SecurityFocus Linux Newsletter #77

SecurityFocus Linux Newsletter #77
----------------------------------

This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml
-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. VBA Emulation: A Viable Method of Macro Virus Detection? Part One
     2. Network Intrusion Detection Signatures, Part Five
     3. Closing the Spycam Sniffer Loophole
     4. Peddling Snake Oil as Security
     5. Openwall: Improving Security with the Openwall Patch
     6. Cutting-Edge High Tech Crime Fighting: Best Practices...
II. LINUX VULNERABILITY SUMMARY
     1. WebTrends Reporting Center GET Request Buffer Overflow...
     2. XPilot Server Remote Buffer Overflow Vulnerability
     3. Burning Board URL Parameter Manipulation Vulnerability
     4. xNewsletter Form Field Input Validation Vulnerability
     5. PVote Poll Content Manipulation Vulnerability
     6. SSH Restricted Shell Escaping Command Execution Vulnerability
     7. IcrediBB Script Injection Vulnerability
     8. Pipermail/Mailman Insecure Archives Permissions Vulnerability
     9. PVote Unauthorized Administrative Password Change Vulnerability
     10. PostBoard Topic Title Script Execution Vulnerability
     11. PostBoard BBCode Denial Of Service Vulnerability
     12. PostBoard BBCode IMG Tag Script Injection Vulnerability
     13. Demarc PureSecure Authentication Check SQL Injection...
III. LINUX FOCUS LIST SUMMARY
     1. HiverCon 2002 (Thread)
     2. No Root Shell with SUID /bin/bash (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. hp secure OS software for Linux
     2. Phoenix Adaptive Firewall
     3. T.REX Firewall
V. NEW TOOLS FOR LINUX PLATFORMS
     1. TinyCA v0.3.0
     2. Nessus v1.2.0
     3. Sophie v1.33rc3
     4. Cisco IP Accounting Fetcher v1.4.3
VI. SPONSORSHIP INFORMATION



I. FRONT AND CENTER
-------------------
1. VBA Emulation: A Viable Method of Macro Virus Detection? Part One
by Gabor Szappanos

This article is the first in a two-part series that will examine some of
the problems that exist with emulation, with the end in mind of
determining whether or not it is a realistic anti-virus method.

http://online.securityfocus.com/infocus/1571

2. Network Intrusion Detection Signatures, Part 5
by Karen Kent Frederick

This is the fifth and final installment in a series of articles on
understanding and developing signatures for network intrusion detection
systems. In the previous article, we looked at the topic of protocol
analysis, meaning that the intrusion detection system actually understands
how various protocols, such as FTP, are supposed to work. We initially
looked at protocol analysis as it applied to a single request or response.
In this article, we will extend this discussion by looking closely at
stateful protocol analysis, which involves performing protocol analysis
for an entire connection or session, capturing and storing certain pieces
of relevant data seen in the session, and using that data to identify
attacks that involve multiple requests and responses.

http://online.securityfocus.com/infocus/1569

3. Closing the Spycam Sniffer Loophole
by Mark Rasch

Those cheap wireless video cameras hawked by annoying pop-up ads can be
intecepted by anyone with a few hundred dollars and a voyeristic bent.
There's no federal law against it, but there should be.

http://online.securityfocus.com/columnists/76

4. Peddling Snake Oil as Security
Richard Forno

Recently, I received an invitation to speak at a plenary session for an
upcoming conference on wireless security. While the conference venue was
first-rate and they were covering all my expenses, I had to be honest with
the conference coordinators and decline the invitation.

http://online.securityfocus.com/columnists/75

5. Openwall: Improving Security with the Openwall Patch
by Zeshan Ghory

This article will examine the Openwall Linux kernel Patch, one of the
best-known kernel hardening patches. It will explain how to install the
patch and will examine its main features. Using the patch will require a
basic understanding of how to recompile the kernel. Some of the
explanations will assume a basic knowledge of the C programming language,
but it is not essential to the usage of the patch.

