SecurityFocus Linux Newsletter #120

Stephen Entwisle <[email protected]> Mon, 24 Feb 2003 11:48:04 -0700 (MST)
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #120
-----------------------------------

This Issue is sponsored by: Captus Networks

Instantly identify and automatically stop:

 - DDoS Attacks
 - Port Scans
 - Exploits from Unknown Worms and Viruses

With precise, real-time responses. Hands-on, online demo--launch and
mitigate live attacks.  Visit us at:
http://www.captusnetworks.com/landing_pages/sflx
-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Secure MySQL Database Design
     2. Richard Clarke's Legacy of Miscalculation
     3. SecurityFocus DPP Program
     4. InfoSec World Conference and Expo/2003(March10-12,2003,Orlando,FL)
II. LINUX VULNERABILITY SUMMARY
     1. HP-UX Bastille sendmail.cf Information Disclosure Weakness
     2. Suckbot Remote Denial Of Service Vulnerability
     3. Util-Linux mcookie Cookie Generation Weakness
     4. PHP CGI SAPI Code Execution Vulnerability
     5. BitchX Malformed RPL_NAMREPLY Denial Of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. entropy + openSSL question (Thread)
     2. LKM Trojan installed (Thread)
     3. openSSL Key generation (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORM
     1. eTrust Antivirus
     2. F-Secure Anti-Virus Total Suite
     3. NetVigil
V. NEW TOOLS FOR LINUX PLATFORMS
     1. LinuxMagic magic-smtpd v0.7.0
     2. Looper Event / Alert System v0.20
     3. Webanalyse v0.9
VI. SPONSORSHIP INFORMATION



I. FRONT AND CENTER
-------------------
1. Secure MySQL Database Design
by Kristy Westphal

When it comes to installing software, secure design is often the last
consideration. The first goal is usually just to get it to work. This is
particularly true of databases. Databases are commonly referred to the
keys to the kingdom: meaning that once they are compromised, all the
valuable data that is stored there could fall into the hands of the
attacker. With this in mind, this article will discuss various methods to
secure databases, specifically one of the most popular freeware databases
in use today, MySQL.

http://online.securityfocus.com/infocus/1667

2. Richard Clarke's Legacy of Miscalculation
By George Smith

The outgoing cybersecurity czar will be remembered for his steadfast
belief in the danger of Internet attacks, even while genuine threats
developed elsewhere.

http://online.securityfocus.com/columnists/143

3. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only
global early-warning system for cyber attacks - SecurityFocus DeepSight
Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

4. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)

Optional Workshops March 8, 9, 12, 13, & 14 Vendor Expo March 10 & 11

Solutions to today’s security concerns; hands-on experts; blockbuster
vendor expo; the CISO Executive Summit; invaluable networking
opportunities.  InfoSec World has it all!

Go to: http://www.misti.com/10/os03nl37inf.html


II. BUGTRAQ SUMMARY
-------------------
1. HP-UX Bastille sendmail.cf Information Disclosure Weakness
BugTraq ID: 6878
Remote: Yes
Date Published: Feb 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6878
Summary:

The Bastille Hardening System attempts to impelement various security
measures on various Unix operating systems. It is currently available for
the Linux and HP-UX operating systems.

A security weakness has been discovered in version B.02.00.00 of the
Bastille Hardening System which may result in information disclosure. This
issue occurs when Bastille is used in conjunction with the HP-UX operating
system and the Sendmail daemon.

HP has reported that a security weakness exists in the sendmail.cf even
after Bastille has been used to disable the feature. Specifically,
Bastille fails to enable the 'novrfy' and 'noexpn' options. Exploiting
this configuration error would have the same affects as a configuration
which has not disabled the use of the 'vrfy' and 'expn' SMTP commands.

This issue poses a security threat as it may allow an unauthorized remote
attacker to obtain sensitive username and alias information from a target
server. As a result a system administrator applying the Bastille system
may have a false sense of security as to the confidentiality of system
information.

It has been confirmed that Bastille available for the Linux operating
system is not affected by this issue.

2. Suckbot Remote Denial Of Service Vulnerability
BugTraq ID: 6854
Remote: Yes
Date Published: Feb 13 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6854
Summary:

Suckbot is an IRC bot program written using the C programming language. It
is available for the Linux, FreeBSD, and Solaris operating systems.

A vulnerability has been discovered in SuckBot. A denial of service may
occur when calling the rquote_cmd() function located in the
mod_mysql_logger shared object file.

Specifically when the function attempts to request a row, from the backend
MySQL database, it fails to check that a row was successfully returned. If
this situation occurs when the invalid row is accessed by the process a
segmentation violation will occur, causing the program to crash.

This issue could potentially be exploited by a malicious IRC user to crash
a target Suckbot IRC bot.

This issue affects Suckbot version 0.006 and earlier.

3. Util-Linux mcookie Cookie Generation Weakness
BugTraq ID: 6855
Remote: Yes
Date Published: Feb 14 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6855
Summary:

util-linux is a freely available, open source software package that
provides some implementations of standard UNIX utilities, such as login.
Included with util-linux is the mcookie utility that is used to generate
random cookies for use with X authentication.

A weakness has been reported for the mcookie utility where cookies may be
generated in a predictable manner. The weakness occurs because mcookie
uses /dev/urandom to generate cookies.

This may be exploited by an attacker to guess cookie values to steal
credentials of users who use X authentication.

Information obtained in this manner may be used by the attacker to launch
further attacks against vulnerable systems and users.

4. PHP CGI SAPI Code Execution Vulnerability
BugTraq ID: 6875
Remote: Yes
Date Published: Feb 17 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6875
Summary:

PHP is a freely available, open source web scripting language package. It
is available for Microsoft Windows, Linux, and Unix operating systems.

