SecurityFocus Linux Newsletter #98

SecurityFocus Linux Newsletter #98
----------------------------------

I. FRONT AND CENTER
     1. Evaluating Network Intrusion Detection Signatures, Part 1
     2. SecurityFocus DPP Program
     3. IIR's 3G Fraud & Security Forum (21-23 October, London)
II. LINUX VULNERABILITY SUMMARY
     1. Cisco VPN Client NETBIOS TCP Packet Denial Of Service...
     2. Cisco VPN Client Password Disclosure Vulnerability
     3. Cisco VPN Client TCP Filter Information Leakage Vulnerability
     4. Cisco VPN Client Distinguished Name Validation Vulnerability
     5. Cisco VPN Client Predictable Sequence Number Vulnerability
     6. SWS Simple Web Server Stack Corruption Vulnerability
     7. Multiple Browser Zero Width GIF Image Memory Corruption...
     8. Ultimate PHP Board Unauthorized Administrative Access...
     9. PHP Header Function Script Injection Vulnerability
     10. phpGB SQL Injection Vulnerability
     11. phpGB PHP Code Injection Vulnerability
     12. PHP Function CRLF Injection Vulnerability
     13. SWS Simple Web Server File Disclosure Vulnerability
     14. phpGB HTML Injection Vulnerability
     15. Netris Remote Memory Corruption Vulnerability
     16. SWS Simple Web Server Non-existent File Request Denial Of...
III. LINUX FOCUS LIST SUMMARY
     1. Openssh and sendmail signatures (Thread)
     2. Strange SSHD Behaviour (Thread)
     3. MD5 checksum's for Redhat 7.3 binaries? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. NetMAX Professional Suite
     2. NetMAX VPN Server Suite
     3. Kerio MailServer
V. NEW TOOLS FOR LINUX PLATFORMS
     1. gateProtect v3.1
     2. video-entropyd v0.1
     3. herbix v1.0-36



I. FRONT AND CENTER
-------------------
1. Evaluating Network Intrusion Detection Signatures, Part 1
By Karen Kent Frederick

This article is the first is a series that will help readers to evaluate
NID signatures. Properly testing NID signatures is a surprisingly complex
topic. This installment will discuss some of the basics of evaluating NID
signature quality, and then look at issues relating to selecting attacks
to be used in testing.

http://online.securityfocus.com/infocus/1623

2. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

3. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space.  This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud?  We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud


II. BUGTRAQ SUMMARY
-------------------
1. Cisco VPN Client NETBIOS TCP Packet Denial Of Service Vulnerability
BugTraq ID: 5649
Remote: Yes
Date Published: Sep 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5649
Summary:

The Cisco VPN Client is software for communicating securely via VPN
(Virtual Private Networks).  It is available for a number of platforms,
including Microsoft Windows, MacOS X, Solaris and Linux.

Cisco VPN Client is reported to be prone to a denial of service condition
upon receipt of NETBIOS TCP packets.  It is possible for a remote attacker
to exploit this condition to shut down a connection that the client has
initiated by sending a NETBIOS packet to port 137 of the host running the
client.

Exploitation of this issue will cause the client to crash.  An attacker
may potentially make a prolonged attack, which will effectively restrict
the ability of the user to make a VPN connection using the client.

2. Cisco VPN Client Password Disclosure Vulnerability
BugTraq ID: 5650
Remote: No
Date Published: Sep 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5650
Summary:

The Cisco VPN Client is software for communicating securely via VPN
(Virtual Private Networks).  It is available for a number of platforms,
including Microsoft Windows, MacOS X, Solaris and Linux.

Cisco has reported that a vulnerability exists in the Windows VPN client
that may result in unintended disclosure of the password.  It is possible
to extract the plaintext password value from a "shaded" (replaced with
asterisks) field in the authentication property page using a utility.
This utility may be the publicly available "Revelation" tool, however this
is unconfirmed.

Exploitation requires local access to the desktop.

3. Cisco VPN Client TCP Filter Information Leakage Vulnerability
BugTraq ID: 5651
Remote: Yes
Date Published: Sep 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5651
Summary:

The Cisco VPN Client is software for communicating securely via VPN
(Virtual Private Networks).  It is available for a number of platforms,
including Microsoft Windows, MacOS X, Solaris and Linux.

Cisco VPN Client, when running in "all tunnel" mode, will acknowledge
packets that originate from outside the tunnel, via the tunnel-assigned IP
address.  This has the potential to leak information about the client
system to attackers.

