SecurityFocus Linux Newsletter #111
John Boletta <[email protected]> Mon, 16 Dec 2002 10:58:46 -0700 (MST)
| Newsgroups | gmane.comp.security.news.linux |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Linux Newsletter #111
-----------------------------------
This issue is sponsored by: Qualys
Strengthening Network Security: FREE Guide Network security is a
constantly moving target - even proven solutions lose their punch over
time. Find out how to get COMPLETE PROTECTION against ever-growing
security threats with our FREE new Guide.
Get your copy today at: https://www.qualys.com/forms/nsguideh_376.php
-------------------------------------------------------------------------------
I. FRONT AND CENTER
1. Securing Outlook, Part One: Initial Configuration
2. Rooting Out Corrupted Code
3. Drop that E-Book or I'll Shoot!
4. A Year-end Mailbag
5. SecurityFocus DPP Program
6. InfoSec World Conference and Expo/2003 (March 10-12, 2003,Orlando, FL)
II. LINUX VULNERABILITY SUMMARY
1. Akfingerd Remote Denial Of Service Vulnerability
3. SuSE GNUPlot French Documentation Buffer Overflow Vulnerability
4. Ultimate PHP Board Add.PHP Path Disclosure Vulnerability
5. Ultimate PHP Board ViewTopic.PHP Directory Contents Browsing...
6. Akfingerd File Disclosure Vulnerability
7. Ultimate PHP Board ViewTopic.PHP Cross Site Scripting...
8. vBulletin HTML Injection Vulnerability
9. ProFTPD STAT Command Denial Of Service Vulnerability
10. Ikonboard User Profile Photo URI HTML Injection Vulnerability
11. Ikonboard X-Forwarded-For: Proxy Header Field HTML Injection...
12. Canna Server Local Buffer Overflow Vulnerability
13. Xoops Private Message System Font Attributes HTML Injection...
14. Canna Server Denial Of Service Vulnerability
15. WGet NLST Client Side File Overwriting Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. NO NEW POSTS FOR THE WEEK ENDING 12.13.02
IV. NEW PRODUCTS FOR LINUX PLATFORM
1. BRU Backup and Restore Utility
2. Hardlock
3. SMART Extractor
V. NEW TOOLS FOR LINUX PLATFORMS
1. ssh-keyinstall v1.0.0
2. Smart Card ToolKit v0.3.2
3. Pixilate v0.1
VI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Securing Outlook, Part One: Initial Configuration
By Scott Granneman
Millions of Outlook users around the world, in homes, organizations, and
businesses, have had to face the insecurities inherent in their email
program, sometimes painfully. This article is the first of a two-part
article that will examine ways that Outlook users can secure their email
client.
http://online.securityfocus.com/infocus/1648
2. Rooting Out Corrupted Code
By Jon Lasser
Is there a backdoor on your system? A flawed but timely project from the
Shmoo Group could help network administrators spot altered programs.
http://online.securityfocus.com/columnists/129
3. Drop that E-Book or I'll Shoot!
By Mark Rasch
Last Thursday federal prosecutors wrapped up their direct case against
Russian software company ElcomSoft for creating and distributing software
that would "crack" Adobe's proprietary software designed to prevent
copying of electronic books - the defense will argue their side this week.
http://online.securityfocus.com/columnists/128
4. A Year-end Mailbag
By George Smith
"Why are you rambling?," and other feedback received by your anti-virus
columnist.
http://online.securityfocus.com/columnists/130
5. SecurityFocus DPP Program
Attention Universities!! Sign-up now for preferred pricing on the only
global early-warning system for cyber attacks - SecurityFocus DeepSight
Threat Management System.
Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml
6. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)
Optional Workshops March 8, 9, 12, 13, & 14 Vendor Expo March 10 & 11
Solutions to todays security concerns; hands-on experts; blockbuster
vendor expo; the CISO Executive Summit; invaluable networking
opportunities. InfoSec World has it all!
