SecurityFocus Linux Newsletter #75

SecurityFocus Linux Newsletter #75
--------------------------------
This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml
-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Managing Intrusion Detection Systems in Large Organizations: One
     2. Active Directory and Linux
     3. Past its Prime: Is Anti-Virus Scanning Obsolete?
     4. Death to Old Software
     5. A Mickey Mouse Bill
II. LINUX VULNERABILITY SUMMARY
     1. PostNuke caselist Arbitrary Module Include Vulnerability
     2. ZeroForum User-Embedded Scripting Vulnerability
     3. Oracle 8i TNS Listener Local Command Parameter Buffer...
     4. IPFilter TTL Fingerprinting Vulnerability
     5. WWWIsis Remote Command Execution Vulnerability
     6. WWWIsis File Disclosure Vulnerability
     7. LibNewt Library Buffer Overflow Vulnerability
     8. Caldera OpenLinux StartKDE Script LD_LIBRARY_PATH Vulnerability
     9. Cyrus SASL LDAP+MySQL Authentication Patch SQL Command...
     10. Icecast AVLLib Buffer Overflow Vulnerability
     11. SquirrelMail Theme Remote Command Execution Vulnerability
     12. Analog Logfile Script Code Injection Vulnerability
     13. Oracle 9i TNS Denial of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. No New Content
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. hp secure OS software for Linux
     2. Immunix
     3. NetMAX FireWall
V. NEW TOOLS FOR LINUX PLATFORMS
     1. Anubis v2.0.0b-2
     2. Sudoscript v1.0
     3. Openwall Linux kernel patch v2.2.20-ow3
     4. Linux Security Auditing Tool v0.1.6
VI. SPONSORSHIP INFORMATION




I. FRONT AND CENTER
-------------------
1. Managing Intrusion Detection Systems in Large Organizations: Part One
by Paul Innella

This article is the first of a two-part series that will discuss the need
for intrusion detection systems (IDS) in large organizations, including
challenges of deploying IDSs in such environments, managing agents in a
distributed environment, and using collected data. It will also discuss
some “real-world” IDS experiences of larger companies.

http://online.securityfocus.com/infocus/1564

2. Active Directory and Linux
by David “Del” Elson

This article discusses the use of Microsoft's Active Directory as an
authentication service for Linux systems. Although Linux has a perfectly
good directory based authentication system (OpenLDAP), it may be desirable
on some sites to authenticate Linux users against a Microsoft Windows 2000
server.

http://online.securityfocus.com/infocus/1563

3. Past its Prime: Is Anti-Virus Scanning Obsolete?
by Paul Schmehl

The title and topic of this article is clearly controversial. It is
guaranteed to get a strong reaction from the anti-virus industry, which is
firmly convinced it sees clear sailing ahead. So, is anti-virus scanning
obsolete? In a word, yes - but don’t throw out your scanner. Its
replacement hasn’t been created yet. In this article we will examine the
weaknesses of virus scanning that will cause its eventual downfall.

http://online.securityfocus.com/infocus/1562

4. Death to Old Software
by Jon Lasser

We all know that outdated network software is security hazard. The
solution: hard-wired expiration codes that self-destruct an old program
when it's past its prime.

http://online.securityfocus.com/columnists/72

5. A Mickey Mouse Bill
By David Banisar

In the name of protecting copyrights, a new bill introduced in the U.S.
Senate threatens to grind to a halt all advancements in electronics,
computing and networking, decimating the consumer's ability to choose how
they wish to listen, watch, and read. The motion picture industry is back
on the Hill.

http://online.securityfocus.com/columnists/71


II. BUGTRAQ SUMMARY
-------------------
1. PostNuke caselist Arbitrary Module Include Vulnerability
BugTraq ID: 4381
Remote: Yes
Date Published: Mar 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4381
Summary:

PostNuke is a content management system originally forked from the
PHP-Nuke project. It is implemented in PHP, and available for Windows,
Linux and other Unix based systems.

A vulnerability has been reported in some versions of PostNuke.
Reportedly, it is possible to force the script user.php to include
arbitrary modules. These files may be hosted remotely and contain
arbitrary code, which will then be executed by the vulnerable system.

The array $caselist is used to specify a list of paths and modules which
should be included by the script. As this variable is not explicitely
initialized before use, it may automatically inherit data supplied through
a number of channels, including user supplied CGI data.

Other versions of PostNuke may share this vulnerability. This has not,
however, been confirmed.