http://online.securityfocus.com/infocus/1570

6. Cutting-Edge High Tech Crime Fighting: Best Practices in Computer
Forensics
June 17-18, 2002
American Management Association, Washington, DC

Walk away able to perform computer forensic examinations that will not
only yield sound evidence but will also hold up in a court of law! Learn
to find, collect and preserve digital evidence, and present the evidence
in court. Also learn to successfully combine private and public computer
forensics forces to investigate computer crimes. Keynote speech by
Microsoft's Chief Security Strategist Scott Charney. Public sector
employee discounts available.

For more information, call 800-280-8440, or visit www.frallc.com (see
InfoTech events).


II. BUGTRAQ SUMMARY
-------------------
1. WebTrends Reporting Center GET Request Buffer Overflow Vulnerability
BugTraq ID: 4531
Remote: Yes
Date Published: Apr 17 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4531
Summary:

WebTrends Reporting Center is used to organize and present usage
information for multiple server web environments. Reporting Center is
available for Windows NT and 2000, Linux and Solaris.

A vulnerability has been reported in some versions of WebTrends Reporting
Center. If an oversized GET request is received by the server, a memory
buffer will overflow. Exploitation may result in the execution of
arbitrary code with SYSTEM privileges. Sending arbitrary data may cause
the server to crash, resulting in a denial of service condition.

This attack is only possible for an authenticated user. However, anonymous
authentication is also sufficient, meaning that any public reports
produced by WebTrends may present an avenue of attack.

This vulnerability has only been confirmed to exist on Windows versions of
the Reporting Center.

2. XPilot Server Remote Buffer Overflow Vulnerability
BugTraq ID: 4534
Remote: Yes
Date Published: Apr 17 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4534
Summary:

XPilot is a multi-player 2D space game.  It is available for variants of
the Linux operating system.

A remotely exploitable buffer overflow has been discovered in the XPilot
server.  This is due to improper bounds checking of externally supplied
data.

A remote attacker who exploits this issue may cause locations in memory to
be overwritten with arbitrary data.  This may allow a remote attacker to
execute arbitrary instructions with the privileges of the xpilot server
process.

3. Burning Board URL Parameter Manipulation Vulnerability
BugTraq ID: 4512
Remote: Yes
Date Published: Apr 15 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4512
Summary:

Burning Board is web forum software.  It is written in PHP, back-ended by
MySQL, and will run on most Unix and Linux variants as well as Microsoft
Windows.

An attacker may allegedly create a malicious link which is capable of
causing actions to be performed on the behalf of a legitimate Burning
Board user who visits the link.  To exploit this vulnerability, the
attacker must manipulate URL parameters in the malicious link in such a
way as to cause the desired actions to be performed by a user who visits
the link.  The legitimate forum user must also be authenticated via a
cookie-based authentication credential.  The link may include BBCode.

If the attacker launches this attack via a malicious attacker-controlled
webpage, then it is trivial for the attacker to write a script to conceal
that unauthorized actions have been performed on the behalf of the
legitimate user.  The attacker's script would most likely redirect the
user to an expected webpage after the attack has been performed.
Otherwise, it is possible the user may discover that an attempt has been
made to perform actions on their behalf.

This might be exploited by an attacker to cause an arbitrary
attacker-supplied forum message to be posted by a legitimate user who
visits the malicious webpage.

It has been reported, but not confirmed, that other web forum software
(such as phpBB) may also be affected by this vulnerability.

4. xNewsletter Form Field Input Validation Vulnerability
BugTraq ID: 4516
Remote: Yes
Date Published: Apr 14 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4516
Summary:

xNewsletter is a script that allows web users to subscribe to a
newsletter.  It is written in PHP and will run on most Unix and Linux
variants, as well as Microsoft Windows operating systems.

xNewsletter does not sanitize dangerous characters from form field input
such as the e-mail address of the newsletter recipient.

