receive a confirmation request messag=
e to which you will have to answer. Alternatively you can also visit http=
://www.securityfocus.com/newsletters and unsubscribe via the website.=20

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: SPI Dynamics

Hacking With Ajax- On demand Webcast
While Ajax can greatly improve the usability of a Web application, it can=
 also=20
create several opportunities for possible attack if the application is no=
t=20
designed with security in mind. Watch this FREE  SPI Dynamics webcast for=
 tips on protecting your applications

https://download.spidynamics.com/1/ad/AJAXw.asp?Campaign_ID=3D70160000000=
CjtG