SecurityFocus Linux Newsletter #103

SecurityFocus Linux Newsletter #103
-----------------------------------

I. FRONT AND CENTER
     1. Security Concerns in Licensing Agreements, Part Two
     2. Polymorphic Macro Viruses, Part One
     3. Identifying and Tracking Emerging and Subversive Worms...
     4. Stupid Bugbear Tricks
     5. Ten Things to Do With IIS
     6. SecurityFocus DPP Program
     7. InfoSec World Conference and Expo/2003
II. LINUX VULNERABILITY SUMMARY
     1. ypxfrd Local File Disclosure Vulnerability
     2. Nylon Proxy Receive Function Denial Of Service Vulnerability
     3. PHPRank Add.PHP Cross-Site Scripting Vulnerability
     4. PHPRank Banner Script Code Injection Vulnerability
     5. PHPRank Administrator Password Plain Text Storage Vulnerability
     6. SquirrelMail Options.PHP Web Root Path Disclosure Vulnerability
     7. KDE KPF Icon Option File Disclosure Vulnerability
     8. PHPBBMod PHPInfo Information Disclosure Vulnerability
     9. OpenOffice Installation Insecure Temporary File Symbolic Link...
     10. PHPNuke Multiple Script Code Filtering Vulnerabilities
     11.  Linux-HA Heartbeat Remote Buffer Overflow Vulnerability
     12. PHPRank MySQL Error Unauthorized Access Vulnerability
     13. ghttpd Log() Function Buffer Overflow Vulnerability
     14. BEA WebLogic Server/Express/Integration Application Migration
     15. Syslog-ng Remote Buffer Overflow Vulnerability
     16. PHPReactor Browse.PHP Cross-Site Scripting Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. Continuous medium traffic fake Syn packets (Thread)
     2. Followup: Continuous medium traffic fake Syn packets (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. NetMAX Professional Suite
     2. SMART Extractor
V. NEW TOOLS FOR LINUX PLATFORMS
     1. Packit v0.3.5
     2. auditunlink v0.0.1
     3. procps



I. FRONT AND CENTER
-------------------
1. Security Concerns in Licensing Agreements, Part Two: Negotiating
Security Provisions
by Steven Robinson

In the first article in this series, we looked at security concerns
related to clickwrap and shrinkwrap agreements, used by vendors for
mass-market licenses and service agreements. In these cases, no
negotiations are involved. If you want what the vendor is selling, you are
required to agree to "a one size fits all" agreement, including whatever
provisions it contains, if any, that pertain to information security. This
type of agreement is typical of the licensing agreements that individual
users and small organizations enter into.

http://wwwdev.securityfocus.com/infocus/1636

2. Polymorphic Macro Viruses,
Part One By Gabor Szappanos

Polymorphic viruses change their code in fundamental ways, such as
changing the encryption routine or the sequence of instructions, in order
to avoid detection by anti-virus scanners. This article is the first of a
two-part series that will offer a brief overview of the use of polymorphic
strategies in macro viruses.

http://online.securityfocus.com/infocus/1635

3. Identifying and Tracking Emerging and Subversive Worms Using
Distributed Intrusion Detection Systems
by Nathan Einwechter

Worms continually become more sophisticated, as new propagation methods
and stealth techniques are developed and implemented. As worms continue to
evolve, so must our ability to detect and track them. One solution is the
use of distributed intrusion detection systems (dIDS) to identify new and
emerging worms that utilize new subversive propagation techniques. This
paper will discuss how and why the dIDS design is able to identify,
detect, and track worms even as they implement more advanced propagation
methods.

http://online.securityfocus.com/infocus/1634

4. Stupid Bugbear Tricks
By George Smith

Despite the virus' success at slamming unwary netizens, there's evidence
that its author is no rocket scientist.

http://online.securityfocus.com/columnists/116

5. Ten Things to Do With IIS
by Matt J. Foley ([email protected])

As an IIS administrator it sometimes gets downright annoying having to
fend off all the insults from Apache admins I meet claming innate server
superiority. Generally the discussion about Web administration starts
first with all the various security holes plaguing IIS and the negative
press the platform garnered over the last year.

http://online.securityfocus.com/guest/16819

6. SecurityFocus DPP Program

Attention Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

6. IIR's 3G Fraud & Security Forum (21-23 October, London)

A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space.  This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud?  We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.

Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.