It has been demonstrated that this condition may be exploited to cause
multiple instances of the same e-mail address to be written to the
datafile.  For example, the "%" character is used to seperate e-mail
addresses in the datafile.  If this character is included as part of an
e-mail address, the script assumes that it is a new e-mail address and
does not check to see if the e-mail address already exists in the
datafile.  Multiple instances of the same address can be added by using
the "%" character to seperate each instance.  An attacker may effectively
trick the script into mail bombing an arbitrary e-mail address.

It has also been demonstrated that PHP code may be included to enable the
attacker may cause arbitrary data to be written to the datafile in such a
way that it cannot be removed using the facilities provided by
xNewsletter.  The malformed data must be removed from the datafile
manually.

It may also be possible, under some circumstances, to execute remote
commands via the inclusion of attacker-supplied PHP code.  Though this
possibility has not been confirmed.

These two consequences of insufficent validation of form input may be
exploited in conjunction with each other.

5. PVote Poll Content Manipulation Vulnerability
BugTraq ID: 4540
Remote: Yes
Date Published: Apr 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4540
Summary:

PVote is a web voting system written in PHP.  It will run on most Unix and
Linux variants as well as Microsoft Windows operating systems.

It is possible for a remote attacker to add/delete web polls just by
manipulating the values of URL parameters.  No authentication credentials
are required for the attacker to perform these actions.  This may enable a
remote attacker to manipulate some of the content on a website running the
voting system.

6. SSH Restricted Shell Escaping Command Execution Vulnerability
BugTraq ID: 4547
Remote: No
Date Published: Apr 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4547
Summary:

SSH (and derivatives) is the protocol Secure Shell protocol
implementation.  It is available for various operating systems, although
this vulnerability affects operating systems such as Unix and Linux.

A problem with the package could make it possible for remote users to
execute unauthorized programs.  The problem is in the handling of command
line execution.

Most versions of SSH permit the execution of commands remotely via the
supplying the command name wrapped in single quotes.  This can allow
remote users to execute commands without logging directly into a shell on
the system.

It has been reported that it is possible for a remote user to upload files
to world-writeable directories, and execute commands from world-writeable
directories.  In doing so, a user may be able to upload a script, and
execute the script to gain access to a regular shell on the system.  This
would allow the user unrestricted, but unprivileged access.

SecurityFocus staff have been unable to reproduce this vulnerability with
OpenSSH version 3.1p1.

7. IcrediBB Script Injection Vulnerability
BugTraq ID: 4548
Remote: Yes
Date Published: Apr 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4548
Summary:

IcrediBB is freely available web forum software.  It is written in PHP and
will run on most Unix and Linux variants, as well as Microsoft Windows
operating systems.

IcrediBB does not adequately filter HTML tags from forum message form
fields. This may enable an attacker to inject malicious script code into
forum messages. In particular, script code is not sufficiently sanitized
from the thread title and body form fields.  When a web user views a
message containing the attacker's script code, the malicious script code
is executed in their browser, in the security context of the website
running the vulnerable software.

An attacker who exploits this may be able to hijack web content or steal
cookie-based authentication credentials.

8. Pipermail/Mailman Insecure Archives Permissions Vulnerability
BugTraq ID: 4538
Remote: No
Date Published: Apr 16 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4538
Summary:

Pipermail is a mailing list archiver, which is no longer being maintained.
A newer version of Pipermail has been bundled into the Mailman mailing
list manager.  Both programs will run on most Unix and Linux variants.

The file which contains the mailing list archive is by default
world-executable.  As a result, local attackers may read mailing list
messages archived by Pipermail (and Mailman) due to the insecure
permissions on the files involved.  To exploit this issue the attacker
must be able to antipicate the location of the files on the local
filesystem.

Furthermore, because of the design of the program these permissions must
exist if the archive files are to be read by a legitimate user.

This is only a security concern if the archives are of a private mailing
list.

