SecurityFocus Linux Newsletter #94

SecurityFocus Linux Newsletter #94
----------------------------------

This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!
http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml
-------------------------------------------------------------------------------


I. FRONT AND CENTER
     1. Configuring IPsec/IKE on Solaris
     2. No Stone Unturned, Part Six
     3. Unlocking the Secrets of Crypto: Cryptography, Encryption...
     4. The Original Anti-Piracy Hack
     5. SecurityFocus DPP Program
     6. InforwarCon 2002
     7. SpiDynamics ALERT
II. LINUX VULNERABILITY SUMMARY
     1. Cisco VPN Client Zero Length IKE Packet Denial Of Service...
     2. iSCSI Insecure Configuration File Permissions Information...
     3. Macromedia Flash Malformed Header Buffer Overflow Vulnerability
     4. ISDN4Linux IPPPD Device String SysLog Format String Vulnerability
     5. Cisco VPN Client IKE Security Parameter Index Payload Buffer...
     6. PGP / GnuPG Chosen Ciphertext Message Disclosure Vulnerability
     7. Cisco VPN Client IKE Packet Excessive Payloads Vulnerability
     8. Red Hat Interchange Arbitrary File Read Vulnerability
     9. Leszek Krupinski L-Forum Message Header Script Injection...
     10. Xinetd Open File Descriptor Denial Of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. NO NEW POSTS THIS WEEK
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. PureSecure
     2. BRICKServer
     3. CipherServer 440
V. NEW TOOLS FOR LINUX PLATFORMS
     1. Advisor v1.2.6-3
     2. spasm anti-spam milter v0.22
     3. HTun v0.9.3b
VI. SPONSORSHIP INFORMATION



I. FRONT AND CENTER
-------------------
1. Configuring IPsec/IKE on Solaris
By Ido Dubrawsky

The IP Security Protocol (IPsec) and the Internet Key Exchange (IKE)
protocol are designed to permit system and network administrators the
capability to protect traffic between two systems. This article is the
first of a three-part series that will examine IPsec and the key
management protocol, IKE, and provide readers with an introduction on how
to configure both protocols on a Solaris host.

http://online.securityfocus.com/infocus/1616

2. No Stone Unturned, Part Six
by H. Carvey

This is an additional installment to the No Stone Unturned series, which
was written to help clarify to NT/2K admins the steps they can take to
determine the nature and purpose of suspicious files found on their
systems. In Part Five of the series, our heroic system administrator found
an unusual file on a compromised system. In this bonus installment, he
attempts to determine the nature and purpose of that file.

http://online.securityfocus.com/infocus/1618

3. Unlocking the Secrets of Crypto: Cryptography, Encryption, and
Cryptology Explained
by Sarah Granger

Encryption, decryption and code breaking came into the public
consciousness in the 1980s with popularity of the movie War Games. It
became newsworthy in the 1990s with the legal battles surrounding PGP and
the political discussion of the Clipper Chip. Now, with information
security becoming more and more of a common concern, the terms encryption,
cryptography and cryptology - commonly grouped together under the term
crypto” - are seeping into our daily language. Still, many people are
unsure of what these terms refer to. The purpose of this article is to
demystify crypto and break it down to simple tools that aid us in
achieving satisfactory privacy and security.

http://online.securityfocus.com/infocus/1617

4. The Original Anti-Piracy Hack
By George Smith

The entertainment industry's plan to use malicious cyber attacks to
enforce its copyrights has precedent in a strange British case from a
decade past

http://online.securityfocus.com/columnists/102

5. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

6. InforwarCon 2002

InforwarCon 2002: Homeland Defense and Cyber-Terrorism, Washington, DC
September 4-5, 2002, optional workshops September 3 & 6. Presented by MIS
Training Institute and Interpact, Inc. Proven strategies for protecting
against threats to critical infrastructures and government systems.

