SecurityFocus Linux Newsletter #99

Stephen Entwisle <[email protected]> Mon, 23 Sep 2002 11:16:26 -0600 (MDT)

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #99
----------------------------------

This Issue is Sponsored by: SPI Dynamics

ALERT! - Cross-site scripting vulnerabilities in web applications allow
hackers to compromise confidential information, manipulate or steal
cookies, and create requests that can be mistaken for those of a valid
user!! All via port 80 and 443! Download this *FREE* white paper from SPI
Dynamics for a complete guide to protection!

Please visit us at: http://www.spidynamics.com/mktg/xss1/

-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Detecting and Removing Trojans and Malicious Code from Win2K
2. Who Goes There? An Introduction to On-Access Virus Scanning...
3. Slapped Silly
4. Privacy Losses Around the World
5. A Cybersecurity Sleeping Pill
6. Hackback or the High Road? The question goes beyond Nimda
6. SecurityFocus DPP Program
7. IIR's 3G Fraud & Security Forum
II. LINUX VULNERABILITY SUMMARY
1. Xbreaky File Corruption Vulnerability
2. Trend Micro InterScan VirusWall HTTP 1.1 Transfer-Encoding...
3. Purity Local Buffer Overflow Vulnerabilities
4. BubbleMon Kernel Memory File Descriptor Leakage Vulnerability
5. ASMon Kernel Memory File Descriptor Leakage Vulnerability
6. KDE Konqueror Oversized Image Width Denial of Service...
7. BRU XBRU Insecure Temporary File Vulnerability
8. ASCPU Kernel Memory File Descriptor Leakage Vulnerability
9. DB4Web File Disclosure Vulnerability
10. Opera Oversized Image Width Denial Of Service Vulnerability
11. WMMon Memory Character File Open File Descriptor Read...
12. WMNet2 Kernel Memory File Descriptor Leakage Vulnerability
13. Joe Text Editor Backup SetUID Executable Editing Permission...
14. DB4Web Connection Proxy Vulnerability
15. Heimdal Kerberos Forwarding Daemon File Overwriting Vulnerability
16. Heimdal Kerberos Forwarding Daemon Zero Terminated String...
III. LINUX FOCUS LIST SUMMARY
1. route add to block IP's (Thread)
2. OpenSSL worm (Thread)
3. Openssh and sendmail signatures (Thread)
4. MD5 checksum's for Redhat 7.3 binaries? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. PureSecure
2. Hardlock
3. SMART Extractor
V. NEW TOOLS FOR LINUX PLATFORMS
1. the Anomy mail sanitizer v1.54
2. nefu v0.8.2
3. Netwatch
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. Detecting and Removing Trojans and Malicious Code from Win2K
By H. Carvey

The amount of malicious code directed at Windows systems seems to be
increasing on a continual curve The purpose of this article is to
recommend steps that an administrator can use to determine whether or not
a Win2K system has been infected with malicious code or "malware" and, if
so, to remove it.

http://online.securityfocus.com/infocus/1627

2. Who Goes There? An Introduction to On-Access Virus Scanning, Part Two
by Bill Hayes

By now, most savvy computer users have anti-virus software (AV) installed
on their machines and use it as part of their regular computing routine.
However, most average users do not know how anti-virus software works.
This article is the second in a two-part series that will offer a brief
overview of a particular type of anti-virus technique known as on-access
scanning.

http://online.securityfocus.com/infocus/1626

3. Slapped Silly
By Jon Lasser

Lessons I learned from falling prey to the latest Linux virus ...

http://online.securityfocus.com/

4. Privacy Losses Around the World
By David Banisar

It has now been one year since the horrific events of September 11th,
2001. It is often said that "everything has changed." That includes
privacy, and the changes are not limited to the United States.

http://online.securityfocus.com/columnists/108

5. A Cybersecurity Sleeping Pill
By George Smith

From a White House given to dramatic warnings of electronic Pearl Harbors
comes an incongruously meek national strategy. Did industry lobbyists slip
someone a Mickey?

http://online.securityfocus.com/columnists/110

6. Hackback or the High Road? The question goes beyond Nimda

A SecurityFocus Guest Feature by Markus DeShon, Ph.D.

http://online.securityfocus.com/guest/16531

7. SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

8. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud

II. BUGTRAQ SUMMARY
-------------------
1. Xbreaky File Corruption Vulnerability
BugTraq ID: 5700
Remote: No
Date Published: Sep 12 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5700
Summary:

xbreaky is a breakout game for X Windows. It is available for most Unix
and Linux variants and is included in the ports collection of some BSD
operating systems.

The xbreaky game is prone to symbolic link attacks, which may allow local
attackers to corrupt arbitrary system files.