9. PVote Unauthorized Administrative Password Change Vulnerability
BugTraq ID: 4541
Remote: Yes
Date Published: Apr 18 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4541
Summary:

PVote is a web voting system written in PHP.  It will run on most Unix and
Linux variants as well as Microsoft Windows operating systems.

It is possible to change the administrative password by submitting a
malicious web request.  The attacker does not require the old
administrative password to change the new one.  The structure of such a
malicious web request is as follows:

http://target/pvote/ch_info.php?newpass=password&confirm=password

The ch_info.php script will accept arbitrary attacker-supplied values for
the newpass and confirm values without requiring any sort of
authentication.

10. PostBoard Topic Title Script Execution Vulnerability
BugTraq ID: 4561
Remote: Yes
Date Published: Apr 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4561
Summary:

PostBoard is a freely available, open source message board module for the
PostNuke content management system.  It is designed for use on the Unix
and Linux operating systems.

A problem with PostBoard may allow the execution of arbitrary script code
in the context of a site.  The problem is in the checking of some input.

PostBoard does not adequately sanitize input by board users.  Because of
this, it is possible for users of the board to insert script code in
message titles.  This would result in a user clicking the message and
executing the script code in the context of the site.

11. PostBoard BBCode Denial Of Service Vulnerability
BugTraq ID: 4562
Remote: Yes
Date Published: Apr 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4562
Summary:

PostBoard is a freely available, open source message board module for the
PostNuke content management system.  It is designed for use on the Unix
and Linux operating systems.

A vulnerability exists in PostBoard's implementation of BBcode which makes
it possible for an attacker to starve resources on the host running the
affected software. In particular, it is possible to exploit the [code] tag
to create this effect. The [code] tag is used to quote samples of source
code without any of the special characters being interpretted. It is not
known whether other tags may also be exploited in this manner.

The consequence of exploitation is that the webserver will consume an
unusual amount of system resources. This may result in a denial of service
to the webserver and possibly the underlying system if adequate resource
limits are not in place.

If this issue is successfully exploited, the webserver will need to be
restarted for normal functionality to resume.

12. PostBoard BBCode IMG Tag Script Injection Vulnerability
BugTraq ID: 4559
Remote: Yes
Date Published: Apr 19 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4559
Summary:

PostBoard is a freely available, open source message board module for the
PostNuke content management system.  It is designed for use on the Unix
and Linux operating systems.

A problem with PostBoard could allow remote users to execute arbitrary
code in the context of the web site.  The problem is in the checking of
some types of input.

PostBoard does not sanitize code submitted to site between IMG tags.  Due
to this, a malicious user may be able to submit a post to the site with
script code between two IMG tags.  This code would be executed by a user's
browser in the context of the site.

13. Demarc PureSecure Authentication Check SQL Injection Vulnerability
BugTraq ID: 4520
Remote: Yes
Date Published: Apr 15 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4520
Summary:

Demarc PureSecure is a commercially available graphical front-end for
Snort, in addition to being a generalized network monitoring solution.
Snort is an open-source NIDS (Network Intrusion Detection System). Demarc
PureSecure will run on most Linux and Unix variants, as well as Microsoft
Windows NT/2000/XP operating systems.

A vulnerability has been reported in some versions of PureSecure. User
supplied input is used to construct a SQL statement, allowing SQL
injection attacks. Administrative access may be gained through
exploitation of this flaw.

A session id value is derived from cookie information, which is under the
control of the client. This information is then used to construct a SQL
query, which is used to determine if the user has administrative access. A
malicious attacker may construct a cookie including additional SQL
commands, and modify this query.

