SecurityFocus Linux Newsletter #76

SecurityFocus Linux Newsletter #76
--------------------------------

This Issue is Sponsored by: Guardian Digital, Inc.

===> Build Complete Internet Presence Quickly and Securely!

EnGarde Secure Linux has everything necessary to create thousands of
virtual Web sites, manage e-mail, DNS, firewalling, and database functions
for an entire organization, all using a secure Web-based front-end.
Engineered to be secure and easy to use!

Don't jeopardize your organization with an off-the shelf Linux!

Click here to find out how to build a secure Internet presence.
http://www.guardiandigital.com/promo/sf150402.html

-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Securing Privacy, Part One: Hardware Issues
     2. Managing Intrusion Detection Systems in Large Organizations P2
     3. My Daily Virus
     4. SecurityFocus PDP Program
     5. Event Announcement
II. LINUX VULNERABILITY SUMMARY
     1. CSGuestbook Remote Command Execution Vulnerability
     2. CSNews Professional Remote Command Execution Vulnerability
     3. CSChat-R-Box Remote Command Execution Vulnerability
     4. CSLiveSupport Remote Command Execution Vulnerability
     5. Abyss Web Server Plaintext Administrative Password Vulnerability
     6. Abyss Web Server File Disclosure Vulnerability
     7. EMUMail HTTP Host Arbitrary Config File Loading Vulnerability
     8. IBM Informix Web Datablade Page Request SQL Injection...
     9. IBM Informix Web Datablade SQL Query HTML Decoding Vulnerability
     10. InterNetNews Multiple Local Format String Vulnerabilties
III. LINUX FOCUS LIST SUMMARY
     1. arp flood (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. NetSecure Web
     2. StoneGate High Availability Firewall
     3. AntiViral Toolkit Pro (AVP) workstation - Linux
V. NEW TOOLS FOR LINUX PLATFORMS
     1. EtherApe v0.8.2
     2. ifmonitor v0.25
     3. Securepoint Firewall and VPN Server SB v2.0.7
     4. Samhain v1.4.7
VI. SPONSORSHIP INFORMATION



I. FRONT AND CENTER
-------------------
1. Securing Privacy, Part One: Hardware Issues
by Scott Granneman

This article is the first of a series of three articles that will examine
privacy concerns as they relate to security. This article will examine
hardware-based privacy issues, specifically: hardware solutions for small
networks and wireless devices, hardware-based spyware, and some attempts
by hardware vendors to infringe upon users' privacy.

http://online.securityfocus.com/infocus/1568

2. Managing Intrusion Detection Systems in Large Organizations, Part Two
by Paul Innella, Oba McMillan, and David Trout, with assistance from
Rebecca Bace

This is the second part of a two-part series devoted to discussing the
implementation of intrusion detection systems in large organizations. In
the first installment, we looked at some of the challenges of planning,
integrating, and deploying IDSs in a large organization. In this
installment, we will look at managing agents in a distributed environment,
managing data from multiple IDS packages, and correlating data from
distributed agents.

http://online.securityfocus.com/infocus/1567

3. My Daily Virus
by George Smith

Why continue to run a "WildList" cataloging every virus in the world when
they all show up in our inboxes anyway?

http://online.securityfocus.com/columnists/73

4. SecurityFocus PDP Program

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

http://www.securityfocus.com/corporate/products/pdpsection.shtml

5. Event Announcement

Infotec 2002 Information Technology Expo & Conference, "Business
Technology in a Changing World---Are You in a Security State of Mind?"
(Omaha, Nebraska April 22-24, 2002).  Held in conjunction with Information
Security Awareness Week on April 20-26. Over 120 different sessions for
everyone; from novice to expert. Sessions range from 75 minutes to full
day depending on content; including HIPAA, Technical Security, Security
Management, and more. Keynotes include: Ryan Russell, SecurityFocus;
Marcus Ranum, NFR; Dr. Peter Neumann, SRI International; Dr. Douglas
Maughan, DARPA; and many more. For full details go to

http://www.infotec.org or contact [email protected]


II. BUGTRAQ SUMMARY
-------------------
1. CSGuestbook Remote Command Execution Vulnerability
BugTraq ID: 4448
Remote: Yes
Date Published: Apr 08 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4448
Summary:

csGuestbook is web guestbook software. It will run on most Unix and Linux
variants.

csGuestbook is prone to an issue which may enable an attacker to execute
Perl code with the privileges of the webserver process.

It is possible to craft a web request which is capable of passing
arbitrary data to the configuration script, including attacker-supplied
Perl code. Perl code passed in this manner will be interpreted by the
vulnerable script, effectively allowing a remote attacker to execute
arbitrary Perl code with the privileges of the webserver process.