Go to: http://www.misti.com/10/os03nl37inf.html
II. BUGTRAQ SUMMARY
-------------------
1. Akfingerd Remote Denial Of Service Vulnerability
BugTraq ID: 6323
Remote: Yes
Date Published: Dec 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6323
Summary:
akfingerd is a small fingerd replacement server. It is available for Unix
and Linux operating systems.
A bug has been discovered in akfingerd that allows a remote attacker to
deny service to other legitimate users. This issue is due to a design flaw
which allows only one connection to the daemon at a time.
An attacker can exploit this vulnerability by connecting to the akfingerd
service. This will prevent akfingerd from responding to other legitimate
requests for service.
It should be noted that this vulnerability was discovered in akfingerd
0.5. It is not yet known whether earlier versions are affected.
2. Akfingerd Local Denial Of Service Attack
BugTraq ID: 6324
Remote: No
Date Published: Dec 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6324
Summary:
akfingerd is a small fingerd replacement. It is available for Unix and
Linux operating systems.
A bug has been discovered in akfingerd that makes it possible for a local
user to cause a denial of service. It is possible to trigger this issue by
creating a situation which allows the attacker to terminate the client
while the daemon is still writing data to the socket. This will cause a
SIGPIPE signal to be sent to the server. Due to insufficient handling of
the SIGPIPE signal, the akfingerd service will crash.
It should be noted that this vulnerability was discovered in akfingerd
0.5. It is not known whether earlier versions are also affected.
3. SuSE GNUPlot French Documentation Buffer Overflow Vulnerability
BugTraq ID: 6329
Remote: No
Date Published: Dec 06 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6329
Summary:
GNUPlot is an interactive function plotting program. It is used to plot
data and functions in a graphical format.
A buffer overflow vulnerability has been reported for GNUPlot shipped with
SuSE Linux. Reportedly, the vulnerability exists in the French
documentation and may allow an attacker to gain control over the execution
of the gnuplot process.
This vulnerability is exacerbated by the fact that gnuplot is typically
installed setuid root on some SuSE distributions.
Precise technical details about the nature of the vulnerability are
currently unknown. This BID will be updated as more information becomes
available.
4. Ultimate PHP Board Add.PHP Path Disclosure Vulnerability
BugTraq ID: 6333
Remote: Yes
Date Published: Dec 07 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6333
Summary:
Ultimate PHP Board (UPB) is a freely available, open source PHP Bulletin
Board. It is available for the Unix and Linux operating systems.
A problem has been discovered in UPB that could lead to the disclosure of
potentially sensitive information.
Under some circumstances, it may be possible to gain access to sensitive
information, such as the installation path of UPB. By passing an
erroneous request to the add.php script, UPB may return the full path to
the installation. This could lead to the disclosure of sensitive
information, and potentially lead to further attack.
5. Ultimate PHP Board ViewTopic.PHP Directory Contents Browsing Vulnerability
BugTraq ID: 6334
Remote: Yes
Date Published: Dec 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6334
Summary:
Ultimate PHP Board (UPB) is a freely available, open source PHP Bulletin
Board. It is available for the Unix and Linux operating systems.
A problem has been discovered in UPB that could lead to the disclosure of
the contents of directoires.
Under some circumstances, it may be possible to disclose the contents of
directories. By passing a malicious request to the viewtopic.php script,
UPB may return a listing of the directory. This could be futher refined
to disclose the contents of selected files.
This could lead to the disclosure of sensitive information, and
potentially lead to further attack. It should be noted that the ability
of the attacker to read information is limited to the privileges of the
web server. Additionally, it is thought that an attacker may not read
directories above the data_dir directory used by UPB.
6. Akfingerd File Disclosure Vulnerability
BugTraq ID: 6325
Remote: No
Date Published: Dec 05 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6325
Summary:
akfingerd is a small fingerd replacement server. It is available for Unix
and Linux operating systems.
