SecurityFocus Linux Newsletter #354

SecurityFocus Linux Newsletter #354
----------------------------------------

This Issue is Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!=
" - White Paper
Blind SQL Injection can deliver total control of your server to a hacker =
giving them the ability to read, write and manipulate all data stored in =
your backend systems! Download this *FREE* white paper from SPI Dynamics =
for a complete guide to protection!
https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=3D70160000000D2=
bp


SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I.   FRONT AND CENTER
       1. VoIP Hopping: A Method of Testing VoIP security or Voice VLANs
       2. Mod Your iPhone - For Fun or Profit?
II.  LINUX VULNERABILITY SUMMARY
       1. MIT Kerberos 5 kadmind Server Uninitialized Pointer Remote Code=
 Execution Vulnerability
       2. MIT Kerberos 5 KAdminD Server SVCAuth_GSS_Validate Stack Buffer=
 Overflow Vulnerability
       3. Red Hat Advanced Intrusion Detection Environment Checksum Datab=
ase Weakness
       4. Alien Arena 2007 Multiple Remote Vulnerabilities
       5. debian-goodies Checkrestart Script Local Privilege Escalation V=
ulnerability
       6. Gforge Unspecified SQL Injection Vulnerability
       7. X.Org X Server Composite Extension Local Buffer Overflow Vulner=
ability
       8. QGit DataLoader::doStart Function Local Privilege Escalation Vu=
lnerability
       9. RealPlayer/HelixPlayer AU Divide-By-Zero Denial of Service Vuln=
erability
       10. OpenSSH X11 Cookie Local Authentication Bypass Vulnerability
       11. Quagga Routing Suite Multiple Denial Of Service Vulnerabilitie=
s
III. LINUX FOCUS LIST SUMMARY
       1. mail antivirus
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1.VoIP Hopping: A Method of Testing VoIP security or Voice VLANs
By Jason Ostrom and John Kindervag
Testing Protection Controls on a VoIP Network - A Case Study and Method
http://www.securityfocus.com/infocus/1892

2. Mod Your iPhone - For Fun or Profit?
By Mark Rasch
I admit it: I own an iPhone. Indeed, I bought one the day they came out. =
No, I didn't wait in line for hours; I just walked into the local Apple s=
tore, plunked down my life's savings, and voila, another AT&T customer!
http://www.securityfocus.com/columnists/453


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. MIT Kerberos 5 kadmind Server Uninitialized Pointer Remote Code Execut=
ion Vulnerability
BugTraq ID: 25533
Remote: Yes
Date Published: 2007-09-04
Relevant URL: http://www.securityfocus.com/bid/25533
Summary:
Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is prone to =
a remote code-execution vulnerability because of an uninitialized pointer=
.

An authenticated attacker can exploit this issue to execute arbitrary cod=
e with superuser privileges. Successful exploits will completely compromi=
se affected computers. Failed attacks will cause denial-of-service condit=
ions.

All 'kadmind' servers run on  the master Kerberos server. Since the maste=
r server holds the KDC principal  and policy database, an attack may not =
only compromise the affected computer,  but could also compromise multipl=
e hosts that use the server for  authentication.

Kerberos 5 'kadmind' 1.5 through 1.6.2 are vulnerable.

2. MIT Kerberos 5 KAdminD Server SVCAuth_GSS_Validate Stack Buffer Overfl=
ow Vulnerability
BugTraq ID: 25534
Remote: Yes
Date Published: 2007-09-04
Relevant URL: http://www.securityfocus.com/bid/25534
Summary:
Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is prone to =
a stack-based buffer-overflow vulnerability because the software fails to=
 adequately bounds-check user-supplied data before copying it to an insuf=
ficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code with superus=
er privileges. A successful attack can result in the complete compromise =
of the application. Failed attempts will likely result in denial-of-servi=
ce conditions.

All 'kadmind' servers run on  the master Kerberos server. Since the maste=
r server holds the KDC principal  and policy database, an attack may not =
only compromise the affected computer,  but could also compromise multipl=
e hosts that use the server for  authentication.

Kerberos 5 'kadmind' 1.4 through 1.6.2 are vulnerable; third-party applic=
ations using the affected RPC library are also affected.

3. Red Hat Advanced Intrusion Detection Environment Checksum Database Wea=
kness
BugTraq ID: 25542
Remote: No
Date Published: 2007-09-04
Relevant URL: http://www.securityfocus.com/bid/25542
Summary:
Red Hat Advanced Intrusion Detection Environment (AIDE) is prone to a des=
ign weakness because its database does not contain checksums for files.

An attacker may exploit this issue to evade AIDE file-modification checks=
, which may lead to other attacks.
   =20
This issue is due to an RPM packaging error on Red Hat systems. Other imp=
lementations of AIDE may also be affected, but Symantec has not confirmed=
 this.

Versions prior to AIDE 0.13.1 on Red Hat Enterprise Linux 5 server and cl=
ient are vulnerable.