For exploitation to be successful, the attacker must pass properly URL
encoded Perl code in CGI parameters via a web request. For example:

http://host/cgi-bin/csGuestbook.cgi?command=savesetup&setup=PERL_CODE_HERE

This issue may enable a remote attacker to gain local, interactive access
to the host running the vulnerable software.

2. CSNews Professional Remote Command Execution Vulnerability
BugTraq ID: 4451
Remote: Yes
Date Published: Apr 08 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4451
Summary:

csNews Professional is a script for managing news items on a website. It
will run on most Unix and Linux variants, as well as Microsoft Windows
operating systems.

csNews Professional is prone to an issue which may enable an attacker to
execute Perl code with the privileges of the webserver process.

It is possible to craft a web request which is capable of passing
arbitrary data to the configuration script, including attacker-supplied
Perl code. Perl code passed in this manner will be interpreted by the
vulnerable script, effectively allowing a remote attacker to execute
arbitrary Perl code with the privileges of the webserver process.

For exploitation to be successful, the attacker must pass properly URL
encoded Perl code in CGI parameters via a web request. For example:

http://host/cgi-bin/csNews.cgi?command=savesetup&setup=PERL_CODE_HERE

This issue may enable a remote attacker to gain local, interactive access
to the host running the vulnerable software.

3. CSChat-R-Box Remote Command Execution Vulnerability
BugTraq ID: 4452
Remote: Yes
Date Published: Apr 08 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4452
Summary:

csChat-R-Box is a web chat script. It will run on most Unix and Linux
variants, as well as Microsoft Windows operating systems.

csChat-R-Box is prone to an issue which may enable an attacker to execute
Perl code with the privileges of the webserver process.

It is possible to craft a web request which is capable of passing
arbitrary data to the configuration script, including attacker-supplied
Perl code. Perl code passed in this manner will be interpreted by the
vulnerable script, effectively allowing a remote attacker to execute
arbitrary Perl code with the privileges of the webserver process.

For exploitation to be successful, the attacker must pass properly URL
encoded Perl code in CGI parameters via a web request. For example:

http://host/cgi-bin/csChatRBox.cgi?command=savesetup&setup=PERL_CODE_HERE

This issue may enable a remote attacker to gain local, interactive access
to the host running the vulnerable software.

4. CSLiveSupport Remote Command Execution Vulnerability
BugTraq ID: 4450
Remote: Yes
Date Published: Apr 08 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4450
Summary:

csLiveSupport is a script for providing live web support. It will run on
most Unix and Linux variants, as well as Microsoft operating systems.

csLiveSupport is prone to an issue which may enable an attacker to execute
Perl code with the privileges of the webserver process.

It is possible to craft a web request which is capable of passing
arbitrary data to the configuration script, including attacker-supplied
Perl code. Perl code passed in this manner will be interpreted by the
vulnerable script, effectively allowing a remote attacker to execute
arbitrary Perl code with the privileges of the webserver process.

For exploitation to be successful, the attacker must pass properly URL
encoded Perl code in CGI parameters via a web request. For example:

http://host/cgi-bin/csLiveSupport.cgi?command=savesetup&setup=PERL_CODE_HERE

This issue may enable a remote attacker to gain local, interactive access
to the host running the vulnerable software.

5. Abyss Web Server Plaintext Administrative Password Vulnerability
BugTraq ID: 4467
Remote: No
Date Published: Apr 07 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4467
Summary:

Abyss Web Server is a freely available personal web server. It is
maintained by Aprelium Technologies and runs on Microsoft Windows
operating systems, as well as Linux.

The administrative password for Abyss Web Server is stored in plaintext in
the configuration file (abyss.conf). If a local attacker can read the
configuration file, they can trivially gain administrative access to the
web server.

Additionally, BugTraq ID 4466 "Abyss Web Server File Disclosure
Vulnerability" describes an issue which may also enable remote attackers
to trivially disclose the contents of the Abyss Web Server configuration
file.

Sensitive information about the web server's configuration may also be
disclosed as a result of this vulnerability.

This issue was reported for Abyss Web Server for Microsoft Windows
operating systems. It is not known whether the Linux version is also
affected by this vulnerability.

6. Abyss Web Server File Disclosure Vulnerability
BugTraq ID: 4466
Remote: Yes
Date Published: Apr 07 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4466
Summary:

Abyss Web Server is a freely available personal web server. It is
maintained by Aprelium Technologies and runs on Microsoft Windows
operating systems, as well as Linux.

Abyss Web Server does not filter certain types of potentially malicious
input from web requests.