A vulnerability has been discovered in akfingerd that may allow attackers
to view the contents of potentially sensitive files. This issue is due to
the daemon failing to drop supplementary group privileges, as well as
insufficient sanity file checks against a users '.plan' file.
By making the '.plan' file a symbolic link to an arbitrary system
resource, it is possible to cause akfingerd to disclose the symlinked
file's contents. Information gained by exploiting this issue may aid the
attacker in launching further attacks against the system.
It should be noted that this vulnerability was discovered in akfingerd
0.5. It is not yet known whether earlier versions are affected.
7. Ultimate PHP Board ViewTopic.PHP Cross Site Scripting Vulnerability
BugTraq ID: 6335
Remote: Yes
Date Published: Dec 08 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6335
Summary:
Ultimate PHP Board (UPB) is a freely available, open source PHP Bulletin
Board. It is available for the Unix and Linux operating systems.
A problem has been discovered in UPB that could lead to cross site
scripting attacks.
By passing a malicious script code to the viewtopic.php script, UPB may
return the script code to the browser of the user visiting the malicious
URL. This could lead to the execution of HTML and script code in the
security context of the UPB site.
8. vBulletin HTML Injection Vulnerability
BugTraq ID: 6337
Remote: Yes
Date Published: Dec 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6337
Summary:
vBulletin is commercial web forum software written in PHP and back-ended
by a MySQL database. It will run on most Linux and Unix variants, as well
as Microsoft operating systems.
Problems with vBulletin could make it possible for an attacker to inject
arbitrary HTML in vBulletin forum messages.
vBulletin does not sufficiently filter potentially malicious HTML code
from posted messages. As a result, when a user chooses to view a message
posting that contains malicious HTML code, the code contained in the
message would be executed in the browser of the vulnerable user. This will
occur in the context of the site hosting the vBulletin forum software.
Attackers may potentially exploit this issue to manipulate web content or
to steal cookie-based authentication credentials. It may be possible to
take arbitrary actions as the victim user.
This vulnerability was reported for vBulletin 2.2.7 and 2.2.8. It is not
known whether other versions are affected.
9. ProFTPD STAT Command Denial Of Service Vulnerability
BugTraq ID: 6341
Remote: Yes
Date Published: Dec 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6341
Summary:
ProFTPD is a popular FTP server that ships with numerous Unix and Linux
variants.
A denial of service vulnerability has been reported for ProFTPD. It is
possible to cause ProFTPD from responding to legitimate requests for
service by issuing specially crafted STAT commands. This will result in a
denial of service condition.
An attacker can exploit this vulnerability by logging on to a vulnerable
FTP server and issuing a STAT command composed of several '/*' characters.
When the FTP server receives this command, it will result in a denial of
service condition.
This vulnerability has been reported to affect ProFTPD 1.2.7rc3 and
earlier.
** This issue is closely related to the vulnerability described in BID
2496.
10. Ikonboard User Profile Photo URI HTML Injection Vulnerability
BugTraq ID: 6342
Remote: Yes
Date Published: Dec 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6342
Summary:
Ikonboard is a web-based bulletin board system implemented in Perl. It may
be installed under Linux, Windows, or many Unix platforms.
Ikonboard is prone to a vulnerability which may enable an attacker to
cause arbitrary HTML and script code to be interpreted by the web client
of other Ikonboard users.
Ikonboard allows users to post a link in their user profile to an external
picture. Ikonboard does not sufficiently sanitize HTML from these photo
URIs in user profiles. An attacker may take advantage of this issue to
embed malicious script code into their user profile. When the profile is
viewed by other users, the attacker-supplied script code will execute in
the security context of the site hosting the Ikonboard software.
Exploitation may allow an attacker to steal cookie-based authentication
credentials or to manipulate web content.
This issue was reported in Ikonboard 3.1.1. Other versions may also be
affected.
11. Ikonboard X-Forwarded-For: Proxy Header Field HTML Injection Vulnerability
BugTraq ID: 6343
Remote: Yes
Date Published: Dec 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6343
Summary:
Ikonboard is a web-based bulletin board system implemented in Perl. It may
be installed under Linux, Windows, or many Unix platforms.