4. Alien Arena 2007 Multiple Remote Vulnerabilities
BugTraq ID: 25559
Remote: Yes
Date Published: 2007-09-05
Relevant URL: http://www.securityfocus.com/bid/25559
Summary:
Alien Arena 2007 is prone to multiple remote vulnerabilities, including a=
 denial-of-service vulnerability and a format-string vulnerability.=20

Successfully exploiting these issues will allow an attacker to execute ar=
bitrary code within the context of the affected application or to disconn=
ect users from the game server.

Alien Arena 2007 6.10 is vulnerable; other versions may also be affected.

5. debian-goodies Checkrestart Script Local Privilege Escalation Vulnerab=
ility
BugTraq ID: 25569
Remote: No
Date Published: 2007-09-06
Relevant URL: http://www.securityfocus.com/bid/25569
Summary:
The 'checkrestart' utility in the 'debian-goodies' package is prone to a =
local privilege-escalation vulnerability because the application fails to=
 sufficiently validate user-supplied data.=20

An attacker can exploit this issue to execute arbitrary commands with sup=
eruser privileges. Successfully exploiting this issue will result in the =
complete compromise of affected computers.

This issue affects  versions prior to debian-goodies 0.34.

6. Gforge Unspecified SQL Injection Vulnerability
BugTraq ID: 25585
Remote: Yes
Date Published: 2007-09-06
Relevant URL: http://www.securityfocus.com/bid/25585
Summary:
Gforge is prone to an unspecified SQL-injection vulnerability because it =
fails to sufficiently sanitize user-supplied data before using it in an S=
QL query.

Exploiting this issue could allow an attacker to compromise the applicati=
on, access or modify data, or exploit latent vulnerabilities in the under=
lying database.

Gforge 3.1 is vulnerable; other versions may also be affected.

7. X.Org X Server Composite Extension Local Buffer Overflow Vulnerability
BugTraq ID: 25606
Remote: No
Date Published: 2007-09-06
Relevant URL: http://www.securityfocus.com/bid/25606
Summary:
The X.Org X Window System is prone to a local buffer-overflow vulnerabili=
ty.

A local attacker can exploit this issue to execute arbitrary code with el=
evated privileges. This may facilitate a compromise of the affected compu=
ter.

8. QGit DataLoader::doStart Function Local Privilege Escalation Vulnerabi=
lity
BugTraq ID: 25618
Remote: No
Date Published: 2007-09-10
Relevant URL: http://www.securityfocus.com/bid/25618
Summary:
QGit is prone to a local privilege-escalation vulnerability because the a=
pplication handles temporary files in an insecure manner.

An attacker can exploit this issue overwrite files and to execute arbitra=
ry code with superuser privileges. Successfully exploiting this issue wil=
l result in the complete compromise of affected computers.

Versions prior to QGit 1.5.7 are vulnerable.

9. RealPlayer/HelixPlayer AU Divide-By-Zero Denial of Service Vulnerabili=
ty
BugTraq ID: 25627
Remote: Yes
Date Published: 2007-09-11
Relevant URL: http://www.securityfocus.com/bid/25627
Summary:
RealPlayer and Helix Player are  prone to a denial-of-service vulnerabili=
ty when handling malformed AU media files.

Successfully exploiting this issue allows remote attackers to deny servic=
e to legitimate users.

10. OpenSSH X11 Cookie Local Authentication Bypass Vulnerability
BugTraq ID: 25628
Remote: No
Date Published: 2007-09-04
Relevant URL: http://www.securityfocus.com/bid/25628
Summary:
OpenSSH is prone to a local authentication-bypass vulnerability because t=
he software fails to properly manage trusted and untrusted X11 cookies.

Successfully exploiting this issue allows local attackers to potentially =
launch a forwarded X11 session through SSH in an unauthorized manner. Fur=
ther details are currently unavailable. We will update this BID as more i=
nformation emerges.

This issue affects OpenSSH 4.6; previous versions  may be affected as wel=
l.

11. Quagga Routing Suite Multiple Denial Of Service Vulnerabilities
BugTraq ID: 25634
Remote: Yes
Date Published: 2007-09-11
Relevant URL: http://www.securityfocus.com/bid/25634
Summary:
Quagga Routing Suite is prone to a multiple denial-of-service vulnerabili=
ties.

An attacker can exploit these issues to crash the affected application, d=
enying service to legitimate users.

These issues affect versions prior to Quagga Routing Suite 0.99.9.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. mail antivirus
http://www.securityfocus.com/archive/91/477433

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securi=
tyfocus.com from the subscribed address. The contents of the subject or m=
essage body do not matter. You will receive a confirmation request messag=
e to which you will have to answer. Alternatively you can also visit http=
://www.securityfocus.com/newsletters and unsubscribe via the website.=20

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: SPI Dynamics

ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!=
" - White Paper
Blind SQL Injection can deliver total control of your server to a hacker =
giving them the ability to read, write and manipulate all data stored in =
your backend systems! Download this *FREE* white paper from SPI Dynamics =
for a complete guide to protection!
https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=3D70160000000D2=
bp