This issue does not occur if "split tunneling" mode is enabled.
Furthermore, 3.5.x releases of the client are not prone to this issue if
the firewall is configured to run in "always on" mode.  The 3.6(Rel)
version of the client is prone to this issue even under circumstances
where the firewall is run in "always on" mode.

4. Cisco VPN Client Distinguished Name Validation Vulnerability
BugTraq ID: 5652
Remote: Yes
Date Published: Sep 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5652
Summary:

The Cisco VPN Client is software for communicating securely via VPN
(Virtual Private Networks).  It is available for a number of platforms,
including Microsoft Windows, MacOS X, Solaris and Linux.

A problem has been discovered that may allow a man-in-the-middle attack.

A flaw in the Cisco VPN Client prevents the client from sufficiently
validating credentials supplied in a certificate used for VPN privacy.
The client does not properly validate Distinguished Names (DN) contained
in some certificates, and may trust certificates supplied by a third party
that represent a malicious host.  This could result in a third party
gaining a man-in-the-middle position between a VPN client and concentrator
with the ability to monitor traffic in an unencrypted state between the
two entities.

5. Cisco VPN Client Predictable Sequence Number Vulnerability
BugTraq ID: 5653
Remote: Yes
Date Published: Sep 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5653
Summary:

The Cisco VPN Client is software for communicating securely via VPN
(Virtual Private Networks).  It is available for a number of platforms,
including Microsoft Windows, MacOS X, Solaris and Linux.

Cisco has reported that random number generation has been improved in
Cisco VPN Client.  Weak random number generation may present a security
vulnerability to users of the client software, since these random numbers
will be used when VPN sessions are negotiated.

It has not been confirmed, but it may be possible under some circumstances
for attackers to anticipate numbers that are generated by the software.

If an attacker can anticipate sequence numbers for VPN sessions, it may be
possible to mount man-in-the-middle attacks against a connection or
possibly inject packets into a connection.  The attacker may need to be
within the VPN to exploit this issue.

6. SWS Simple Web Server Stack Corruption Vulnerability
BugTraq ID: 5660
Remote: Yes
Date Published: Sep 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5660
Summary:

SWS Simple Web Server is a small web server intended to run on Unix and
Linux operating systems.

SWS Simple Web Server is prone to an error that may result in a denial of
service.  If a recv() call fails, a null word will overwrite the saved
base pointer on the stack.

This is the vulnerable code:

    i = recv(sock, recvBuffer, 4000, 0);
    if (i == -1)  printf("Okuma hatalý...");
      recvBuffer[i] = '\0';

This may cause a crash and access violation after the affected function
returns.  A denial of service may result.

7. Multiple Browser Zero Width GIF Image Memory Corruption Vulnerability
BugTraq ID: 5665
Remote: Yes
Date Published: Sep 06 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5665
Summary:

Multiple web browsers are prone to memory corruption when handling GIF
image files with a width field set to zero.  Browsers reported to be
affected are Netscape, Mozilla and Opera on Linux platforms.  Other
browsers and platforms may also be affected.

It may be possible to exploit this issue to cause a denial of service or
potentially execute arbitrary code.  It is reported that the malformed GIF
may enable an attacker to corrupt the heap with attacker-supplied data,
which may lead to execution of arbitrary code.

As multiple browsers are affected, this vulnerability may be due to a
common issue in a library used to render GIF images (such as libungif).
This possibility has not been confirmed.

8. Ultimate PHP Board Unauthorized Administrative Access Vulnerability
BugTraq ID: 5666
Remote: Yes
Date Published: Sep 06 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5666
Summary:

Ultimate PHP Board is a freely available, open source PHP bulletin board.
It is available for Unix, Linux, and Microsoft Operating Systems.

Ultimate PHP Board does not sufficiently validate whether authenticated
users possess administrative privileges before granting access to some
administrative facilities.

Access is not sufficiently validated for the following administrative
scripts:

admin_members.php, admin_config.php, admin_cat.php, admin_forum.php

Ultimate PHP Board checks that the scripts are being accessed by a user
who is currently logged in, but does not validate the permissions of the
user before allowing access.

Authenticated users may exploit this issue to perform administrative
actions.

9. PHP Header Function Script Injection Vulnerability
BugTraq ID: 5669
Remote: Yes
Date Published: Sep 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5669
Summary:

PHP is a freely available, open source web scripting language package.
It is available for Microsoft Windows, Linux, and Unix operating systems.