Ikonboard is prone to HTML injection attacks via X-Forwarded-For: HTTP
header fields for proxies. The HTTP X-Forwarded-For: header field is used
by many proxy server implementations to indicate the original source of a
request that has been forwarded by the proxy. When Ikonboard is accessed
via a proxy, it will log the user's IP address as the address that appears
in the X-Forwarded-For: HTTP header field. HTML will not be sanitized
when this information in the HTTP header field is logged. When an
administrator views the logged IP address, script code supplied via a
malicious X-Forwarded-For: HTTP header field will be executed in the web
client of the administrator.
While the data in the header field is limited to 16 characters, it may be
possible to embed malicious script code or HTML over multiple requests.
Successful exploitation may enable a remote attacker to steal cookie-based
authentication credentials from an administrative user.
This issue was reported in Ikonboard 3.1.1. Other versions may also be
affected.
12. Canna Server Local Buffer Overflow Vulnerability
BugTraq ID: 6351
Remote: No
Date Published: Dec 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6351
Summary:
Canna is a kana-kanji conversion server which is necessary for Japanese
language character input. It is available for the Linux operating system.
A buffer overflow vulnerability has been discovered in Canna. Exploiting
this issue may allow an attacker to overwrite sensitive locations in
memory. It may be possible to run arbitrary system commands, with 'bin'
level privileges, by redirecting program flow to execute attacker-supplied
instructions.
It should be noted that Canna is typically installed only when Japanese
language support is enabled.
Precise technical details regarding this vulnerability are not yet known.
This BID will be updated as more information becomes available.
13. Xoops Private Message System Font Attributes HTML Injection Vulnerability
BugTraq ID: 6344
Remote: Yes
Date Published: Dec 09 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6344
Summary:
Xoops is open-source, freely available web portal software written in
object-oriented PHP. It is back-ended by a MySQL database and will run on
most Unix and Linux distributions.
Xoops includes a Private Message System for users, so that they may send
messages to one another. HTML tags used for font attributes, including
bold, italic and underline tags, are not sufficiently filtered of HTML
code. This makes it possible for an attacker to supply malicious input in
the HTML font tags that contain arbitrary script code. When another user
receives the attacker's private message, the malicious script code will be
executed on that user in the context of the site running Xoops.
This issue may be exploited by an attacker to steal a legitimate user's
cookie-based authentication credentials, potentially making it possible to
hijack the users session.
This vulnerability has been reported for Xoops 1.3.5.
14. Canna Server Denial Of Service Vulnerability
BugTraq ID: 6354
Remote: Yes
Date Published: Dec 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6354
Summary:
Canna is a kana-kanji conversion server which is necessary for Japanese
language character input. It is available for the Linux operating system.
A vulnerability has been discovered in Canna. It has been reported that
due to insufficient request validation it is possible for a remote
attacker to crash the Canna server. Under some circumstances it may also
be possible to cause information leakage.
It should be noted that Canna is typically installed only when Japanese
language support is enabled.
Precise technical details regarding this vulnerability are not yet known.
This BID will be updated as more information becomes available.
15. WGet NLST Client Side File Overwriting Vulnerability
BugTraq ID: 6352
Remote: Yes
Date Published: Dec 10 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6352
Summary:
wget is a freely available, open source FTP utility. It is included with
many Unix and Linux operating systems.
A problem with wget may result in the overwriting of arbitrary files.
wget does not properly handle some types of server responses. When a NLST
response is received from an FTP server, RFC specifications require that
clients check the input to see if it contains directory information.
wget does not properly check this information, which may allow a remote
FTP server to overwrite files on the client system.
It should be noted that this vulnerability requires an FTP server to know
the path to the file to be overwritten. Additionally, this vulnerability
may be exploited to overwrite only those files which are write-permissible
by the FTP client user.