For more details please visit http://www.iir-conferences.com/3GFraud


II. BUGTRAQ SUMMARY
-------------------
1. ypxfrd Local File Disclosure Vulnerability
BugTraq ID: 5937
Remote: No
Date Published: Oct 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5937
Summary:

ypxfrd is a NIS map transfer daemon used to speed up the distribution of
large NIS maps from NIS master to NIS slave servers. It is available on a
multiple platforms.

A vulnerability has been discovered in ypxfrd.

Reportedly, before calling the 'getdbm' procedure, ypxfrd specifies a path
to a map file in /var/yp/domain/map, where domain and map are user
supplied arguments. ypxfrd fails to sufficiently parse arguments for dot
(.) and slash (/) values. By supplying a malicious path to an
attacker-created symlink posed as a map file, arbitrary ypxfrd system
files could be accessed by the attacker.

If running as a privileged user, exploiting this issue could allow an
attacker to access sensitive files, such as a system's shadow file.

The exact operating system releases that are vulnerable to this issue have
not yet been confirmed, but it is assumed that the latest versions are
affected.

Under some circumstances, depending on the configuration of the vulnerable
system, it may be possible for dbm files to be viewed by a remote
attacker.

*** It should be noted that this may be the same issue as bid 5912, but
due to conflicting reports, we are treating it as a seperate issue.

2. Nylon Proxy Receive Function Denial Of Service Vulnerability
BugTraq ID: 5938
Remote: Yes
Date Published: Oct 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5938
Summary:

Nylon is a freely available, open source proxy software package.  It is
available for Unix and Linux operating systems.

A problem with nylon could make it possible for a remote user to deny
service to legitimate users of the proxy.

Under some circumstances, it may be possible for a remote user to cause a
denial of service.  Nylon does not properly check the return value of the
recv() call.  While connected to a vulnerable proxy, if a client
disconnects from the proxy during the time nylon is recv()'ing data, the
function will not exit.  This could lead to resource consumption, and
denial of service.

It has been reported that exploitation of this vulnerability typically
leads to resource consumption, such as 100% utilization of the CPU.  It is
likely that this vulnerability could be exploited to cause a system crash.

3. PHPRank Add.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 5945
Remote: Yes
Date Published: Oct 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5945
Summary:

phpRank is a freely available web site link sharing script.  It is
available for Unix, Linux, and Microsoft operating systems.

A problem with phpRank has been discovered that could lead to cross-site
scripting attacks.

It has been reported that phpRank is vulnerable to cross-site scripting
attacks.  Under some circumstances, it is possible to force the rendering
of arbitrary HTML and script code through the add.php portion of the
phpRank package.  This could allow the execution of potentially malicious
script and HTML in the security context of a vulnerable site.

It has additionally been reported that this vulnerability may exist in
other scripts included as part of the phpRank package.  Further details
about vulnerable scripts have not been made available.

4. PHPRank Banner Script Code Injection Vulnerability
BugTraq ID: 5946
Remote: Yes
Date Published: Oct 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5946
Summary:

phpRank is a freely available web site link sharing script.  It is
available for Unix, Linux, and Microsoft operating systems.

A problem with phpRank has been discovered that could lead to the
execution of arbitrary script code.

It has been reported that phpRank does not properly filter some forms of
input.  When a user submits a site to the banner list, it is possible for
the user to insert arbitrary HTML or script code in the banner URL.  This
could allow a remote user to execute arbitrary code in the browser of
clients visiting the site.

This problem could lead to an attacker gaining access to sensitive
information, such as authentication cookies, and could potentially be used
to perform other attacks.  Any code executed through this vulnerability
would be in the security context of the vulnerable site.

5. PHPRank Administrator Password Plain Text Storage Vulnerability
BugTraq ID: 5947
Remote: No
Date Published: Oct 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5947
Summary:

phpRank is a freely available web site link sharing script.  It is
available for Unix, Linux, and Microsoft operating systems.

A problem with phpRank has been discovered that could allow an attacker to
gain access to sensitive information.

It has been reported that phpRank does not safely store the administrator
password in some circumstances.  phpRank stores the administrative
password in plain text on the server side when the password has been set.
Additionally, once the administrator has accessed the web administration
interface, and enabled the cookie storage of authentication credentials,
the password is stored in plain text in the authentication cookie.