It has been reported possible to gain administrative access through this
attack. Further exploitation may be possible, although this has not been
confirmed.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. HiverCon 2002 (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/02041921355504.00223@carmen

2. No Root Shell with SUID /bin/bash (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]


IV.NEW PRODUCTS FOR LINUX PLATFORMS
-----------------------------------
1. hp secure OS software for Linux
by Hewlett-Packard
Platforms: N/A
Relevant URL:
http://www.hp.com/security/products/linux/
Summary:

A secure server platform for Linux as an enhancement to the HP Netaction
software suite. HP Secure OS Software for Linux, will help businesses
secure their Linux environments by offering intrusion prevention,
real-time protection against attacks, and damage containment. HP is first
to market with this business-critical security solution for Linux. HP
Secure OS Software for Linux provides high reliability, performance,
availability, flexibility and scalability. Additionally, it is easy to
install and manage, making it attractive to businesses that don't have
large IT organizations.

2. Phoenix Adaptive Firewall
by Progressive Systems
Platforms: Linux, Propietary Hardware
Relevant URL:
http://www.progressive-systems.com/products/phoenix/
Summary:

The Phoenix Adaptive Firewall is a MLSI-based firewall available for Linux
distributions and as a stand alone appliance. Free software evaluations
and GUI demo available on-line.

3. T.REX Firewall
by Freemont Avenue Software, Inc.
Platforms: Linux, Solaris, AIX, HP-UX
Relevant URL:
http://www.opensourcefirewall.com/trex.html
Summary:

The T.REX Firewall provides a mission critical, fault tolerant Firewall
for Linux, AIX and Solaris. Features include High Availibility, Load
Balancing, Web Caching, Content Filtering, NAT, VPN support, an advanced
Application Proxy, and the ability to produce up to 52 unique reports.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. TinyCA v0.3.0
by Stephan Martin
Relavant URL:
http://tinyca.sm-zone.net/
Platforms: Linux, OpenNMS, POSIX
Summary:

TinyCA is a simple GUI written in Perl/Tk to manage a small certification
authority. It is based on OpenSSL and Perl modules from the OpenCA
project. TinyCA lets you manage x509 certificates. It is possible to
export data as PEM or DER for use with servers, or as PKCS#12 for use with
clients, or as S/MIME certificates for use with email programs.

2. Nessus v1.2.0
by Renaud Deraison, [email protected]
Relevant URL:
http://www.nessus.org/
Platforms: FreeBSD, IRIX, Linux, NetBSD, OpenBSD, Solaris
Summary:

Nessus is a remote security scanner for Linux, BSD, Solaris, and other
Unices. It is multi-threaded and plug-in-based, has a GTK interface, and
performs over 500 remote security checks. It allows for reports to be
generated in HTML, XML, LaTeX, and ASCII text, and suggests solutions for
security problems.

3. Sophie v1.33rc3
by Vanja Hrustic
Relevant URL:
http://www.vanja.com/tools/
Platforms: FreeBSD, HP-UX, Linux, OpenBSD, POSIX
Summary:

Sophie is a daemon which uses 'libsavi' library from Sophos anti virus
vendor ( http://www.sophos.com ). On startup, Sophie initializes SAPI
(Sophos Anti-Virus Interface), loads virus patterns into memory, opens
local UNIX domain socket, and waits for someone to connect and instructs
it which path to scan. Since the database is loaded in RAM, scanning is
very fast. (Note: speed of scanning also depends on SAVI settings and size
of the file.) It works on Linux, Solaris (Sparc/x86), HP-UX, and FreeBSD.
It was made as a part of 'Virge' project, which is a mail/attachment/virus
scanning tool, written in C.

4. Cisco IP Accounting Fetcher v1.4.3
by Tobias Geiger [email protected]
Relevant URL:
http://cipaf.sourceforge.net/
Platforms: Perl (any system supporting perl)
Summary:

Cisco IP Accounting Fetcher is a set of Perl scripts that allows you to
fetch IP accounting data from Cisco routers. It is capable of fetching
this information from multiple routers. It summarizes this information on
a daily and monthly basis. It optionally generates HTML output with CSS
support, and it is able to ignore specific traffic.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml
-------------------------------------------------------------------------------