SecurityFocus Linux Newsletter #105

SecurityFocus Linux Newsletter #105
-----------------------------------
This issued sponsored by: SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:

http://www.securityfocus.com/corporate/products/dpsection.shtml
---------------------------------------------------------------

I. FRONT AND CENTER
     1. Scary Movies
     2. Responsible Disclosure by Corporate Fiat
     3. Attack of the Mod Squads
     4. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)

II. LINUX VULNERABILITY SUMMARY
     1. Benjamin Lefevre Dobermann Forum Remote File Include Vuln
     2. phpBB2 Unauthorized Administrative Access Vuln
     3. Arescom NetDSL-800 Firmware Undocumented Username/Password...
     4. Jason Orcutt Prometheus Remote File Include Vuln

III. LINUX FOCUS LIST SUMMARY
      1. Administrivia: Out for a wedding (Thread)

IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Easycrypt
     2. CASQUE Systems
     3. CyberGuard VPN
     4. CyberGuard Firewall/VPN Appliances

V. NEW TOOLS FOR LINUX PLATFORMS
     1. PCX Firewall v2.17
     2. spews2fw v0.3

VI. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Scary Movies

Hollywood's creative geniuses have launched a new horror genre: the
computer virus slasher film. How did we live without this?

http://online.securityfocus.com/columnists/121

2. Responsible Disclosure by Corporate Fiat

The new Organization for Internet Safety aims to make vulnerability
disclosure more responsible. It's a good idea, but is the group too
corporate to pull it off?

http://www.online.securityfocus.com/columnists/120

3. Attack of the Mod Squads

Game console mod chips can be used for everything from watching movies to
installing Linux on your X-Box. But under goofy copyright laws, the piracy
app kills all the others.

http://online.securityfocus.com/columnists/119

4. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)
Optional Workshops March 8, 9, 12, 13, & 14
Vendor Expo March 10 & 11

Solutions to today's security concerns; hands-on experts; blockbuster
vendor expo; the CISO Executive Summit; invaluable networking
opportunities.  InfoSec World has it all! Go to:

http://www.misti.com/10/os03nl37inf.html

II. LINUX VULNERABILITY SUMMARY
-------------------------------

1. Benjamin Lefevre Dobermann Forum Remote File Include Vulnerability
BugTraq ID: 6057
Remote: Yes
Date Published: Oct 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6057
Summary:

Dobermann Forum is a Web forum implemented in PHP. It is available for
Unix and Linux variants as well as Microsoft Windows operating systems.

Dobermann Forum is prone to an issue which may allow remote attackers to
include arbitrary files located on remote servers. This issue is present
in the following PHP script files provided with Dobermann Forum:
entete.php enteteacceuil.php topic/entete.php index.php newtopic.php

An attacker may exploit this by supplying a path to a maliciously created
'banniere.php' file, located on an attacker-controlled host as a value for
the 'subpath' parameter.

If the remote file is a PHP script, this may allow for execution of
attacker-supplied PHP code with the privileges of the webserver.
Successful exploitation may provide local access to the attacker.

2. phpBB2 Unauthorized Administrative Access Vulnerability
BugTraq ID: 6056
Remote: Yes
Date Published: Oct 28 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6056
Summary:

phpBB2 is an open-source web forum application that is written in PHP and
supported by a number of database products. It will run on most Unix and
Linux variants, as well as Microsoft Windows operating systems.

The admin_ug_auth.php script is used by phpBB administrators to specify
user privileges. Depending on the permissions set via admin_ug_auth.php,
administrative privileges may be required to view certain pages.

A vulnerability has been discovered the admin_ug_auth.php script, which
allows malicious users to post responses to administrative pages, without
the need to view them. By constructing a malicious response, it may be
possible for an unauthorized user to grant 'administrator' privileges to
arbitrary users.

Exploiting this issue could allow a remote attacker to gain complete
control of a target forum.

It has been reported that third party utilities that use phpBB v2.0.0 may
also be vulnerable to this issue.

3. Arescom NetDSL-800 Firmware Undocumented Username/Password Weakness
BugTraq ID: 6064
Remote: Yes
Date Published: Oct 29 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6064
Summary:

The Arescom NetDSL 800 series ADSL modem/router is a stand-alone device.
It is compatible with various operating systems including Windows, MacOS,
Unix, and Linux.

A weakness has been discovered in NetDSL-800 router firmware.