A problem with PHP may make it possible to execute arbitrary script code.

It has been reported that a vulnerability in the PHP header function
exists.  It may be possible for a user to supply arbitrary script code in
an URL that would allow the injection of script code into the HTTP header.

In such a scenario, a piece of code using the header function as in the
following example would be vulnerable:

<?php header("Location: $_GET['$url']"); ?>

This problem could lead to the execution of arbitrary script code in the
security context of the redirected site.

10. phpGB SQL Injection Vulnerability
BugTraq ID: 5673
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5673
Summary:

phpGB is a PHP/MySQL based guestbook.  It is available for all operating
systems that support PHP, including Unix, Linux, and Microsoft Windows.

The cause of the issue is that the bulletin board relies on the PHP
magic_quotes_gpc directive to sanitize variables that are used in SQL
queries.

If magic_quotes_gpc is not enabled, then it will be possible for attackers
to mount SQL injection attacks through the guestbook.  Variables will not
be properly sanitized of potentially malicious input, which may allow an
attacker to inject SQL code into variables which will be used to construct
database queries.

It is possible to exploit this issue to modify the logic of SQL queries,
which may allow attackers to corrupt the database.  It is also possible to
exploit this issue to gain administrative guestbook privileges.

11. phpGB PHP Code Injection Vulnerability
BugTraq ID: 5679
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5679
Summary:

phpGB is a PHP/MySQL based guestbook. phpGB is available on all platforms
that support PHP, including Unix, Linux, and Microsoft Windows.

phpGB is subject to a PHP code injection vulnerability.

It is possible to inject code into the guestbook configuration file
(config.php) by supplying malicious parameters for the savesettings.php
script. The configuration file is referenced in most of the other
guestbook scripts, so each time one of the scripts is accessed the
attacker-supplied PHP code will be executed.

It should be noted that normally authentication is required to access the
savesettings.php script, however, the script authenticates by checking
that it was request via a HTTP POST request and does not further
authenticate users.

Injection of improper syntax will result in a denial of service on the
entire guestbook, since this will cause an error to occur when the
configuration file is interpreted.

It is also possible for an attacker to exploit this condition to execute
operating system commands with the privileges of the webserver via PHP
code injection.

12. PHP Function CRLF Injection Vulnerability
BugTraq ID: 5681
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5681
Summary:

PHP is a freely available, open source web scripting language package. It
is available for Microsoft Windows, Linux, and Unix operating systems.

PHP includes a number of functions, such as fopen() and file(), which are
used to reference external resources, such as other PHP files.  If the
allow_url_fopen() PHP directive is enabled, these functions may be used to
access resources that exist on remote hosts by supplying a URL as an
argument to the function.  When these functions are used to reference a
remote resource, PHP constructs a request for the resource using the
appropriate protocol.

A vulnerability has been discovered in PHP which may allow an attacker to
add arbitrary data to headers constructed by PHP when remote resources are
retrieved using these functions.  This may be accomplished by embedding
CRLF (carriage returns/linefeed pairs) in variables included in the URL.
For example, if fopen() is called with an include_path to a remote web
server, then a HTTP GET request will be constructed to access the remote
resource.  It is possible, by injecting CRLFs into parameters of a
vulnerable script, to add arbitrary header information (such as the Host:
field, cookies, etc) to the request that is constructed by PHP.

This input validation condition may allow for a number of attacks.  For
example, attackers may modify the Host: field.  This may theoretically
result in a file other than that expected being included in a PHP script.
Furthermore, under some circumstances it is possible to trick the PHP
interpreter into connecting to an arbitrary port and transmitting
commands.  This was demonstrated by the individual who reported this
issue.

13. SWS Simple Web Server File Disclosure Vulnerability
BugTraq ID: 5662
Remote: Yes
Date Published: Sep 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5662
Summary:
SWS Simple Web Server is a small web server intended to run on Unix and Linux

operating systems.

A directory traversal bug exists in SWS Web Server.

By appending dot-dot-slash sequences (../) in a request to the web server,
an attacker has the ability to view arbitrary webserver readable files.
This is due to the server insufficiently validating the user supplied
input.

It should be noted that the web server does not drop privileges, so this
may result in disclosure of arbitrary system files.

14. phpGB HTML Injection Vulnerability
BugTraq ID: 5676
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5676
Summary:

phpGB is a PHP/MySQL based guestbook.  phpGB is available on all platforms
that support PHP, including Unix, Linux, and Windows.

phpGB fails to check for the presence of HTML tags when generating
guestbook entries.  It is reported that an attacker may inject HTML and
script code into guestbook entries, which will be executed in the web
client of the administrative guestbook user when the admin attempts to
delete the entry.