Visit us at:
http://www.misti.com/08/iw02nl26inf.html

7. SpiDynamics

ALERT: Top 14 Web Application Attack Techniques and Methods to Combat them
Firewalls, IDS and Access Controls don't stop these attacks because
hackers using the web application layer are NOT seen as intruders. Learn
why 75% of today's successful system hacks involve Web Application
vulnerabilities, not network security flaws. Download this *FREE* white
paper from SPI Dynamics for a complete guide of Web application
vulnerabilities.

http://www.spidynamics.com/mktg/webappsecurity20


II. BUGTRAQ SUMMARY
-------------------
1. Cisco VPN Client Zero Length IKE Packet Denial Of Service Vulnerability
BugTraq ID: 5440
Remote: Yes
Date Published: Aug 12 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5440
Summary:

The Cisco VPN Client is Virtual Private Network software. It is available
for a number of platforms including Microsoft Windows and Unix and Linux
variants.

Some versions of the VPN Client are vulnerable to a denial of service
attack.

When vulnerable clients receive a specific IKE packet with a zero length
payload, the VPN client will consume all available processor time. This
may result in a denial of service condition, and require that the VPN
client process be manually killed and restarted in order to regain normal
functionality.

It may be possible to exploit this vulnerability with a malicious server.
It may also be possible to exploit this issue by injecting a malicious
packet into a legitimate VPN connection. The ability to inject data will
depend on network proximity of the attacker, however VPN connections are
commonly made when traffic must pass through untrusted network space.

2. iSCSI Insecure Configuration File Permissions Information Disclosure Vulnerability
BugTraq ID: 5423
Remote: No
Date Published: Aug 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5423
Summary:

The iSCSI (Internet Small Computer System Interface) protocol is an
Internet Protocol (IP) based storage networking standard for linking data
storage facilities.

iSCSI leaves administrative credentials stored in a world-readable
configuration file.

The configuration file that iSCSI uses is stored in /etc/iscsi.conf.
Reportedly, this file is installed, by default, with world readable and
possibly world writeable permissions enabled. This may have some
potentially serious consequences as the configuration file also stores
password information in plain text.

Reportedly, RedHat Linux Limbo Beta and SuSE ship with iSCSI. SuSE has
reported that proper permissions are enabled for iSCSI. RedHat has
confirmed that Limbo Beta ships with improper file permissions enabled and
will reportedly fix it in the next release of Limbo.

3. Macromedia Flash Malformed Header Buffer Overflow Vulnerability
BugTraq ID: 5430
Remote: Yes
Date Published: Aug 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5430
Summary:

Macromedia Flash is a modular package designed to enhance web browsing and
enables users to view various multimedia web content.

Macromedia Flash is prone to a buffer overflow condition.  This is due to
insufficient bounds checking of headers in Flash Shockwave movie files
(.SWF).  It is reportedly possible to exploit this issue by hand-editing
header information in a movie file with a hex editor.  When the movie with
the malformed header is processed by Flash, the condition will occur,
resulting in corruption of memory.  In particular, it is frame data in the
header which must be malformed for memory corruption to occur.  An
attacker may exploit this to overwrite function pointers with
attacker-supplied values.

Successful exploitation will allow an attacker to execute arbitrary code
on a client system running Macromedia Flash.  An attacker would have to
entice a user of the vulnerable software to load the malformed movie file.
This might be accomplished via a malicious webpage, e-mail, newsgroups or
any other means by which the malicious movie file may be transmitted to a
user.  Code execution will occur with the privileges of the user running
the player.

The Macromedia Flash plug-in is included in a number of web browsers.
This issue is known to affect Macromedia Flash on all platforms.

4. ISDN4Linux IPPPD Device String SysLog Format String Vulnerability
BugTraq ID: 5437
Remote: No
Date Published: Aug 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5437
Summary:

isdn4linux is a freely available, open source package of isdn
compatibility tools.  It is available for Linux operating systems.

A problem with isdn4linux may make local code execution and privilege
elevation possible.

isdn4linux contains a format string vulnerability in the ipppd utility.
In some installations, this utility is installed with setuid root
privileges.  Exploitation of this vulnerability could lead to a local
attacker executing code with administrative privileges.

The problem is in handling of device strings.  By executing ipppd with an
excessively long device string (256 or greater bytes), and embedding
format string specifiers in the device string, it is possible to execute
arbitrary attacker-supplied instructions.

SecurityFocus staff have determined that this vulnerability has apparently
been fixed in version 3.2p1 of the software.  This has not been confirmed
by the vendor.

5. Cisco VPN Client IKE Security Parameter Index Payload Buffer Overflow Vulnerability
BugTraq ID: 5441
Remote: Yes
Date Published: Aug 12 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5441
Summary:

The Cisco VPN Client is Virtual Private Network software.  It is available
for a number of platforms including Microsoft Windows and Unix and Linux
variants.

The Cisco VPN Client is prone to a remotely exploitable buffer overflow
condition.  It is possible to trigger this condition by sending malformed
IKE packets to the client.  The overflow occurs when the Security
Parameter Index payload of the IKE packet is longer than 16 bytes in
length.  When the malformed packet is handled by the client, memory can be
corrupted with attacker-supplied values, which may enable the attacker to
execute arbitrary instructions.

An attacker would most likely exploit this vulnerability with a malicious
server.  It may also be possible to exploit this issue by injecting a
malicious packet into a legitimate VPN connection.  The ability to inject
data will depend on network proximity of the attacker, however VPN
connections are commonly made when traffic must pass through untrusted
network space.

It may be possible to exploit this condition to execute arbitrary code
with the privileges of the client.  It is possible that exploitation of
this vulnerability may affect availability of the client, resulting in a
denial of service condition.

This issue is reported to be exploitable when the client software is
operating in Aggressive Mode during a phase 1 IKE exchange.

This vulnerability affects versions of the client on all platforms.

6. PGP / GnuPG Chosen Ciphertext Message Disclosure Vulnerability
BugTraq ID: 5446
Remote: Yes
Date Published: Aug 12 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5446
Summary:

PGP and GnuPG are two popular implementations of the OpenPGP encryption
specification. Both are available for a range of platforms, including
Microsoft Windows and Linux based systems.

A weakness in the OpenPGP specification, as implemented by both products,
may allow an attacker to learn the plaintext contents of encrypted
communications. While some degree of user interaction is required, the
attack is very plausible against non-technical end users.

In order to exploit this issue, an attacker E must first intercept an
encrypted message of interest between two users, B and A. The attacker may
modify this message and inject additional content into the encrypted
content.  This modified message must then be transmitted to A, the
recipient of the original message.

The attacker must then entice A into decrypting this message, and
revealing the results of the decrypted message. This may occur if A
responds to the malicious message with text that includes the decrypted
contents. As the results of decryption will appear garbled and
meaningless, it is conceivable that A would reply and include the original
"quoted" message in an attempt to determine what has gone wrong.

Given the decrypted version of the malicious message, and the original
encrypted message, the attacker may recover a portion of the original
plaintext. In general the attacker will be able to recover at best half of
the plaintext content per attack, as it is difficult to modify the
encrypted length of the message, and an equal amount of injected content
is required in order to implement the attack. Under many applications this
will be sufficient, however multiple attacks may result in full disclosure
of the plaintext message.

It is not believed to be possible to exploit this weakness against message
content which is compressed during the OpenPGP encryption process.
Attacker supplied content will cause an error in the decompression process
with a high degree of probability, which may alert the end user or prevent
the display of the decrypted content. Compression is reported to be
enabled in both products by default. Files which are already compressed,
however, may not be compressed again, allowing exploitation.

It is important to note that exploitation of this issue will result in the
plaintext contents of a specific, intercepted message being disclosed to a
third party. The integrity of the private keys involved in the original
communication is not compromised, and widespread exploitation of this
weakness is extremely likely to be noticed by the end user.

