SecurityFocus Linux Newsletter #102

SecurityFocus Linux Newsletter #102
-----------------------------------

This Issue is Sponsored By: SpiDynamics

ALERT! - Cross-site scripting vulnerabilities in web applications allow
hackers to compromise confidential information, manipulate or steal
cookies, and create requests that can be mistaken for those of a valid
user!! All via port 80 and 443! Download this *FREE* white paper from SPI
Dynamics for a complete guide to protection!

Please visit us at:

http://www.spidynamics.com/mktg/xss1/
-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Footprints in the Sand, Part One
     2. Assessing Internet Security Risk, Part Five: Custom Web Applications
     3. Mozilla's 'Code of Silence' Isn't
     4. Shutting Down Spyware Loopholes
     5. SecurityFocus DPP Program
     6. InfoSec World Conference and Expo/2003
II. LINUX VULNERABILITY SUMMARY
     1. NetBSD talkd Buffer Overflow Vulnerability
     2. phpMyNewsLetter Remote File Include Vulnerability
     3. phpLinkat Multiple Cross Site Scripting Vulnerabilities
     4. Logsurfer Off-By-One Buffer Overflow Vulnerability
     5. Zope Failed Login Information Disclosure Vulnerability
     6. Ximian Evolution SSL Man-In-The-Middle Vulnerability
     7. Apache Web Server Scoreboard Memory Segment Overwriting SIGUSR1...
     8. Apache AB.C Web Benchmarking Buffer Overflow Vulnerabilities
     9. PHPBB2 Avatar Images Information Disclosure Vulnerability
     10. Michael Schatz Books PostNuke Module Cross Site Scripting...
III. LINUX FOCUS LIST SUMMARY
     1. Continuous medium traffic fake Syn packets (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. PowerBroker
     2. SelectAccess
V. NEW TOOLS FOR LINUX PLATFORMS
     1. SEPPL v200210082244
     2. Network-Accounting Daemon for Netfilter v0.2.1
     3. MudPit v1.0
VI. SPONSORSHIP INFORMATION



I. FRONT AND CENTER
-------------------
1. Footprints in the Sand, Part One - Fingerprinting Exploits in System
   and Application Log Files
By Eric Hines, Alan Neville and Joseph Kelly

Forensic analysts must be able to understand and recognize footprints that
exploits leave on system logfiles. Identifying these signatures, is the
key to understanding what took place. This article will focus on the
identification of the footprints that exploits leave on system logfiles
and what they mean, as well as some of the most common traces that some
recent exploits leave.

http://online.securityfocus.com/infocus/1633

2. Assessing Internet Security Risk, Part Five: Custom Web Applications
   Continued
by Charl van der Walt

This article is the fifth and final in a series that is designed to help
readers to assess the risk that their Internet-connected systems are
exposed to. In the first installment, we established the reasons for doing
a technical risk assessment. In the second article, we started to discuss
the methodology that we follow in performing this kind of assessment. The
third part discussed methodology in more detail, focussing on visibility
and vulnerability scanning. The fourth installment discussed a relatively
unexplored aspect of Internet security, custom Web applications. This
article will conclude the discussion of security risks of Web
applications.

http://online.securityfocus.com/infocus/1632

3. Mozilla's 'Code of Silence' Isn't
By Jon Lasser

Developers are accused of not publicizing the browser's security
vulnerabilities enough. But do we really need world wide alerts for every
bug?

http://online.securityfocus.com/columnists/114

4.  Shutting Down Spyware Loopholes
By Mark Rasch

I have this terrible recurring nightmare. One night, there is a knock on
the door, and Bill Gates and Steve Ballmer are there. When I ask why, they
reply, "We are here for your kidney. Don't you remember the contract you
clicked on when you downloaded the beta version of Internet Explorer?
Don't you read those things?"

http://online.securityfocus.com/columnists/113

5. SecurityFocus DPP Program

Attention Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

6. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space.  This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud?  We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud


II. BUGTRAQ SUMMARY
-------------------
1. NetBSD talkd Buffer Overflow Vulnerability
BugTraq ID: 5910
Remote: No
Date Published: Oct 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5910
Summary:

talkd is a client-server application shipped with many Unix and Linux
variants that is used for communication between users locally or remotely.

A buffer overflow vulnerability has been reported for the talkd service
shipped with NetBSD. Reportedly, the talkd service does not perform proper
bounds checking on inbound messages before copying data to a destination
buffer. Specifically, the vulnerability occurs in the find_user() function
in the 'libexec/talkd/process.c' source file.

An attacker can exploit this vulnerability to obtain elevated privileges
on a vulnerable system.

As this vulnerability is due to a buffer overflow condition, it is
possible for a malicious attacker to cause talkd to execute code. This,
however, has not been confirmed.

talkd ships as a core component for a number of Linux and Unix variants
and is independently maintained by the various distributions, so it is
highly probable that many other operating systems are affected by this
vulnerability.