This issue may be exploited to obtain sensitive information such as the
session ID of the guestbook administrator.

15. Netris Remote Memory Corruption Vulnerability
BugTraq ID: 5680
Remote: Yes
Date Published: Sep 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5680
Summary:

Netris is a freely available network "Tetris" clone.  It is available for
Unix and Linux variants.

Netris is prone to a remotely exploitable memory corruption issue.  An
attacker may exploit this to cause a denial of service to occur.  It may
also be possible to cause memory to be corrupted with attacker-supplied
data, which may result in execution of arbitrary code with the privileges
of the user running the program.  The possibility of code execution has
not been confirmed.

16. SWS Simple Web Server Non-existent File Request Denial Of Service Vulnerability
BugTraq ID: 5659
Remote: Yes
Date Published: Sep 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5659
Summary:

SWS Web Server is a small web server intended to run on Unix and Linux
operating systems.

SWS Simple Web Server is prone to a denial of service when repeated
requests for non-existent resources are made.  Reportedly, the source of
this issue is a failure of the software to close the file descriptor used
when an error message is sent to a client.  An error page is served for
the first request for a non-existent webpage, but subsequent requests will
cause the server to crash.

The web server must be restarted to regain normal functionality.

Remote attackers may exploit this condition to deny access to legitimate
users of the web server.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Openssh and sendmail signatures (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291557

2. Strange SSHD Behaviour (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291455

3. MD5 checksum's for Redhat 7.3 binaries? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291342


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. NetMAX Professional Suite
by Cybernet Systems
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Relevant URL:
http://www.netmax.com/products/pro_prods.html
Summary:

NetMAX Professional Suite provides a complete set of networking tools,
integrating NetMAX's FireWall ProSuite, Internet Server ProSuite, and
FileServer Suite (Linux) or FireWall, WebServer, and FileServer (FreeBSD)
into one comprehensive Internet appliance package. Our Professional Suite
enables you to use the power and reliability of either Linux or FreeBSD as
well as popular applications such as Apache, Sendmail, and Samba which are
integrated into this product. The browser-based interface helps you to
quickly and easily configure and manage the required network services,
freeing network administrators from routine tasks.

2. NetMAX VPN Server Suite
by Cybernet Systems
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Relevant URL:
http://www.netmax.com/products/vpn_prods.html
Summary:

The NetMAX VPN Server Suite simplifies Linux servers by installing a
ready-to-configure network security solution consisting of a Virtual
Private Network (VPN) server, firewall, router, and proxy/cache server,
along with the Linux operating system. NetMAX Internet Appliance Software
provides small/medium sized businesses and enterprise workgroups easy use
of a browser-based administration and pre-configured suite of
applications, along with the strength and reliability of Linux.

3. Kerio MailServer
by Kerio Technologies Inc.
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL:
http://www.kerio.com/us/kms_home.html
Summary:

Kerio MailServer represents a new generation of mail servers designed for
corporate networks. To help combat increasing security threats, Kerio
MailServer offers a wide range of features to keep email from being
intercepted, infected by computer viruses, or sent as spam


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. gateProtect v3.1
by Till von Rennenkampff
Relevant URL:
http://www.gateprotect.com/
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

The firewall product line of gateProtect's high security systems enables
companies to completely secure their corporate networks against internal
and external attacks. gateProtect includes features to protect data from
Internet-based security risks, espionage, and virus attacks. Through the
use of an intrusion detection system, attacks are detected, prevented, and
located. gateProtect's all-in-one firewall products feature very easy
usage combined with a maximum of power, speed and security. The whole
firewall can be easily configured through a graphical interface with drag
& drop support. gateProtect's firewall software requires its own dedicated
PC to run.

2. video-entropyd v0.1
by Folkert van Heusden
Relevant URL:
http://www.vanheusden.com/ved/
Platforms: Linux, POSIX
Summary:

video-entropyd is a program to add entropy data from video4linux devices
to the kernel random driver.

3. herbix v1.0-36
by herbi
Relevant URL:
http://cuodan.net/~sina
Platforms: Linux, POSIX
Summary:

Herbix is a Linux server that fits on a floppy. It supports ipchains and
can serve FTP, HTTP, IRC, DHCP, SMTP, and IDENT.