It is possible for a remote attacker to disclose the contents of arbitrary
web-readable files by making a specially crafted web request containing
encoded dot-dot-slash (../) sequences. Such a request will enable the
attacker to browse files outside of the wwwroot directory.

This issue may be exploited by a remote attacker to gain access to the
administrative configuration file for the web server. Another known issue
regarding plaintext storage of the administrative password is described in
BugTraq ID 4467 "Abyss Web Server Plaintext Administrative Password
Vulnerability" .

This issue was reported for Abyss Web Server for Microsoft Windows
operating systems. It is not known whether the Linux version is also
affected by this vulnerability. Furthermore, it should be noted that web
servers on multi-user Windows operating systems generally run with SYSTEM
privileges.

7. EMUMail HTTP Host Arbitrary Config File Loading Vulnerability
BugTraq ID: 4488
Remote: No
Date Published: Apr 10 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4488
Summary:

Emumail is a web mail package available from Emumail, Inc.  It is designed
for use on Linux, Unix, and Windows systems.

A problem with the software could allow a user with local access to gain
elevated privileges.  The problem is in the handling of some types of
input.

When a user accesses emumail, emumail checks the HTTP Host variable.
Once this variable is received from the client, the server opens a file
using the variable.

Under some circumstances, it is possible for a local user to gain
privileges equal to the HTTP server process.  Upon connecting to the
server and supplying a malicious HTTP Host value to emumail, it could be
possible to force the program to open an arbitrary file.  This could
addition result in the execution of an arbitrary program, supplied by an
attacker with local access to the host.

This makes it possible for a local user to execute code with the
privileges of the HTTP process.

8. IBM Informix Web Datablade Page Request SQL Injection Vulnerability
BugTraq ID: 4496
Remote: Yes
Date Published: Apr 11 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4496
Summary:

Informix is an enterprise database distributed and maintained by IBM. The
Web Datablade Module for Informix SQL dynamically generates HTML content
based on Database data. Web Datablade is available for Apache, IIS, and
Netscape web servers, and a generic CGI version is provided for
alternative servers. It will execute under Windows NT, Linux and many
Unix-like systems.

A vulnerability has been reported in some versions of Web Datablade.
Reportedly, it is possible to inject SQL commands into any page request
processed by Web Datablade. This may result in the disclosure of sensitive
information or increased access to the database.

When a page request is recieved by Web Datablade, a database query is made
to retrieve the page contents. This query includes user supplied data
taken from the URL requested, and is not properly sanitized. An attacker
may include the double quotation character '"' and additional SQL
statements, subverting the intended query.

Exploitation may expose or modify sensitive information within the
database, including database user and password information. Usage of
procedures within the database may impact the underlying operating system.
It has been reported that the FileToClob() function may be used to expose
the contents of system files, including /etc/passwd. Usage of the
webexplode() function may allow the execution of arbitrary additional SQL
statements.

There have been reports that a similar issue exists within the HTTP Basic
Authentication process used by Web Datablade, which also submits queries
to the database. However, detailed exploitation information is not
available for this case.

9. IBM Informix Web Datablade SQL Query HTML Decoding Vulnerability
BugTraq ID: 4498
Remote: Yes
Date Published: Apr 11 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4498
Summary:

Informix is an enterprise database distributed and maintained by IBM. The
Web Datablade Module for Informix SQL dynamically generates HTML content
based on Database data. Web Datablade is available for Apache, IIS, and
Netscape web servers, and a generic CGI version is provided for
alternative servers. It will execute under Windows NT, Linux and many
Unix-like systems.

Web Datablade supports the function $(WEBUNHTML), which is used to HTML
encode characters such as '"' which may be dangerous if blindly included
in an SQL query. Reportedly, SQL queries executed by Web Datablade perform
a HTML decode operation before execution, undoing the work of the
$(WEBUNHTML) function.

If a developer was to rely upon this function to sanitize user supplied
input, insecure code may be created. This could increase the possibility
of SQL injection vulnerabilities in projects developed within the Web
Datablade system.

Exploitation of this vulnerability will depend upon the details of
projects developed within the Web Database architecture.

10. InterNetNews Multiple Local Format String Vulnerabilties
BugTraq ID: 4501
Remote: No
Date Published: Apr 11 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4501
Summary:

The Internet Software Consortium (ISC) InterNetNews (INN) project is a
powerful, mature implementation of a usenet system, including a NNTP
server and a newsreading server. It is available for a wide range of Unix
based systems, including Linux.