2. phpMyNewsLetter Remote File Include Vulnerability
BugTraq ID: 5886
Remote: Yes
Date Published: Oct 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5886
Summary:

phpMyNewsletter is a publically available newsletter management script
written in php. It is available for multiple platforms including Microsoft
Windows and Linux.

A vulnerability has been discovered in phpMyNewsLetter.

Reportedly, it is possible to pass an attacker-specified file include
location to a CGI parameter of the 'customize.php' script.

Exploitation of this issue may allow an attacker to execute arbitrary
commands with the privileges of the webserver by including a malicious PHP
script from an attacker-supplied host.

Additionally, an attacker may exploit this problem to view local webserver
readable files.

3. phpLinkat Multiple Cross Site Scripting Vulnerabilities
BugTraq ID: 5890
Remote: Yes
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5890
Summary:

phpLinkat is Web-based link indexing system. It is implemented in PHP, and
available for Windows, Linux and other Unix based systems.

Reportedly, phpLinkat is prone to cross site scripting attacks. The
vulnerabilities are present in the files 'showcat.php' and
'addyoursite.php'.

An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link containing HTML and script code. The
attacker-supplied HTML and script code may be executed on a web client in
the context of the site hosting phpLinkat.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability was reported for phpLinkat 0.1.0.

4. Logsurfer Off-By-One Buffer Overflow Vulnerability
BugTraq ID: 5898
Remote: Yes
Date Published: Oct 04 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5898
Summary:

Logsurfer is a log parsing program, similar to swatch, available for Unix
and Linux.

A vulnerability has been discovered in Logsurfer.

Reportedly under some circumstances, a malformed log entry could trigger
an off-by-one buffer overflow condition. The problem occurs when
calculating matched string lengths, and is located in the context_action()
function in context.c. Triggering the overflow will result in the
corruption of memory located in the heap. Under some cirumstances this may
result in the logsurfer process terminating.

Although not confirmed, it may also be possible for an attaker to cause
aribtrary code to be executed.

5. Zope Failed Login Information Disclosure Vulnerability
BugTraq ID: 5903
Remote: Yes
Date Published: Oct 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5903
Summary:

Zope is an open source web application server, maintained by the Zope
Project. Zope is available for Linux, Unix, and Microsoft Windows based
systems.

Reportedly, Zope will disclose path information if a user hits 'Cancel'
after a failed login attempt to the management interface.  This
information is leaked in a stack trace that is output after the error.

If an attacker can gain information about the details of the filesystem,
this information may be useful in further attacks against the host.

6. Ximian Evolution SSL Man-In-The-Middle Vulnerability
BugTraq ID: 5875
Remote: Yes
Date Published: Oct 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5875
Summary:

Evolution is personal and workgroup information management software for
Linux and Unix operating systems. It provides a mailer, calendaring, and a
contact manager. Evolution is maintained by Ximian.

A vulnerability has been reported in Evolution's camel component which is
used to verify SSL certificates. It has been reported that upon a
connection breakdown, the camel component fails to re-authenticate
previously accepted SSL certificates when re-establishing the connection.
This can potentially allow for malicious certificates to be injected into
the SSL connection.

By exploiting this issue, it would be possible for an attacker to
construct a malicious certificate which has previously been authenticated
by the camel component, and use the certificate to launch a
man-in-the-middle attack, allowing the intruder to intercept and modify
SSL traffic.

It should be noted that this vulnerability only exists if protocols over
SSL are being used, such as IMAPS, POP3S, SMTPS, etc.

7. Apache Web Server Scoreboard Memory Segment Overwriting SIGUSR1 Sending Vulnerability
BugTraq ID: 5884
Remote: No
Date Published: Oct 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5884
Summary:

Apache is a freely available webserver for Unix and Linux variants, as
well as Microsoft operating systems.

A problem with Apache may make it possible for a local user to deny
service to legitmate users of a server.

A vulnerability in the handling of the Apache scorecard has been reported.
A user with the privileges of the Apache user could attach to an httpd
process, and overwrite the parent[].pid and parent[].last_rtime shared
memory segments.  By overwriting these, a signal may be sent to an
arbitrary process with administrative privileges.

It should be noted that the signal sent is a SIGUSR1.  This is a
user-defined signal that is handled as specified in an application.  Some
applications default to SIGTERM when this signal is caught.

8. Apache AB.C Web Benchmarking Buffer Overflow Vulnerabilities
BugTraq ID: 5887
Remote: Yes
Date Published: Oct 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5887
Summary:

Apache is a freely available webserver for Unix and Linux variants, as
well as Microsoft operating systems.

Potentially exploitable buffer overflows have been reported in the ab.c
web benchmarking support utility provided with Apache webserver.