7. Cisco VPN Client IKE Packet Excessive Payloads Vulnerability
BugTraq ID: 5443
Remote: Yes
Date Published: Aug 12 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5443
Summary:

The Cisco VPN Client is Virtual Private Network software.  It is available
for a number of platforms including Microsoft Windows and Unix and Linux
variants.

The Cisco VPN Client is prone to a remotely exploitable buffer overflow
condition.  It is possible to trigger this condition by sending malformed
IKE packets to the client.  The overflow is known to occur when the client
attempts to process an IKE packet with more than 57 valid payloads.  When
the malformed packet is handled by the client, memory can be corrupted
with attacker-supplied values, which may enable the attacker to execute
arbitrary instructions.

An attacker would most likely exploit this vulnerability with a malicious
server.  It may also be possible to exploit this issue by injecting a
malicious packet into a legitimate VPN connection. The ability to inject
data will depend on network proximity of the attacker, however VPN
connections are commonly made when traffic must pass through untrusted
network space.

It may be possible to exploit this condition to execute arbitrary code
with the privileges of the client.  It is possible that exploitation of
this vulnerability may affect availability of the client, resulting in a
denial of service condition.

This issue is reported to be exploitable when the client software is
operating in Aggressive Mode during a phase 1 IKE exchange.

This vulnerability affects versions of the client on all platforms.

8. Red Hat Interchange Arbitrary File Read Vulnerability
BugTraq ID: 5453
Remote: Yes
Date Published: Aug 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5453
Summary:

Interchange is a Web application development environment with a focus on
ecommerce and dynamic content management. It is available for Linux and
Unix variant operating systems.

A vulnerability has been reported for Interchange 4.8.5 and earlier.
Interchange may disclose contents of files to attackers.

The vulnerability occurs due to the placement of the 'doc' folder.
Reportedly, the folder will be installed as follows:
<INTERCHANGE_ROOT>/doc. This folder, by default, contains Interchange man
pages. This vulnerability is only exploitable when the Interchange service
runs in INET (Internet service) mode.

An attacker may exploit this vulnerability to the contents of restricted
files accessible to the Interchange process. The potentially sensitive
information obtained may be used to mount further attacks against a
vulnerable system.

It has been reported that this issue may be exploited through a '../'
directory traversal sequence in a HTTP request to the vulnerable server.
URLs may escape the document root in this manner, and request arbitrary
files on the system, subject to the permissions of the server process.

9. Leszek Krupinski L-Forum Message Header Script Injection Vulnerability
BugTraq ID: 5462
Remote: Yes
Date Published: Aug 14 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5462
Summary:

Leszek Krupinski L-Forum is a Web forum implemented in PHP, and should be
available for Microsoft Windows, Linux and most Unix based operating
systems.

A script injection vulnerability has been reported in L-Forum 2.4.0.
Malicious messages may be posted to the forum which include arbitrary HTML
content, including JavaScript code. If the message is then viewed by
another user of the system, the supplied script code will execute within
the context of the vulnerable site.

If the 'Enable HTML in messages' server option is enabled, it is possible
to include arbitrary code in both the message body and all message
headers, including the 'From', 'E-mail' and 'Subject' fields.

If this option is disabled, however, it is still possible to include
arbitrary HTML in the message header fields.

Malicious script code may be able to access sensitive information
associated with the vulnerable site, such as authentication credentials
stored in cookies. It may also be possible to take actions on the forum as
the authenticated user viewing the message.

This vulnerability has been reported for L-Forum 2.4.0. It is not known
whether other versions are affected.

10. Xinetd Open File Descriptor Denial Of Service Vulnerability
BugTraq ID: 5458
Remote: No
Date Published: Aug 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5458
Summary:

Xinetd is intended as a secure replacement for inetd. It is designed for
use with Linux and Unix variant operating environments.