2. ZeroForum User-Embedded Scripting Vulnerability
BugTraq ID: 4394
Remote: Yes
Date Published: Mar 29 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4394
Summary:

ZeroForum is a message board application which provides an enterprise
level web discussion forum, and runs on most UNIX and Linux Operating
systems. Versions of ZeroForum suffers from a user-embedded scripting
vulnerability

ZeroForum allows forum users to post images in messages. It is reportedly
possible for attackers to cause script code to be embedded in the image
tags.

When other users view the images, the attacker-embedded script code will
execute within the context of the website.  Attackers may design script
code that can obtain cookies or perform actions as the victim user.  This
may result in a compromise of the victim's forum account.

3. Oracle 8i TNS Listener Local Command Parameter Buffer Overflow Vulnerability
BugTraq ID: 4413
Remote: No
Date Published: Apr 01 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4413
Summary:

Oracle 8i is a powerful relational database product. It is available for
Windows, Linux, and a wide range of Unix operating systems.

A vulnerability has been reported with some versions of Oracle 8i for
Linux. A local attacker able to execute the tnslsnr process may pass an
oversized command line parameter. It is possible to overflow stack memory,
including sensitive data used to restore CPU registers. If done correctly,
this can lead to the execution of arbitrary code.

The TNS Listener is central to the Oracle system. Under Linux, it runs
suid as the user 'oracle', and is world executable by default.

Versions of Oracle 8i available for other operating systems have not yet
been confirmed as vulnerable.

4. IPFilter TTL Fingerprinting Vulnerability
BugTraq ID: 4403
Remote: Yes
Date Published: Mar 31 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4403
Summary:

IPFilter is a freely available, open source firewall package written by
Darren Reed.  It is available for multiple platforms, including Unix and
Linux operating systems.

A problem with IPFilter could allow remote users to gain information about
open ports on a system.  The problem is in the response to some types of
traffic.

Under some circumstances, IPFilter sends responses that can allow an
attacker to gain information about the firewall ruleset.  When an attempt
is made to connect to a system via TCP on a port that is filtered by
IPFilter, and IPFilter returns a RST, it is possible to differentiate
between filtered and unfiltered ports.  A port that is filtered by
IPFilter will return a RST with a TTL field set to 60, whereas the
operating system will return it's default TTL value for a RST.

In the event that a system is filtering certain ports, analysis of the TTL
values returned by the system could lead to accurately predicting ports
that are open but have no services running on them, as would be indicated
by a TTL characteristic of the default operating system.  For ports
filtered by IPFilter, the returned TTL of 60 would give information about
a port that can't be accessed due to filtering by IPFilter.

This vulnerability can only be exploited in rulesets which return RST
values for unauthorized connection attempts.  Rulesets that do not return
RSTs but simply drop the incoming packet are not affected.  Firewalls that
filter all ports by default will not exhibit this behavior.

5. WWWIsis Remote Command Execution Vulnerability
BugTraq ID: 4383
Remote: Yes
Date Published: Mar 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4383
Summary:

WWWIsis provides a web interface for accessing ISIS databases. It will run
on most Unix and Linux variants, as well as Microsoft Windows operating
systems.

WWWIsis does not adequately filter shell metacharacters from CGI
parameters. As a result, it is possible for a remote attacker to execute
commands on the underlying shell of the host running the vulnerable
software. Such commands will be executed with the privileges of the
webserver process.

Exploitation of this issue may enable a remote attacker to gain local,
interactive access to the host running the vulnerable software.

This issue has been reported for 3.x versions. Other versions are not
affected by this vulnerability. Additionally, JavaISIS and other tools
based on WWWIsis may also be affected.

6. WWWIsis File Disclosure Vulnerability
BugTraq ID: 4384
Remote: Yes
Date Published: Mar 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4384
Summary:

WWWIsis provides a web interface for accessing ISIS databases. It will run
on most Unix and Linux variants, as well as Microsoft Windows operating
systems.

A file disclosure vulnerability exists in WWWIsis. This may enable a
remote attacker to disclose the contents of arbitrary web-readable files
via a maliciously crafted web request. This is due to insufficient
validation of data passed via CGI parameters.

Successful exploitation of this vulnerability may enable a remote attacker
to gather sensitive information, which may aid in further attacks against
the host.

This issue has been reported for 3.x versions. Other versions are not
affected by this vulnerability. Additionally, JavaISIS and other tools
based on WWWIsis may also be affected.

7. LibNewt Library Buffer Overflow Vulnerability
BugTraq ID: 4393
Remote: No
Date Published: Mar 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4393
Summary:

Libnewt is a freely available, open source graphics library for text
screens.  It is available for use with Linux operating systems.