It has been reported that NetDSL-800 firmware, configured by certain
Internet Service Providers(ISP), contain undocumented users. Undocumented
users have administrative privileges.

It is possible to obtain a target devices undocumented username and
password using a network sniffer and the Arescom NetDSL Remote Manager.
Access to this information could grant unauthorized administrative access
to remote attackers.

Administrative privileges gained on target routers may allow attackers to
corrupt configuration settings or cause a denial of service.

It should be noted that all firmware configurations may not contain
undocumented users. Firmware configured by the MSN ISP are reported to be
vulnerable.

It should also be noted that it has not yet been confirmed whether unique
username and passwords are generated for each device.

4. Jason Orcutt Prometheus Remote File Include Vulnerability
BugTraq ID: 6087
Remote: Yes
Date Published: Nov 01 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6087
Summary:

Jason Orcutt Prometheus is a collection of tools to facilitate the design
and implementation of active content Web sites. It is implemented in PHP
and is available for Unix and Linux variants as well as Microsoft Windows
operating systems.

Prometheus is prone to an issue which may allow remote attackers to
include arbitrary files located on remote servers. This issue is present
in the following PHP script files provided with Prometheus:
index.php
install.php
test_*.php

An attacker may exploit this by supplying a path to a maliciously created
'autoload.lib' file, located on an attacker-controlled host as a value for
the 'PROMETHEUS_LIBRARY_BASE' parameter.

If the remote file is a PHP script, this may allow for execution of
attacker-supplied PHP code with the privileges of the webserver.
Successful exploitation may provide local access to the attacker.


III. LINUX FOCUS LIST SUMMARY
---------------------------------

1. Administrivia: Out for a wedding (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/297950

IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Easycrypt
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.easycrypt.co.uk/

EasyCrypt is a file encryption software program - a cryptographic product
with the versatility to protect all PC based files or folders from
unauthorised disclosure, even where the PC itself is shared between
individuals.

2. CASQUE Systems
by Distributed Management Systems (DMS)
Platforms: Os Independent
Relevant URL: http://www.dms-soft.com/casque_components.htm

CASQUE provides components to build secure systems with Strong
Authentication, Authorisation and Key Update on local or wide area
networks or www.

3. CyberGuard VPN
by CyberGuard
Platforms: N/A
Relevant URL: http://www.cybg.com/SOLUTIONS/product_vpn.cfm

Securing connections across an enterprise is precisely what CyberGuard?s
VPN is designed to do. Because it is integrated into the world?s most
secure firewall appliances, the CyberGuard VPN offers numerous advantages
to network administrators, whether you need to connect securely on a
local, regional, national or worldwide scale.

4. CyberGuard Firewall/VPN Appliances
by CyberGuard
Platforms: N/A
Relevant URL: http://www.cybg.com/SOLUTIONS/product_intro.cfm

The KS, SL, FS and LX series of premium firewall/VPN appliances from
CyberGuard carry on a strong tradition of offering the world's most secure
firewalls. CyberGuard has been developing its extensive knowledge and
expertise in security systems, designing and implementing the best
performing, easiest to use and most secure network solutions for the
world's most demanding customers: major banks, financial institutions,
corporations and governments. Today, with the offering of appliance
firewalls, security is almost "plug and play" as our firewalls are
delivered pre-loaded on an appliance -- ready to install and protect your
network.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. PCX Firewall v2.17
by James A. Pattie
Relevant URL: http://pcxfirewall.sourceforge.net/
Platforms: Linux, POSIX

PCX Firewall is an IPTables firewalling solution that uses Perl to
generate static shell scripts based upon the user's configuration
settings. This allows the firewall to startup quickly, as it does not have
to parse config files every time it starts.

2. spews2fw v0.3
by Robert Maxwell
Relevant URL: http://online.securityfocus.com/tools/2921
Platforms: POSIX, UNIX

spews2fw is a Perl script that will automatically download the Level 1 or
Level 2 listings from spews.org and generate firewall rulesets for
ipchains, iptables, pf, ipf, and Cisco. It then writes out the generated
ruleset to a file, which can be loaded onto the specified firewall type.


VI. SPONSOR INFORMATION
-----------------------

This issue brought to you by: SecurityFocus DPP Program

Attention Non-profit Organizations and Universities!! Sign-up now for
preferred pricing on the only global early-warning system for cyber
attacks - SecurityFocus DeepSight Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml