SecurityFocus Linux Newsletter #338

SecurityFocus Linux Newsletter #338
----------------------------------------

This Issue is Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Cross-Site Scripting Attack"- White Paper=
=20
Cross-site scripting vulnerabilities in web apps allow hackers to comprom=
ise confidential information, steal cookies and create requests that can =
be mistaken for those of a valid user!! Download this *FREE* white paper =
from SPI Dynamics for a complete guide to protection!
=20
https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=3D70160000000Cq=
BQ


SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Your Space, My Space, Everybody's Space
II.  LINUX VULNERABILITY SUMMARY
       1. Samba MS-RPC Remote Shell Command Execution Vulnerability
       2. Samba NDR RPC Request Multiple Heap-Based Buffer Overflow Vulne=
rabilities
       3. Samba SID Names Local Privilege Escalation Vulnerability
       4. Linux Kernel 8250 Serial Driver Local Denial of Service Vulnera=
bility
       5. Libpng Library Remote Denial of Service Vulnerability
       6. Computer Associates BrightStor ARCserve Backup CatiRPC.DLL/RWXD=
R.DLL Denial Of Service Vulnerability
       7. Computer Associates BrightStor ARCserve Backup CALoggerD.EXE De=
nial Of Service Vulnerability
       8. Retired: Libpng Library Grayscale Image CRC Check Remote Denial=
 of Service Vulnerability
       9. Sun Brocade Switches Denial Of Service Vulnerability
       10. IRCD RatBox Pending Connections Denial Of Service Vulnerabilit=
y
III. LINUX FOCUS LIST SUMMARY
       1. Security Videos
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Your Space, My Space, Everybody's Space
By Mark Rasch
Privacy is about protecting data when somebody wants it for some purpose.=
 It is easy to protect data that nobody wants.
http://www.securityfocus.com/columnists/444


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Samba MS-RPC Remote Shell Command Execution Vulnerability
BugTraq ID: 23972
Remote: Yes
Date Published: 2007-05-14
Relevant URL: http://www.securityfocus.com/bid/23972
Summary:
Samba is prone to a vulnerability that allows attackers to execute arbitr=
ary shell commands because the software fails to sanitize user-supplied i=
nput.

An attacker may leverage this issue to execute arbitrary shell commands o=
n an affected computer with the privileges of the application.

This issue affects Samba 3.0.0 to 3.0.25rc3.

2. Samba NDR RPC Request Multiple Heap-Based Buffer Overflow Vulnerabilit=
ies
BugTraq ID: 23973
Remote: Yes
Date Published: 2007-05-14
Relevant URL: http://www.securityfocus.com/bid/23973
Summary:
Samba is prone to multiple remote heap-based buffer-overflow vulnerabilit=
ies because it fails to properly bounds-check user-supplied data before c=
opying it to an insufficiently sized memory buffer.

An attacker can exploit these issues to execute arbitrary code with super=
user privileges, facilitating the complete remote compromise of affected =
computers. Failed exploit attempts will result in a denial of service.

These issues affect Samba 3.0.25rc3 and prior versions.

3. Samba SID Names Local Privilege Escalation Vulnerability
BugTraq ID: 23974
Remote: No
Date Published: 2007-05-14
Relevant URL: http://www.securityfocus.com/bid/23974
Summary:
Samba is prone to a local privilege-escalation vulnerability due to a log=
ic error in the 'smbd' daemon's internal security stack.

An attacker can exploit this issue to temporarily perform SMB/CIFS operat=
ions with superuser privileges. The attacker may leverage this issue to g=
ain superuser access to the server.

Samba 3.0.23d through 3.0.25pre2 are vulnerable.

4. Linux Kernel 8250 Serial Driver Local Denial of Service Vulnerability
BugTraq ID: 23978
Remote: No
Date Published: 2007-05-14
Relevant URL: http://www.securityfocus.com/bid/23978
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability beca=
use the software fails to handle exceptional conditions.=20

A local attacker can exploit this issue to crash the affected computer, d=
enying service to legitimate users. The attacker may also be able to exec=
ute arbitrary code, but this has not been confirmed.=20

This issue affects kernel versions 2.6 prior to 2.6.20.11.

5. Libpng Library Remote Denial of Service Vulnerability
BugTraq ID: 24000
Remote: Yes
Date Published: 2007-05-15
Relevant URL: http://www.securityfocus.com/bid/24000
Summary:
The 'libpng' library is prone to a remote denial-of-service vulnerability=
 because the library fails to handle malicious PNG files.=20

Successful exploits may allow remote attackers to cause denial-of-service=
 conditions on computers running the affected library.

This issue affects 'libpng' 1.2.16 and prior versions.

6. Computer Associates BrightStor ARCserve Backup CatiRPC.DLL/RWXDR.DLL D=
enial Of Service Vulnerability
BugTraq ID: 24015
Remote: Yes
Date Published: 2007-05-16
Relevant URL: http://www.securityfocus.com/bid/24015
Summary:
Computer Associates BrightStor ARCserve Backup is affected by a denial-of=
-service vulnerability because the application mishandles malformed user-=
supplied input.
=20
A remote attacker may exploit this issue to cause denial-of-service condi=
tions.

This issue affects ARCserver Backup 11.5.2 SP2; other versions may also b=
e vulnerable.

7. Computer Associates BrightStor ARCserve Backup CALoggerD.EXE Denial Of=
 Service Vulnerability
BugTraq ID: 24017
Remote: Yes
Date Published: 2007-05-16
Relevant URL: http://www.securityfocus.com/bid/24017
Summary:
Computer Associates BrightStor ARCserve Backup is affected by a denial-of=
-service vulnerability because the application mishandles unexpected user=
-supplied input.
=20
A remote attacker may exploit this issue to cause denial-of-service condi=
tions.

BrightStor ARCserve Backup 11.5.2.0 is vulnerable; other versions may als=
o be affected.

8. Retired: Libpng Library Grayscale Image CRC Check Remote Denial of Ser=
vice Vulnerability
BugTraq ID: 24023
Remote: Yes
Date Published: 2007-05-16
Relevant URL: http://www.securityfocus.com/bid/24023
Summary:
The libpng library is prone to a remote denial-of-service vulnerability b=
ecause the library fails to handle malicious PNG files.=20

Successful exploits may allow remote attackers to cause denial-of-service=
 conditions on computers running the affected library.

This issue affects libpng-0.90 through libpng-1.2.16.

This BID is being retired because this issue was addressed in BID 24000 (=
https://srcm.symantec.com/LoadDocument.aspx?guid=3Df0d8a8b2-d80a-4180-b2b=
8-bdd00aceb1b6

9. Sun Brocade Switches Denial Of Service Vulnerability
BugTraq ID: 24036
Remote: Yes
Date Published: 2007-05-17
Relevant URL: http://www.securityfocus.com/bid/24036
Summary:
Sun Brocade switches are prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause affected switches to panic an=
d reboot, resulting in denial-of-service conditions.

This issue affects:

- Switches with FOS 5.2.0b and prior
- Switches without FOS 5.0.5c.=20

10. IRCD RatBox Pending Connections Denial Of Service Vulnerability
BugTraq ID: 24044
Remote: Yes
Date Published: 2007-05-18
Relevant URL: http://www.securityfocus.com/bid/24044
Summary:
The 'ircd-ratbox' program is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to deny service to legitimate users.

Versions of ircd-ratbox prior to 2.2.6 are vulnerable.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Security Videos
http://www.securityfocus.com/archive/91/469297

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securi=
tyfocus.com from the subscribed address. The contents of the subject or m=
essage body do not matter. You will receive a confirmation request messag=
e to which you will have to answer. Alternatively you can also visit http=
://www.securityfocus.com/newsletters and unsubscribe via the website.=20

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Cross-Site Scripting Attack"- White Paper=
=20
Cross-site scripting vulnerabilities in web apps allow hackers to comprom=
ise confidential information, steal cookies and create requests that can =
be mistaken for those of a valid user!! Download this *FREE* white paper =
from SPI Dynamics for a complete guide to protection!
=20
https://download.spidynamics.com/1/ad/xss.asp?Campaign_ID=3D70160000000Cq=
BQ