Multiple vulnerabilities have been reported in two components of INN,
inews and rnews. Reportedly, both are vulnerable to locally exploitable
format string problems. Under some systems these binaries may be installed
suid root or sgid news, allowing a local attacker to gain elevated
privileges.

It has also been reported that insecure open() calls may exist in some
binaries included with INN. Further details are not currently available.

More recent versions of INN may share these problems, this has not however
been confirmed. More recent versions of INN are reported to run with fewer
permissions, reducing the privileges which may be gained through
exploitation.


III. LINUX FOCUS LIST SUMMARY
----------------------------
1. arp flood (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]


IV. NEW PRODUCTS FOR LINUX PLATFORMS
--------------------------------
1. NetSecure Web
by NetSecure Software
Platforms: Linux, Solaris, Windows NT, AIX, BSDI
Relevant URL:
http://www.netsecuresoftware.com/netsecurenew/Products/NetSecureWeb/netsecureweb.html
Summary:

NetSecure Web enables you to create Internet services guaranteeing full
protection of your information system network. * Total access to internal
database server * Fully transparent for internal and external users *
Preserves your private network from intrusion * Ensures that only
authorized requests are delivered * Easy installation and operation

2. StoneGate High Availability Firewall
by Stonesoft
Platforms: Linux, Solaris, Windows NT, Windows 2000
Relevant URL:
http://www.stonesoft.com/products/main/StoneGate
Summary:

StoneGate provides the first fully scalable, high security and high
performance firewall and VPN solution for business critical applications.
StoneGate is the first firewall to provide secure connections and load
balancing between multiple ISPs to ensure continuous network connectivity.

3. AntiViral Toolkit Pro (AVP) workstation - Linux
by Kaspersky Labs
Platforms: Linux
Relevant URL:
http://www.kasperskylabs.com/
Summary:

AVP for Linux is a powerful system of anti-virus protection for
workstations and servers operating under Linux. The program uses the same
anti-virus database as other AVP products. Thus, Linux users are provided
with the same level of anti-virus defense as the users of other operating
systems.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. EtherApe v0.8.2
by Juan Toledo, [email protected]
Relevant URL:
http://etherape.sourceforge.net/
Platforms: Linux, NetBSD, Solaris
Summary:

EtherApe is a graphical network monitor for Unix modeled after etherman.
Featuring ether, ip and tcp modes, it displays network activity
graphically. Hosts and links change in size with traffic. Color coded
protocols display. It supports ethernet, fddi, ppp and slip devices. It
can filter traffic to be shown, and can read traffic from a file as well
as live from the network. Uses GNOME libraries and libpcap. Source. Linux
i386 binaries also available.

2. ifmonitor v0.25
by Edson Medina
Relevant URL:
http://ifmonitor.preteritoimperfeito.com/
Platforms: Linux
Summary:

ifmonitor is a network interface traffic logger and grapher for Linux. It
does not depend on SNMP, and it is written in Perl/PHP. It uses MySQL to
store its logs.

3. Securepoint Firewall and VPN Server SB v2.0.7
by Lutz Hausmann, [email protected]
Relevant URL:
http://www.securepoint.cc/download.htm
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Summary:

The Securepoint Firewall Server is a high-performance, commercial-grade
application designed to offer full protection for network assets. The
Securepoint is a complete software system with an operation system, based
on a secure Linux. You can use the firewall on a standard PC with two or
three network cards, and is easy to install and administer.

4. Samhain v1.4.7
by Rainer Wichmann, [email protected]
Relevant URL:
http://la-samhna.de/samhain/
Platforms: AIX, Digital UNIX/Alpha, FreeBSD, HP-UX, Linux, Solaris,
Unixware
Summary:

samhain is a file system integrity checker that can optionally be used as
a client/server application for centralized monitoring of networked hosts.
Databases and configuration files can be stored on the server. In addition
to forwarding reports to the log server via authenticated TCP/IP
connections, several other logging facilities (e-mail, console,
tamper-resistant log file, and syslog) are available. samhain has been
tested on Linux, AIX 4.1, HP-UX 10.20, Unixware 7.1.0, and Solaris 2.6.


VI. SPONSORSHIP INFORMATION
---------------------------
This Issue is Sponsored by: Guardian Digital, Inc.

==> Build Complete Internet Presence Quickly and Securely!

EnGarde Secure Linux has everything necessary to create thousands of
virtual Web sites, manage e-mail, DNS, firewalling, and database functions
for an entire organization, all using a secure Web-based front-end.
Engineered to be secure and easy to use!

Don't jeopardize your organization with an off-the shelf Linux!

Click here to find out how to build a secure Internet presence.
http://www.guardiandigital.com/promo/sf150402.html

-------------------------------------------------------------------------------