It may be possible for a malicious webserver to exploit one of these
overflows when the benchmarking utility is run against it.  Data sent by a
malicious server during the benchmarking process could cause memory to be
corrupted with attacker-supplied values.

A malicious server could exploit this condition to execute code with the
privileges of the user running the utility.

9. PHPBB2 Avatar Images Information Disclosure Vulnerability
BugTraq ID: 5923
Remote: Yes
Date Published: Oct 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5923
Summary:

phpBB2 is an open-source web forum application that is written in PHP and
backended by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

It has been reported that phpBB2 reveals a user's IP address. This
vulnerability is due to phpBB2's file naming scheme for avatar files.
Avatar files are typically GIF images files uploaded by users that wish to
personalize their posts.

When a user elects to upload an avatar file to a system using phpBB2, the
system will save the file with a random name. This random name consists of
the user's IP address, encoded in hexadecimal values, followed by other
characters.

A malicious attacker can exploit this vulnerability to find out IP
addresses of the users of the system hosting phpBB2. This information may
be used by attackers to launch attacks against users of the system hosting
phpBB2 forums.

This vulnerability was reported for phpBB2 2.0.0 to 2.0.3. Other versions
may also be affected.

10. Michael Schatz Books PostNuke Module Cross Site Scripting Vulnerability
BugTraq ID: 5882
Remote: Yes
Date Published: Oct 03 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5882
Summary:

Books is a module written for PostNuke. It is implemented in PHP, and
available for Windows, Linux and other Unix based systems.

Reportedly, Books is prone to cross site scripting attacks.

An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link containing HTML and script code. The
attacker-supplied HTML and script code may be executed on a web client in
the context of the site hosting the vulnerable module.

Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.

This vulnerability has been reported for Books 0.54 and 0.6.


III. LINUX FOCUS LIST SUMMARY
----------------------------
1. Continuous medium traffic fake Syn packets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/294722


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. PowerBroker
by Symark Software
Platforms: DG-UX, HP-UX, Linux, SunOS, UNIX
Relevant URL:
http://www.symark.com/powerbroker.htm
Summary:

Symark PowerBroker allows the full administrative powers of the root
account to be selectively delegated to trusted users without having to
disclose the root password, thereby maintaining system security. Second,
it provides an indelible audit trail of all actions occurring in important
accounts such as root, which allows sites to track exactly which actions
have been undertaken, by which people, when, and on which machine.

2. SelectAccess
by Baltimore Technologies
Platforms: Linux, Solaris, SunOS, UNIX, Windows 2000, Windows NT
Relevant URL:
http://www.baltimoretechnologies.com/selectaccess/index.asp
Summary:

SelectAccess enables businesses to capitalize on the potential of
extranets, intranets and portals by providing web-based single sign-on for
a seamless user experience. SelectAccess greatly reduces administration
cost and complexity by providing a unified approach to defining
authorization policies and securely managing role-based access to on-line
resources.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. SEPPL v200210082244
by Mezcalero
Relevant URL:
http://www.ring2.org/seppl/
Platforms: Linux, POSIX
Summary:

SEPPL is both a protocol definition and a software implementation of a new
encryption layer for IPv4. It is extremely leightweight and easy to use.
It is implemented for the Linux kernel and makes use of netfiler and the
Linux CryptoAPI. It is intended as a software replacement for WEP but may
be used on non-wireless lans as well. It even fits for VPN solutions.

2. Network-Accounting Daemon for Netfilter v0.2.1
by Hilko Bengen
Relevant URL:
https://savannah.nongnu.org/projects/ulog-acctd/
Platforms: Linux, POSIX
Summary:

ulog-acctd is a userspace network accounting daemon which generates log
files of network traffic for accounting purposes. It collects headers of
IP packets that travel through the Linux 2.4+ netfilter. It writes
accounting information to a log which can include protocol type, source
and destination address, port numbers, byte and packet count, and incoming
and outgoing interfaces. It is easily possible to generate CISCO "IP
accounting output packets" style logs with this tool.

3. MudPit v1.0
by Gene Savchuk [email protected]
Relevant URL:
http://www.fidelissec.com/mudpit/
Platforms: Linux, POSIX
Summary:

MudPit is a spool processor for the Snort intrusion detection system. It
is similar to the Barnyard project, but is able to process both log and
alert streams at the same time. It is simple, modular, and reliable.


VI. SPONSORSHIP INFORMATION
---------------------------
This Issue is Sponsored By: SpiDynamics

ALERT! - Cross-site scripting vulnerabilities in web applications allow
hackers to compromise confidential information, manipulate or steal
cookies, and create requests that can be mistaken for those of a valid
user!! All via port 80 and 443! Download this *FREE* white paper from SPI
Dynamics for a complete guide to protection!

Please visit us at:

http://www.spidynamics.com/mktg/xss1/
-------------------------------------------------------------------------------