This problem could allow an attacker to gain access to the administrative
password of vulnerable system by searching a web client's cookie directory
for a cookie named "ap".  Additionally, if the attacker were to gain
access to the source code of the phpRank system, the attacker could
extract the plain text password from the source code.

6. SquirrelMail Options.PHP Web Root Path Disclosure Vulnerability
BugTraq ID: 5949
Remote: Yes
Date Published: Oct 11 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5949
Summary:

SquirrelMail is a feature rich webmail program implemented in the PHP4
language. It is available for Linux and Unix based operating systems.

A problem with SquirrelMail could make it possible for an attacker to gain
sensitive information.

Under some conditions, SquirrelMail may reveal sensitive configuration
information. When a malformed 'optpage' file argument is given to the
'options.php' script,an error page will be generated. The error page
returned contains absolute pathname of the options.php script.

An attacker can exploit this vulnerability to obtain potentially sensitive
information about a vulnerable system. Information obtained in this manner
may be used by an attacker to launch further, potentially destructive,
attacks against a vulnerable system.

This vulnerability was reported for SquirrelMail 1.2.7.

7. KDE KPF Icon Option File Disclosure Vulnerability
BugTraq ID: 5951
Remote: Yes
Date Published: Oct 11 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5951
Summary:

kpf is a file sharing utility shipped with the KDE desktop. It uses a
subset of the HTTP protocol internally and acts much similiar to a
webserver.  KDE is available for the Linux operating system.

A vulnerability has been discovered in the kpf file sharing utility.

It has been reported that by passing a malicious file request to kpf, it
is possible for a remote attacker to gain access to files outside of the
'shared directory' root.  The ability to read files outside of the shared
root directory would be dependent upon the privileges of the kpf process.

The problem is in the handling of the '?icon=' option used by kpf.  The
'?icon=' option allows a user to remotely specify a directory for an icon
image.  However, if a directory is supplied instead of an image, it is
possible for a user to gain a listing of the contents of the directory.
Any files readable by the kpf process will also be disclosed to the remote
user.

By exploiting this issue it may be possible for a remote attacker to view
or download arbitrary kpf readable files. Access to sensitive files may
aid the attacker in future exploit attempts made against the target
system.

8. PHPBBMod PHPInfo Information Disclosure Vulnerability
BugTraq ID: 5942
Remote: Yes
Date Published: Oct 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5942
Summary:

phpBBmod is freely available web forum software.  It is based on phpBB and
should run on most Linux and Unix variants, as well as Microsoft Windows
operating systems.

phpBBmod ships with a sample script (phpinfo.php) that may disclosure
sensitive information to remote attackers.  When this script is accessed,
sensitive information about the underlying environment will be revealed.
Software versions and path information may be disclosed by the script.

This script is for debugging purposes and should be removed from publicly
accessible sites.

This may allow an attacker to gather sensitive information which may be
useful in further attacks against the host running the vulnerable.

This issue was reported in phpBBmod version 1.3.3.  Other versions may
also be affected.

9. OpenOffice Installation Insecure Temporary File Symbolic Link Vulnerability
BugTraq ID: 5950
Remote: No
Date Published: Oct 11 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5950
Summary:

OpenOffice is an open source office software package distributed and
maintained by the OpenOffice project.  It is available for Unix, Linux,
and Microsoft Windows operating systems.

A problem with OpenOffice could make it possible for a local user to
destroy arbitrary files.  This vulnerability only affects Unix and Linux
systems.

When OpenOffice is installed, it insecurely creates temporary files.
Temporary files created by the office suite are created with a predictable
file name.  Additionally, a check is not performed prior to the attempted
writing to the file.  This could result in the destruction of files with
the permissions of the user installation OpenOffice if attackers create
symbolic links with the correct filename.

The vulnerable file is typically created as
/tmp/$USERNAME_autoresponse.conf, where $USERNAME is the name of the user
installing the office suite.  It should be noted that the office suite is
typically installed by the administrative user.

10. PHPNuke Multiple Script Code Filtering Vulnerabilities
BugTraq ID: 5953
Remote: Yes
Date Published: Oct 11 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5953
Summary:

PHPNuke is a web based Portal system. Implemented in PHP, it is available
for a range of systems, including Unix, Linux, and Microsoft Windows.

Multiple script code vulnerabilities have been discovered in various
PHPNuke features.  These problem could potentially result in the execution
of arbitrary code within the context of the vulnerable website.
Exploitation of this issue may allow remote attackers to steal user's
cookie-based authentication credentials, or launch other attacks.