A problem in the library could allow the potential for arbitrary code
execution.  The problem is in bounds checking by the library.

The newt library does not properly check bounds on some data used by the
library.  In a setuid program linked against the library, a user could
exploit this condition to execute arbitrary code.  The code would execute
with the privileges of the administrative user, and potentially result in
adminstrative access.

This problem could make it possible for a local user to execute arbitrary
code, potentially resulting in elevated privileges.

8. Caldera OpenLinux StartKDE Script LD_LIBRARY_PATH Vulnerability
BugTraq ID: 4400
Remote: No
Date Published: Apr 01 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4400
Summary:

OpenLinux is a freely available, open source implementation of the Linux
operating system.  It is maintained and distributed by Caldera.

A problem with the OpenLinux startkde script could lead to arbitrary
library attacks.  The problem is in the initialization of an environment
variable.

The startkde script insecurely initializes the LD_LIBRARY_PATH environment
variable.  When the script is executed, it by default searches the current
working directory.  Any libraries needed by KDE that are found in the
current working directory will be loaded.

This vulnerability requires that a user start KDE with the startkde script
outside of his or her home directory.  Additionally, it requires that the
directory the script is executed in be write accessible to other system
users.

9. Cyrus SASL LDAP+MySQL Authentication Patch SQL Command Execution Vulnerability
BugTraq ID: 4409
Remote: Yes
Date Published: Apr 02 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4409
Summary:

The Cyrus SASL LDAP+MySQL patch is a freely available, open source
enhancement patch.  It is designed for use on the Unix and Linux operating
systems.

A problem with the patch could make it possible for remote users to gain
access to the mail account of any user.  The problem is in the handling of
user input.

The Cyrus SASL LDAP+MySQL patch is designed to integrate LDAP and MySQL
authentication with Cyrus SASL.  This makes it possible to centralize
authentication data.

Due to a design problem in the patch, users may gain access to the mail
accounts of others.  By passing a specially crafted SQL command to the
password challenge, it is possible to provoke a successful authentication
response from the MySQL server.  This would give access to the mail of the
user specified in the login challenge.

Exploitation of this vulnerability may offer intermitted success through
the use of a string such as ') OR 1=1 HAVING FLOOR(RAND()*100)=1 AND
('1'='1.  If the attacker has knowledge of database layout via another
vulnerability that allows SQL command stuffing, the probability of
exploitation increases significantly.

This problem may allow a remote user to gain access to the mail spool of
the desired user.

10. Icecast AVLLib Buffer Overflow Vulnerability
BugTraq ID: 4415
Remote: Yes
Date Published: Apr 03 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4415
Summary:

Icecast is a freely available, open source streaming audio server.
Icecast is available for the Unix, Linux, and Microsoft Windows platforms.

A problem with the software package could make it possible for a remote
user to execute arbitrary code.  The problem is in the handling of
user-supplied input.

Icecast does not properly check bounds on some user-supplied.  Because of
this, it is possible for a remote user to send an arbitrarily long string
of data to the server which could result in a stack overflow, and the
execution of user supplied code.  The code would be executed with the
privileges of the Icecast server.

The recommended Icecast installation is without administrative privileges.
However, a number of Icecast servers are improperly configured and run
with administrative privileges.  This could yield an attacker
administrative access to the affect system.

11. SquirrelMail Theme Remote Command Execution Vulnerability
BugTraq ID: 4385
Remote: Yes
Date Published: Mar 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4385
Summary:

SquirrelMail is a feature rich webmail program implemented in the PHP4
language. It is available for Linux and Unix based operating systems.
SquirrelMail allows for extended functionality through a plugin system.

A vulnerability has been reported in some versions of SquirrelMail.
Reportedly, it is possible to corrupt the variable used to select a user's
theme through maliciously constructed cookie data. This may be used to
force the vulnerable script to execute arbitrary commands.

This vulnerability may be related to the issues discussed in BID 2968.
This has not, however, been confirmed.

12. Analog Logfile Script Code Injection Vulnerability
BugTraq ID: 4389
Remote: Yes
Date Published: Mar 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4389
Summary:

Analog is logfile analysis software which is capable of printing formatted
logfiles in HTML. It will run on most Unix and Linux variants, as well as
a number of other operating systems including Microsoft Windows.

Analog does not filter HTML tags when analyzing logfiles. As a result, it
is possible for an attacker to cause arbitrary script code to be included
in web pages generated by Analog. When a legitimate user views a page
generated by Analog, the script code will be executed in their browser, in
the context of the site that is hosting the pages.