IV. LINUX FOCUS LIST SUMMARY
----------------------------
1. NO NEW POSTS FOR THE WEEK ENDING 12.13.02
IV. NEW PRODUCTS FOR LINUX PLATFORM
-----------------------------------
1. BRU Backup and Restore Utility
by Enhanced Software Technologies
Platforms: Solaris
Relevant URL:
http://www.bru.com/
Summary:
BRU has been providing Backup You Can Trust[SM] to the Unix community
since 1985 and for Linux since 1994. This software is provides a backup
solution to UNIX/Linux on multiple platforms and architectures.
2. Hardlock
by Aladdin Knowledge Systems
Platforms: Propietary Hardware
Relevant URL:
http://www.ealaddin.com/hardlock/index.asp
Summary:
If you develop applications for multiple operating environments, we invite
you to test drive the new HASP4, the latest generation in software
protection solutions. HASP4 is the only true cross-platform solution
available on the market, providing a solid foundation of reliability,
ease-of-use and state-of-the-art security. With HASP4 USB, a single key
will protect Windows, Mac and Linux applications.
3. SMART Extractor
by WetStone Technologies
Platforms: Linux
Relevant URL:
http://www.wetstonetech.com/extractor.html
Summary:
WetStone Technologies, SM&A, the Computer Forensics Research and
Development Center (CFRDC), and the New York State Police Forensic
Investigation Center (NYSPFIC) have developed the Extractor, a Linux
RedHat® deleted file recovery tool. The technology can assist law
enforcement, government and commercial organizations in retrieving
maliciously or accidentally deleted files within the increasingly poplular
Linux operating system environment.
V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. ssh-keyinstall v1.0.0
by William Stearns
Relevant URL:
http://www.stearns.org/ssh-keyinstall/
Platforms: Linux, POSIX
Summary:
ssh-keyinstall is a script that helps an ssh user set up the keys at both
ends of an ssh connection. It creates an rsa or dsa key if needed and
copies the public half to the server. Once the process is done, you'll be
able to log in with the passphrase and key instead of a password.
2. Smart Card ToolKit v0.3.2
by Alexandre Becoulet
Relevant URL:
http://etud.epita.fr/~becoul_a/sctk
Platforms: Linux, POSIX
Summary:
Smart Card ToolKit provides a library and associated tools for smart
cards. Phoenix and Smartmouse protocols are supported for ISO7816
asynchronous smart card access and debugging. JDM is supported for
programming PIC-based smart cards like piccard, goldwafer (goldcard), and
silvercard. SPI is supported for programming AVR based smart cards
(funcard). PIC and AVR loaders provide access to external i2c EEPROM. I2c
memory smart cards are also supported. All tools use Intel hex file format
to store data. An Intel hex to binary and vice-versa converting tool is
also provided.
3. Pixilate v0.1
by Kirby Kuehl [email protected]
Relevant URL:
http://winfingerprint.sourceforge.net/pixilate.php
Platforms: FreeBSD, Linux, NetBSD, OpenBSD
Summary:
Pixilate is a packet generation tool based off of Libnet 1.1.0 (Older
Libnet 1.0.x versions will not work). Pixilate generates packets by
parsing a file that contains ACLs in either Cisco IOS format (using the -r
option) or in Cisco PIX 6.2x format. Currently TCP, UDP, IGMP, and various
types of ICMP packets are built with the appropriate source and
destination for each rule. "any" as a source generates a random source
address and "any" as a destination will send the packet to the user
supplied destination (-d option). For more information, see the pixilate
manpage.
VI. SPONSOR INFORMATION
-----------------------
This issue is sponsored by: Qualys
Strengthening Network Security: FREE Guide Network security is a
constantly moving target - even proven solutions lose their punch over
time. Find out how to get COMPLETE PROTECTION against ever-growing
security threats with our FREE new Guide.
Get your copy today at: https://www.qualys.com/forms/nsguideh_376.php
-------------------------------------------------------------------------------