Reportedly, xinetd is vulnerable to a denial of service condition. The
vulnerability is the result of file descriptors for the signal pipe being
inherited by child processes launched by xinetd. This may result in a
malicious attacker access to pipes associated with xinetd thus having the
ability to communicate with xinetd.

Local attackers may misuse the open file descriptors by sending extraneous
or malformed data to xinetd which may cause the service to crash. This
results xinetd failing to respond to legitimate requests for service.

The signal pipe was introduced in version 2.3.4 of Xinetd.  Earlier
versions are not prone to this issue.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. NO NEW POSTS THIS WEEK


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1 PureSecure
by Demarc Security
Platforms: Linux, POSIX, Solaris, SunOS, UNIX, Windows 2000, Windows
95/98, Windows NT, Windows XP
Relevant URL:
http://www.demarc.com/products/puresecure/
Summary:

Demarc PureSecure is a Total Intrusion Detection System (TIDS), which
provides an unsurpassed level of comprehensive security. For the first
time you will be able to reliably prevent, detect, and deter internal and
external threats to your organization's valuable assets with complete
confidence, 24 hours a day. Advanced cross platform compatible technology
means PureSecure can be deployed and scale in a wide variety of network
infrastructures.

2. BRICKServer
by SAGE
Platforms: Linux
Relevant URL:
http://www.thirdpig.com/brickserver.htm
Summary:

BRICKServer is a secure Web appliance featuring Process-Based security,
created for the sole purpose of protecting a website from Hackers.

3. CipherServer 440
by SSP Solutions
Platforms: Linux, Windows 2000
Relevant URL:
http://www.litronic.com/solutions/cipherserver.html
Summary:

The CipherServer 440 is specially designed to off-load the public key
functions to on-board processors, free up CPU resources and provide
instant responses back to the customer. Whether transactions need server
and/or client authentication, the CipherServer 440 accelerates SSL
transactions to handle multiple, simultaneous sessions for passing
information securely between the client and sever.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Advisor v1.2.6-3
by miron
Relevant URL:
http://www.niftybox.com/download.php
Platforms: Linux
Summary:

Advisor monitors a security advisory database and sends alerts whenever an
advisory affects an installed software package. For example, if there is a
security advisory regarding Apache, and you have Apache installed, a
notification will be sent out. Currently, RedHat and Mandrake are
supported.

2. spasm anti-spam milter v0.22
by Aradia
Relevant URL:
http://www.theasylum.org/spasm/
Platforms: Linux
Summary:

The spasm anti-spam milter is a spam filter for sendmail 8.12+ (with
libmilter support). Current features include logging of rejected spam,
fully virtualised settings for domains, individual whitelists, and over
two dozen blacklist filters which can be set individually on a per-domain
or per-email address basis (including local blacklist, rDNS resolution,
HELO/EHLO verification, envelope sender address verification, numerous
DNS-based lists, whitelist-only mode, tagging-only mode, and
auto-blacklisting features).

3. HTun v0.9.3b
by Moshe Jacobson
Relevant URL:
http://htun.runslinux.net/
Platforms: Linux
Summary:

HTun is a VPN (Virtual Private Network) interface that allows you to
create a fully bidirectional IP-layer VPN over an HTTP proxy or just over
port 80, allowing you to bypass restrictive firewalls and use any IP-based
service you desire.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by: SecurityFocus DeepSight Threat Management
System

From June 24th - August 31st, 2002, SecurityFocus announces a FREE
two-week trial of the DeepSight Threat Management System: the only early
warning system providing customizable and comprehensive early warning of
cyber attacks and bulletproof countermeasures to prevent attacks before
they hit your network.

With the DeepSight Threat Management System, you can focus on proactively
deploying prioritized and specific patches to protect your systems from
attacks, rather than reactively searching dozens of Web sites or hundreds
of emails frantically trying to gather information on the attack and how
to recover from it.

Sign up today!
http://www.securityfocus.com/corporate/products/promo/tmstrial-lx.shtml
-------------------------------------------------------------------------------