SecurityFocus Linux Newsletter #403

SecurityFocus Linux Newsletter #403
----------------------------------------

This issue is sponsored by Sponsored by Ironkey: The World's Most Secure =
Flash Drive

You can now initiate and utilize IronKey flash drives on Linux operating =
systems based on kernel 2.6 and above.
IronKey uses military-grade AES hardware encryption and provides rugged a=
nd waterproof protection to safeguard your data.
https://www.ironkey.com/forenterprise2



SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I.   FRONT AND CENTER
       1.Get Off My Cloud
       2.An Astonishing Collaboration
II.  LINUX VULNERABILITY SUMMARY
       1. RETIRED: mktemp Predictable Temporary Filename Vulnerability
       2. Linux Kernel 'dccp_setsockopt_change()' Remote Denial of Servic=
e Vulnerability
       3. VLC Media Player 'demux\tta.c' TTA File Handling Buffer Overflo=
w Vulnerability
       4. EchoVNC Remote Buffer Overflow Vulnerability
       5. libxml2 Recursive Entity Remote Denial of Service Vulnerability
       6. Red Hat OpenSSH Backdoor Vulnerability
       7. Vim Insufficient Shell Escaping Multiple Command Execution Vuln=
erabilities
       8. VLC Media Player 'mmstu.c' MMS Protocol Handling Buffer Overflo=
w Vulnerability
       9. GPicView Multiple Local Security Vulnerabilities
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1.Get Off My Cloud
By Mark Rasch
One of the features of Apple's device that appeals to me is the new Mobil=
eMe service, where you can "access and manage your email, contacts, calen=
dar, photos, and files at me.com," according to Apple.=20
More companies, among them Microsoft and Google, already allow people to =
store information and use common services online -- or "in the cloud" -- =
leading analysts to refer to the entire trend as "cloud computing."
http://www.securityfocus.com/columnists/478

2.An Astonishing Collaboration
By Dan Kaminsky
Wow. It's out. It's finally, finally out. Sweet!
http://www.securityfocus.com/columnists/477


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. RETIRED: mktemp Predictable Temporary Filename Vulnerability
BugTraq ID: 30701
Remote: No
Date Published: 2008-08-15
Relevant URL: http://www.securityfocus.com/bid/30701
Summary:
mktemp may create temporary files with names based on the current process=
 ID. An attacker with local access could potentially exploit this issue t=
o perform symbolic-link attacks, overwriting arbitrary files in the conte=
xt of the affected application. Attackers may be able to gain elevated pr=
ivileges.

This vulnerability exists in Todd Miller's mktemp 1.5; other versions may=
 also be vulnerable. GNU coreutils mktemp is not currently believed to be=
 vulnerable.

Update 18/08/2008: This issue is retired, as the temporary file is create=
d with 'O_EXCL'; as a result this issue is not exploitable. Attacks may b=
e possible when mktemp is called with the '-u' option, however this is do=
cumented as an unsafe mode. Any exploitable use of this script would be a=
 vulnerability in 3rd party scripts, not in 'mktemp' itself.

2. Linux Kernel 'dccp_setsockopt_change()' Remote Denial of Service Vulne=
rability
BugTraq ID: 30704
Remote: Yes
Date Published: 2008-08-15
Relevant URL: http://www.securityfocus.com/bid/30704
Summary:
The Linux kernel is prone to a remote denial-of-service vulnerability bec=
ause it fails to properly handle user-supplied input.

Attackers can exploit this issue to cause a kernel panic, denying service=
 to legitimate users.=20

Versions since Linux kernel 2.6.17-rc1 are vulnerable.

3. VLC Media Player 'demux\tta.c' TTA File Handling Buffer Overflow Vulne=
rability
BugTraq ID: 30718
Remote: Yes
Date Published: 2008-08-16
Relevant URL: http://www.securityfocus.com/bid/30718
Summary:
VLC media player is prone to a heap-based buffer-overflow vulnerability b=
ecause the application fails to perform adequate boundary checks on user-=
supplied input.

Attackers may leverage this issue to execute arbitrary code in the contex=
t of the application. Failed attacks will cause denial-of-service conditi=
ons.

VLC media player 0.8.6i is vulnerable; other versions may also be affecte=
d.