When xbreaky writes to the high score file, it will follow any symbolic
links. Since xbreaky is installed setuid root by default, an attacker
could create a symbolic link to an arbitrary file and then when the
highscore file is written to, the file pointed to by the symbolic link
will also be written to. The high score file (.breakyhighscores) is
stored in the home directory of the user who runs the game.

There may be some possibility of exploiting this condition to elevate
privileges, if the attacker causes system files to be corrupted with
custom data. Otherwise, file corruption may result in a denial of
service.

2. Trend Micro InterScan VirusWall HTTP 1.1 Transfer-Encoding Bypass Vulnerability
BugTraq ID: 5697
Remote: Yes
Date Published: Sep 12 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5697
Summary:

Trend Micro InterScan VirusWall is a internet gateway virus scanning
package. It is capable of scanning incoming content over HTTP, SMTP and
FTP for viruses and other malicious code.

A vulnerablity has been discovered, in some versions of VirusWall, that
allows specially encoded data to bypass security measures.

The HTTP 1.1 protocol specifies a method of data encoding called 'Chunked
Transfer-Encoding', designed to facilitate fragmentation of HTTP requests
in transit. InterScan VirusWall does not support HTTP 1.1
Transfer-Encoding, allowing malicious files transferred using this method,
to bypass scanning procedures.

3. Purity Local Buffer Overflow Vulnerabilities
BugTraq ID: 5702
Remote: No
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5702
Summary:

Purity is an automated version of the purity test. It will run on most
Unix and Linux variants and ships with Debian.

Purity is reported to be prone to a number of buffer overflows, making it
possible for local attackers to corrupt memory with attacker-supplied
data. As a result, it is possible for an attacker to execute arbitrary
code. This issue is due to insufficient bounds checking of input supplied
via the command line when the program is invoked.

The game is installed setgid, and successful exploitation of these issues
may allow for elevation of privileges. In most installations the program
is owned by the games group.

4. BubbleMon Kernel Memory File Descriptor Leakage Vulnerability
BugTraq ID: 5714
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5714
Summary:

BubbleMon is a freely available, open source system monitoring application
for the Gnome desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that BubbleMon is vulnerable to a leakage of open
file descriptors that may result in unauthorized disclosure of kernel
memory. It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through BubbleMon. The program that is executed can be specified by the
attacker at the command line.

Upon exploiting this vulnerability, an attacker would have read-access to
kernel memory. The attacker could use this access to gain sensitive
information such as passwords, or other information. It should be assumed
that total compromise is imminent if an attacker has read access to kernel
memory.

5. ASMon Kernel Memory File Descriptor Leakage Vulnerability
BugTraq ID: 5720
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5720
Summary:

asmon is a freely available, open source system monitoring application for
the AfterStep desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that asmon is vulnerable to a leakage of open file
descriptors that may result in unauthorized disclosure of kernel memory.
It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through asmon. The program that is executed can be specified by the
attacker at the command line.

6. KDE Konqueror Oversized Image Width Denial of Service Vulnerability
BugTraq ID: 5721
Remote: Yes
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5721
Summary:

Konqueror is an Open Source web browser, shipped with the KDE desktop. It
is available on Linux platforms.

It has been reported that Konqueror is prone to a denial of service
vulnerability when processing overly wide images.

When Konqueror attempts to process a valid image containing a reported
width of 32759 pixels, the condition is triggered, causing Konqueror to
temporarily consume system resources and then crash.

This vulnerability may result in memory corruption. If memory can be
corrupted with attacker-supplied data, then it may be possible to execute
arbitrary code within the context of the client.

The problem reportedly exists on Mandrake 8.2 running KDE 3.0.2 Although
unconfirmed, it likely exists on all systems running KDE 3.0.2

7. BRU XBRU Insecure Temporary File Vulnerability
BugTraq ID: 5708
Remote: No
Date Published: Sep 13 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5708
Summary:

BRU is a backup and restore utility distributed by The Tolis Group. This
problem affects the utility on the Linux platform.

Under some circumstances, it may be possible for a local user to gain
elevated privileges.

xbru does not properly check for the existence of temporary files prior to
execution. Because of this, it is possible for a local user to create
symbolic links to other files, which will be overwritten by the BRU user.
As BRU is typically run by the root user, this could result in the
overwriting of root-owned files.

It is possible that this vulnerability could be exploited to execute
arbitrary commands. This problem could also be exploited to overwrite
critical system files, such as the passwd file. In this situation, it
would be possible for a local user to gain administrative access if
successfully exploited.