The following vulnerabilities have been reported in PHPNuke:

The RDF/RSS parser fails to strip HTML tags.  A user could inject script
code into an RSS file that would bypass filtering, and execute in another
user's browser.

Private Messages in PHPNuke are not sufficiently sanitized.  A user may
input HTML into the body of a message that could result in the execution
of code in a user's browser.

The PHPNuke Journal fails to properly sanitize input.  A malicious user
could take advantage of this issue to execute code in a user's browser.

The PHPNuke 'Your Info' section does not properly sanitize input.  A user
could place arbitrary code in one of the following fields that would be
executed in the browser of a user:  Real Name, Fake Email, Your Location,
Your Interests, Your Occupation Signature. This could allow the creation
of malicious fields.

The 'Downloads' and 'Web Links' sections do not sufficiently sanitize user
input.  Both allow <a href> tags in the following fields: Program Name,
File Link, Author's Name, Author's Email, and Homepage.

11.  Linux-HA Heartbeat Remote Buffer Overflow Vulnerability
BugTraq ID: 5955
Remote: Yes
Date Published: Oct 14 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5955
Summary:

Heartbeat is a utility designed to indicate the availability of a Linux
system.  It is made available as part of the High-Availability Linux
(Linux-HA) project.

The heartbeat utility is vulnerable to a remotely exploitable buffer
overflow condition.  Attackers may exploit the vulnerability to execute
arbitrary code.  It has been reported that the condition is related to the
handling of TCP packets.

Any code executed will run with root privileges.

12. PHPRank MySQL Error Unauthorized Access Vulnerability
BugTraq ID: 5948
Remote: Yes
Date Published: Oct 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5948
Summary:

phpRank is a freely available web site link sharing script.  It is
available for Unix, Linux, and Microsoft operating systems.

phpRank does not provide sufficient error checking with regards to
functions which access the underlying MySQL database.  As a result, when
the database is inaccessible or temporarily unavailable it is possible for
remote attackers to authenticate as any user to phpRank using a null
password.

This problem occurs because the vulnerable script still attempts to
authenticate the user even though authentication data cannot be fetched
from the database.  The password credential will be fetched from the
database and stored in a variable.  The vulnerable script will then match
it against the password supplied by the user when prompted for
authentication.  If the script cannot fetch the relevant information from
the database, the variable will be blank.  Therefore, an attacker is able
to successfully authenticate using a blank password.

This will allow an attacker to gain unauthorized access as an arbitrary
user to phpRank.

13. ghttpd Log() Function Buffer Overflow Vulnerability
BugTraq ID: 5960
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5960
Summary:

ghttpd is a freely available, open source web server for Unix and Linux
variant systems.

A buffer overflow has been reported in ghttpd which will allow arbitrary
code to be executed with the privileges of the webserver.

The overflow occurs when the argument to a 'GET' request is of excessive
length. It is a stack-based overflow which may allow for attackers to
overwrite stack variables and execute arbitrary code on the underlying
host. The vulnerability occurs when excessively long 'GET' requests are
logged using the log() function without adequate bounds checking.

The webserver minimizes the risk of root compromise by dropping privileges
after it has bound to port 80. This vulnerability is still a serious
threat however, as remote attackers can gain access.

This vulnerability affects ghttpd versions 1.4.3 and earlier.

14. BEA WebLogic Server/Express/Integration Application Migration Security Policy Weakness
BugTraq ID: 5971
Remote: Yes
Date Published: Oct 15 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5971
Summary:

BEA Systems WebLogic Server is an enterprise level web and wireless
application server for Microsoft Windows and most Unix and Linux
distributions.

The affected products supported undocumented extensions for the Servlet
2.3 specification.  These extensions included additional URL mapping
syntax for web applications.  Since these extensions are no longer
supported in recent versions of the software, role mappings and security
policies may not carry over when web applications are migrated.  The
extensions allowed for URL patterns in web.xml files that did not start
with a '*.' or a '/' to be treated as though they were prefixed a '/'
character.

This may cause security to be inadvertently lowered when applications are
migrated.

15. Syslog-ng Remote Buffer Overflow Vulnerability
BugTraq ID: 5934
Remote: Yes
Date Published: Oct 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5934
Summary:

Syslog-NG is a portable syslog implementation. Its highlights include
regexp based log selection, TCP transport and more. It is available for
multiple platforms including Linux, Solaris, and FreeBSD.