Theoretically, this issue might be exploited to steal cookie-based
authentication credentials from a legitimate user of the software.

13. Oracle 9i TNS Denial of Service Vulnerability
BugTraq ID: 4391
Remote: Yes
Date Published: Mar 28 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4391
Summary:

Oracle is a commercial relational database product. Oracle is available
for the Unix, Linux, and Microsoft Windows platforms.

Reportedly, it is possible for a remote user to initiate a denial of
service on an Oracle host.

Submitting a one byte packet to the TNS Listener on port 1521, could cause
the host's CPU usage to spike to 100%. As a result, legitimate users of
the service will be denied access to database resources. A restart may be
required in order to regain normal functionality.

It should be noted that the TNS Listener sits on the port waiting for
connection requests from clients, the ports involved in this procedure
range from 1521-1528. Any port within that range may be susceptible to
this issue.

This issue may stem from an originally discovered issue in Oracle Net8
(formerly Oracle SQL*Net). However this has not yet been confirmed.


IV. LINUX FOCUS LIST SUMMARY
---------------------------------
No New Content


IV.NEW PRODUCTS FOR LINUX PLATFORMS
----------------------------------------
1. hp secure OS software for Linux
by Hewlett-Packard
Platforms: N/A
Relevant URL:
http://www.hp.com/security/products/linux/
Summary:

A secure server platform for Linux as an enhancement to the HP Netaction
software suite. HP Secure OS Software for Linux, will help businesses
secure their Linux environments by offering intrusion prevention,
real-time protection against attacks, and damage containment. HP is first
to market with this business-critical security solution for Linux. HP
Secure OS Software for Linux provides high reliability, performance,
availability, flexibility and scalability. Additionally, it is easy to
install and manage, making it attractive to businesses that don't have
large IT organizations.

2. Immunix
by WireX
Platforms: Linux
Relevant URL:
http://www.immunix.org/
Summary:

"Immunix" is a family of tools designed to enhance system integrity by
hardening system components and platforms against security attacks. The
Immunix OS is a Linux platform hardened with the Immunix tool set.

3. NetMAX FireWall
by Cybernet Systems
Platforms: Linux, FreeBSD, Windows NT, MacOS
Relevant URL:
http://www.netmax.com/products/index.html
Summary:

NetMAX FireWall is a firewall and a router in one integrated product. The
NetMAX FireWall includes and easily installs all necessary software in
about 15 minutes. The product includes a Linux operating system based on
the Red Hat distribution or FreeBSD, the packet firewall package, and the
routing package. All of the services are pre-configured and integrated
into the FireWall product. The point and click HTML based interface makes
running a server as easy as browsing the web.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Anubis v2.0.0b-2
by The Anubis Team [email protected]
Relevant URL:
http://anubis.sourceforge.net/
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Summary:

Anubis is an anonymous email sender for Unix, BeOS, Win32, and AmigaOS. It
supports WinGates, encrypted TLS/SSL connections, remailers, anonymous
news posting, and more.

2. Sudoscript v1.0
by hbo
Relevant URL:
http://www.egbok.com/sudoscript/
Platforms: FreeBSD, Linux, OpenBSD, POSIX, Solaris, SunOS
Summary:

Sudoscript is a pair of Perl scripts (sudoscriptd/sudoshell) that provide
an audited root shell using sudo.

3. Openwall Linux kernel patch v2.2.20-ow3
by Solar Designer solar at false.com
Relevant URL:
http://www.openwall.com/linux/
Platforms: Linux
Summary:

The Openwall Linux kernel patch is a collection of security "hardening"
features for the Linux kernel. In addition to the new features, some
versions of the patch contain various security fixes. The "hardening"
features of the patch, while not a complete method of protection, provide
an extra layer of security against the easier ways to exploit certain
classes of vulnerabilities and/or reduce the impact of those
vulnerabilities. The patch can also add a little bit more privacy to the
system by restricting access to parts of /proc so that users may not see
what others are doing.

4. Linux Security Auditing Tool v0.1.6
by Triode
Relevant URL:
http://www.dimlight.org/~number9/lsat/
Platforms: Linux, POSIX
Summary:

Linux Security Auditing Tool (LSAT) is a post install security auditing
tool. It is modular in design, so new features can be added quickly. It
checks inetd entries and scans for unneeded RPM packages. It is being
expanded to work with Linux distributions other than Red Hat, and checks
for kernel versions.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml
-------------------------------------------------------------------------------