4. EchoVNC Remote Buffer Overflow Vulnerability
BugTraq ID: 30722
Remote: Yes
Date Published: 2008-08-15
Relevant URL: http://www.securityfocus.com/bid/30722
Summary:
EchoVNC is affected by a remote buffer-overflow vulnerability because the=
 application fails to properly validate user-supplied data before copying=
 it into insufficiently sized buffers.=20
=20
An attacker may leverage this issue to execute arbitrary code on the affe=
cted computer with the privileges of the user running the vulnerable appl=
ication. Failed exploit attempts will likely cause denial-of-service cond=
itions.

This issue affects EchoVNC for Linux versions prior to 1.1.2.

5. libxml2 Recursive Entity Remote Denial of Service Vulnerability
BugTraq ID: 30783
Remote: Yes
Date Published: 2008-08-21
Relevant URL: http://www.securityfocus.com/bid/30783
Summary:
The libxml2 library is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause the library to consume an exc=
essive amount of memory, denying service to legitimate users.

6. Red Hat OpenSSH Backdoor Vulnerability
BugTraq ID: 30794
Remote: Yes
Date Published: 2008-08-22
Relevant URL: http://www.securityfocus.com/bid/30794
Summary:
OpenSSH running on Red Hat operating systems are prone to a backdoor vuln=
erability.

Attackers can exploit this issue by enticing an unsuspecting victim to do=
wnload and install a malicious OpenSSH package from a compromised Red Hat=
 software repository or from mirrors that replicated the malicious packag=
es. Successfully exploiting this issue will compromise the affected compu=
ter.

This issue affects OpenSSH running on the following operating systems:=20

Red Hat Enterprise Linux 4 i386=20
Red Hat Enterprise Linux 4 x86_64=20
Red Hat Enterprise Linux 5 x86_64

7. Vim Insufficient Shell Escaping Multiple Command Execution Vulnerabili=
ties
BugTraq ID: 30795
Remote: Yes
Date Published: 2008-08-19
Relevant URL: http://www.securityfocus.com/bid/30795
Summary:
Vim is prone to multiple command-execution vulnerabilities because the ap=
plication fails to sufficiently sanitize user-supplied data.=20

Successfully exploiting these issues can allow an attacker to execute arb=
itrary commands with the privileges of the user running the affected appl=
ication.=20

Vim 7.2 is vulnerable; other versions may also be affected.

8. VLC Media Player 'mmstu.c' MMS Protocol Handling Buffer Overflow Vulne=
rability
BugTraq ID: 30806
Remote: Yes
Date Published: 2008-08-24
Relevant URL: http://www.securityfocus.com/bid/30806
Summary:
VLC media player is prone to a heap-based buffer-overflow vulnerability b=
ecause the application fails to perform adequate boundary checks on user-=
supplied input.

Attackers may leverage this issue to execute arbitrary code in the contex=
t of the application. Failed attacks will cause denial-of-service conditi=
ons.

VLC media player 0.8.6i is vulnerable; other versions may also be affecte=
d.

9. GPicView Multiple Local Security Vulnerabilities
BugTraq ID: 30819
Remote: No
Date Published: 2008-08-25
Relevant URL: http://www.securityfocus.com/bid/30819
Summary:
GPicView is affected by multiple local security vulnerabilities.  These i=
ssues include creating insecure temporary files, and two vulnerabilities =
that may allow attackers to overwrite arbitrary files. These issues arise=
 due to a design error that permits files to be saved without user verifi=
cation.

An attacker may leverage these issues to overwrite arbitrary files with t=
he privileges of the user running the application.

GPicView 0.1.9 is vulnerable; other versions may also be affected.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securi=
tyfocus.com from the subscribed address. The contents of the subject or m=
essage body do not matter. You will receive a confirmation request messag=
e to which you will have to answer. Alternatively you can also visit http=
://www.securityfocus.com/newsletters and unsubscribe via the website.=20

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is sponsored by Sponsored by Ironkey: The World's Most Secure =
Flash Drive

You can now initiate and utilize IronKey flash drives on Linux operating =
systems based on kernel 2.6 and above.
IronKey uses military-grade AES hardware encryption and provides rugged a=
nd waterproof protection to safeguard your data.
https://www.ironkey.com/forenterprise2