8. ASCPU Kernel Memory File Descriptor Leakage Vulnerability
BugTraq ID: 5716
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5716
Summary:

ascpu is a freely available, open source system monitoring application for
the AfterStep desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that ascpu is vulnerable to a leakage of open file
descriptors that may result in unauthorized disclosure of kernel memory.
It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through ascpu. The program that is executed can be specified by the
attacker at the command line.

9. DB4Web File Disclosure Vulnerability
BugTraq ID: 5723
Remote: Yes
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5723
Summary:

DB4Web is an application server that allows read and write access to
relational databases and other information sources, via the web. The
application is available for Windows, Linux, and various Unix platforms.

A directory traversal bug exists in DB4Web.

By passing a maliciously crafted query to the application, such as encoded
"dot-dot" sequences (../), an attacker can potentially gain access to
arbitrary system files. This is due to the application insufficiently
validating the user supplied input.

An attacker can access the DB4Web application binary via the 'cgi-bin'
directory on Unix and Linux servers, or the 'scripts' directory on windows
servers.

10. Opera Oversized Image Width Denial Of Service Vulnerability
BugTraq ID: 5717
Remote: Yes
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5717
Summary:

Opera is a web browser created by Opera Software. It is available for a
range of operating systems including Windows and Linux.

It has been reported that Opera is prone to a denial of service
vulnerability, when processing overly wide images.

When Opera attempts to process a valid image containing a width of 32759
pixels, the condition is triggered, causing Opera to crash.

This vulnerability may result in memory corruption. If memory can be
corrupted with attacker-supplied data, then it may be possible to execute
arbitrary code within the context of the client.

Although not confirmed, it has been reported that this may actually be a
bug in QImage, which Opera uses to display image files.

This issue was reported in Opera on Linux platforms. Other versions may
also be affected.

11. WMMon Memory Character File Open File Descriptor Read Vulnerability
BugTraq ID: 5718
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5718
Summary:

wmmon is a freely available, open source system monitoring application for
the WindowMaker desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that wmmon is vulnerable to a leakage of open file
descriptors that may result in unauthorized disclosure of kernel memory.
It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through wmmon. The program that is executed can be specified by the
attacker at the command line.

12. WMNet2 Kernel Memory File Descriptor Leakage Vulnerability
BugTraq ID: 5719
Remote: No
Date Published: Sep 16 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5719
Summary:

wmnet2 is a freely available, open source system monitoring application
for the WindowMaker desktop. It is available for Unix and Linux operating
systems. On FreeBSD it is installed setgid mem/kmem by default.

It has been reported that wmnet2 is vulnerable to a leakage of open file
descriptors that may result in unauthorized disclosure of kernel memory.
It is allegedly possible for attackers to inherit the open file
descriptors for /dev/mem and /dev/kmem by executing a malicious program
through wmnet2. The program that is executed can be specified by the
attacker at the command line.

13. Joe Text Editor Backup SetUID Executable Editing Permission Elevation Vulnerability
BugTraq ID: 5732
Remote: No
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5732
Summary:

Joe is a freely available, open source text editor. It is available for
Unix and Linux operating systems.

A problem with Joe could make it possible for local users to gain elevated
privileges.

When joe is used to edit a file, joe automatically creates a backup of the
file with the name filename~ where filename represents the name of the
file being edited.

When joe is used to edit a setuid file, joe automatically creates a copy
of the setuid file. The permissions on the file are preserved with the
exception of ownership. This could result in an arbitrary copy of a
setuid file being created with the permissions of the joe user.

It should be noted that this vulnerability is limited in it's application,
as it would require social engineering, and the editing of a setuid file
by either a privileged user, or a user in a world-writeable directory.

14. DB4Web Connection Proxy Vulnerability
BugTraq ID: 5725
Remote: Yes
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5725
Summary:

By requesting a specially crafted URL, it is possible to initiate a TCP
connect from the vulnerable server to a remote IP address and arbitrary
port.

The application will send TCP SYN requests which will produce information
displayed in a debug error page. Information displayed such as "connect()
ok" or "connect() failed: Connection refused", can be used to determine
port status information on the specified host.

15. Heimdal Kerberos Forwarding Daemon File Overwriting Vulnerability
BugTraq ID: 5729
Remote: Yes
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5729
Summary:

Heimdal Kerberos is an implementation of the Kerberos protocol distributed
and maintained by the Center for Parallel Computers, KTH. It is open
source, and available for Unix and Linux operating systems.

A problem with the implementation could make it possible for remote users
to overwrite files on a vulnerable system.

The Heimdal Kerberos Forwarding Daemon does not properly protect some
information sent from a client to a server. Because of this, it may be
possible to overwrite files accessible via the authenticated user's id.
This could result in a denial of service, or potential loss of data.