A vulnerability has been discovered in syslog-ng.

When expanding macros, syslog-ng uses a buffer to store the expansion, and
a variable 'left', which is a value used to store the number of remaining
bytes in the buffer. When expanding constant characters, syslog-ng fails
to decrement the value of 'left'.

By passing an overly large amount of constant characters to a macro, it is
possible to trigger an overflow in the expansion buffer. This may memory
to be corrupted with values that may potentially be specified by an
attacker.

This issue could be exploited by a remote attacker; potentially resulting
in the execution of arbitrary system commands within the context of the
syslog-ng process.

Although discovered for version 1.4.15 and 1.5.20, it is likely that other
versions of the software are also vulnerable.

16. PHPReactor Browse.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 5939
Remote: Yes
Date Published: Oct 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5939
Summary:

php(Reactor) is an integrated system of web applications designed for
website maintenance. It will run on most Linux and Unix variants, in
addition to Microsoft Windows operating systems.

An attacker may create a malicious link to a php(Reactor) site which
contains malicious HTML and script code.  If this link is visited by a web
user, the attacker-supplied code will execute in their web client, in the
security context of the php(Reactor) site.

The problem exists in the 'browse.php' script.  HTML and script code can
be injected into URI parameters of this script, and will be output in a
webpage.  HTML tags are not sufficiently sanitized from the output.

This may allow for theft of cookie-based authentication credentials from
legitimate authenticated users.  Other attacks are also possible.

This issue has been reported in php(Reactor) version 1.2.7pl1.  Other
versions may also be affected.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Continuous medium traffic fake Syn packets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/295684

2. Followup: Continuous medium traffic fake Syn packets (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/294988


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. NetMAX Professional Suite
by Cybernet Systems
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Relevant URL:
http://www.netmax.com/products/pro_prods.html
Summary:

NetMAX Professional Suite provides a complete set of networking tools,
integrating NetMAX's FireWall ProSuite, Internet Server ProSuite, and
FileServer Suite (Linux) or FireWall, WebServer, and FileServer (FreeBSD)
into one comprehensive Internet appliance package. Our Professional Suite
enables you to use the power and reliability of either Linux or FreeBSD as
well as popular applications such as Apache, Sendmail, and Samba which are
integrated into this product. The browser-based interface helps you to
quickly and easily configure and manage the required network services,
freeing network administrators from routine tasks.

2. SMART Extractor
by WetStone Technologies
Platforms: Linux
Relevant URL:
http://www.wetstonetech.com/extractor.html
Summary:

WetStone Technologies, SM&A, the Computer Forensics Research and
Development Center (CFRDC), and the New York State Police Forensic
Investigation Center (NYSPFIC) have developed the Extractor, a Linux
RedHat® deleted file recovery tool. The technology can assist law
enforcement, government and commercial organizations in retrieving
maliciously or accidentally deleted files within the increasingly poplular
Linux operating system environment.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Packit v0.3.5
by Darren Bounds
Relevant URL:
http://www.intrusense.com/~dbounds/?select=projects
Platforms: FreeBSD, Linux, POSIX
Summary:

Packit is a network auditing tool that allows you to monitor, manipulate,
and inject customized IPv4 traffic into your network. This can be
extremely valuable for testing firewalls, intrusion detection systems,
port scanning, and general TCP/IP auditing. It currently supports the
ability to define nearly all Ethernet, TCP, and UDP header options, as
well as ICMP injection and packet capture. It requires libnet and libpcap,
and runs on FreeBSD and Linux.

2. auditunlink v0.0.1
by DJ Flux
Relevant URL:
http://sourceforge.net/projects/auditunlink
Platforms: Linux, POSIX
Summary:

auditunlink is a Linux shared library that intercepts the unlink system
call, and logs which process, program, and user initiated it, and to which
file the call was applied. It is designed to be loaded with LD_PRELOAD or
/etc/ld.so.preload, and allows system administrators to log file deletions
even if a user has the proper file system permissions to perform the
deletion.

3. procps v3.0.3
by Albert Cahalan
Relevant URL:
http://procps.sf.net/
Platforms: Linux
Summary:

procps is a package of utilities which report on the state of the system,
including the states of running processes, amount of memory available and
currently-logged-in users.