It should be noted that this vulnerability may be exploited to overwrite
files that are write-accessible by the victim.

No further details are known at this time.

16. Heimdal Kerberos Forwarding Daemon Zero Terminated String Passing Buffer Overflow Vulnerability
BugTraq ID: 5731
Remote: Yes
Date Published: Sep 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5731
Summary:

A problem with the implementation could make it possible for remote users
to launch remote buffer overflow attacks.

The Heimdal Kerberos Forwarding Daemon does not properly check information
sent from a client to a server for the termination of strings. As this
information is often passed to additional programs that may be executed
with elevated privileges, it could be possible to exploit a buffer
overflow in one of these programs.

This could lead to the execution of arbitrary code with elevated
privileges, and potential compromise of administrative access.

IV. LINUX FOCUS LIST SUMMARY
---------------------------------
1. route add to block IP's (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/292321

2. OpenSSL worm (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291794

3. Openssh and sendmail signatures (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291787

4. MD5 checksum's for Redhat 7.3 binaries? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/291785

IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. PureSecure
by Demarc Security
Platforms: Linux, POSIX, Solaris, SunOS, UNIX, Windows 2000, Windows
95/98, Windows NT, Windows XP
Relevant URL:
http://www.demarc.com/products/puresecure/
Summary:

Demarc PureSecure is a Total Intrusion Detection System (TIDS), which
provides an unsurpassed level of comprehensive security. For the first
time you will be able to reliably prevent, detect, and deter internal and
external threats to your organization's valuable assets with complete
confidence, 24 hours a day. Advanced cross platform compatible technology
means PureSecure can be deployed and scale in a wide variety of network
infrastructures.

2. Hardlock
by Aladdin Knowledge Systems
Platforms: Propietary Hardware
Relevant URL:
http://www.ealaddin.com/hardlock/index.asp
Summary:

If you develop applications for multiple operating environments, we invite
you to test drive the new HASP4, the latest generation in software
protection solutions. HASP4 is the only true cross-platform solution
available on the market, providing a solid foundation of reliability,
ease-of-use and state-of-the-art security. With HASP4 USB, a single key
will protect Windows, Mac and Linux applications.

3. SMART Extractor
by WetStone Technologies
Platforms: Linux
Relevant URL:
http://www.wetstonetech.com/extractor.html
Summary:

WetStone Technologies, SM&A, the Computer Forensics Research and
Development Center (CFRDC), and the New York State Police Forensic
Investigation Center (NYSPFIC) have developed the Extractor, a Linux
RedHat® deleted file recovery tool. The technology can assist law
enforcement, government and commercial organizations in retrieving
maliciously or accidentally deleted files within the increasingly poplular
Linux operating system environment.

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. the Anomy mail sanitizer v1.54
by Juggler
Relevant URL:
http://mailtools.anomy.net/
Platforms: POSIX
Summary:

The Anomy mail sanitizer is a filter designed to block email-based
security risks, such as trojans and viruses. It can scan an arbitrarily
complex RFC822 or MIME message and remove or rename attachments, truncate
unusually long MIME header fields and sanitize HTML by disabling
Javascript, etc. It uses a single-pass pure Perl MIME parser, which can
make it both more efficient and more precise than other similar programs.
The sanitizer has built-in support for third-party virus scanners.

2. nefu v0.8.2
by UMich RSUG
Relevant URL:
http://rsug.itd.umich.edu/software/nefu/
Platforms: FreeBSD, Linux, MacOS, OpenBSD, Solaris, SunOS, UNIX
Summary:

nefu (network fidelity utility) is a Unix daemon that monitors services
over the network. It uses a "no false alarms" fault verification
algorithm, and understands network dependancies. Natively-monitored
protocols include ICMP echo (ping), DNS, HTTP, POP, NTP, IMAP, SMTP, and
LDAP, as well as having facilities to execute external programs. Status
pages are available via finger or the Web.

3. Netwatch
by Gordon MacKay
Relevant URL:
http://online.securityfocus.com/tools/198
Platforms: Linux
Summary:

Netwatch is a Linux program created to aid in monitoring Network
Connections. It is based on a program called "statnet" but has been
substantially modified for its Ethernet emphasis. It is a dynamic program
which displays the Ethernet status based each the connection's activity.
It has the capability of monitoring hundreds of site statistics
simultaneously. The connection's port number (Well Known Service) and
destination address are available as well. There are options which allow
router statistics to be measured on simple networks (with one router).
External network communication is counted and transfer rates are
displayed.

VI. SPONSORSHIP INFORMATION
---------------------------
This Issue is Sponsored by: SPI Dynamics

Please visit us at: http://www.spidynamics.com/mktg/xss1/

-------------------------------------------------------------------------------