An unspecified vulnerability has been reported in the CGI SAPI of PHP
version 4.3.0.

Direct access to the CGI binary can be prevented by using the
configuration option '--enable-force-cgi-redirect' and the php.ini option
'cgi.force_redirect'.

The report states that an unspecified bug could render these options
useless, allowing a remote user to directly access the CGI binary.  This
could allow an attacker to read any file that is readable by the web
server user, or to potentially execute arbitrary PHP code.  The attacker
would have to be able to inject the PHP code into a file accessible by the
CGI binary, such as the web server access logs.

5. BitchX Malformed RPL_NAMREPLY Denial Of Service Vulnerability
BugTraq ID: 6880
Remote: Yes
Date Published: Feb 18 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6880
Summary:

BitchX is a freely available, open source IRC client.  It is available for
Unix, Linux, and Microsoft operating systems.

A problem with BitchX could make it possible for a malicious IRC server to
crash a vulnerable client.

It has been reported that BitchX does not properly handle some types of
replies contained in the RPL_NAMREPLY numeric.  When a malformed reply is
received by the client, the client crashes, resulting in a denial of
service.

The problem occurs through the handling of the 353 IRC numeric.  It is
suspected that this vulnerability may also make possible the execution of
arbitrary code.  In the event that this is possible, code executed through
this vulnerability would be in the context of the BitchX user.  This could
allow a remote attacker access to the system on which the affected client
is running with the privileges of the BitchX user.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. entropy + openSSL question (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/312405

2. LKM Trojan installed (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/312387

3. openSSL Key generation (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/312270


IV. NEW PRODUCTS FOR LINUX PLATFORM
-----------------------------------
1. eTrust Antivirus
by Computer Associates International, Inc.
Platforms: Linux, MacOS, Netware, Solaris, SunOS, Windows 2000, Windows
95/98, Windows NT, Windows XP
Relevant URL:
http://www3.ca.com/Solutions/ProductFamily.asp?ID=156
Summary:

eTrust Antivirus is a set of award-winning antivirus solutions, providing
superior protection against today's most prevalent security threat -
viruses. Based on advanced technology, eTrust Antivirus reduces virus
infections, simplifies and automates updating, and eases administration.
eTrust Antivirus is certified by ICSA Labs for detecting 100% of "in the
wild" viruses.

2. F-Secure Anti-Virus Total Suite
by F-Secure Corporation
Platforms: DOS, Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL:
http://www.f-secure.com/products/anti-virus/totalsuite/
Summary:

F-Secure Anti-Virus Total Suite includes all critical components for
corporate virus security. By using F-Secure's award winning workstation,
file server, email server and firewall anti-virus products, you are always
protected even against the latest threats. All F-Secure Anti-Virus Total
Suite products are centrally manageable with one easy to use management
solution, F-Secure Policy Manager.

3. NetVigil
by Fidelia
Platforms: Linux, Solaris, Windows NT
Relevant URL:
http://www.fidelia.com/products/index.phtml
Summary:

Fidelia NetVigil is a real-time integrated fault and performance
management tool that provides end-to-end business visibility of your
company's IT infrastructure. Fidelia NetVigil's unique architecture will
scale with your organization and allow you to view and correlate data
across your servers, applications and network devices. Fidelia NetVigil's
instant configuration capabilities and multi-level views combine to
expedite isolation and repair of IT problems, minimize downtime and reduce
the cost of labor and implementation. This translates into savings for
your bottom line.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. LinuxMagic magic-smtpd v0.7.0
by LinuxMagic Inc. [email protected]
Relevant URL:
http://www.linuxmagic.com/opensource/magicmail/magic-smtpd/
Platforms: Linux, POSIX
Summary:

MAGIC-SMTPD is a drop-in replacement for Dan Bernstein's qmail-smtpd, and
was originally designed to be part of the LinuxMagic Magic Mail Server.
This opensource version has been released to allow others to benefit from
its anti-spam components, and valid user checking to reduce server loads
and spam volumes. It is designed to support stock qmail installations,
qmail/vpopmail installations, and database connectivity. Designed for ISP
service, this will work for all mail servers large and small.

2. Looper Event / Alert System v0.20
by Mohit Muthanna [email protected]
Relevant URL:
http://looper.sourceforge.net/
Platforms: AIX, FreeBSD, HP-UX, Linux, OpenBSD, Solaris, SunOS
Summary:

Looper is a highly modularized application designed to simplify the event
/ alert model. Primarily used for Network Management, this application can
be used to accomplish a variety of tasks related to logging and alerting
such as listening for SNMP traps and logging to a file or sending
notification to Netcool (a la "trapd probe"), reading a log file for
alerts and sending notification via e-mail, parsing syslogs and sending
notifications to Netcool (a la "syslog probe"), etc. Looper can also be
used as an ad-hoc Netcool probe or Gateway.

3. Webanalyse v0.9
by Ranx [email protected]
Relevant URL:
http://www.nanobody.net/
Platforms: Linux, POSIX
Summary:

Webanalyse is a Web site traffic statistics tool written in PHP 4. It
doesn't use any databases or Apache logs. Its reports include Web site
statistics by day, week, month, and year, referer, host, IP, browser. The
big advantage lies primarily in detail of each visit--you can follow the
pages or articles which are visited on your site. WebAnalyse can be added
very easily on all the pages where you wish to follow the activity.


VI. SPONSORSHIP INFORMATION
---------------------------

This Issue is sponsored by: Captus Networks

Instantly identify and automatically stop:

 - DDoS Attacks
 - Port Scans
 - Exploits from Unknown Worms and Viruses

With precise, real-time responses. Hands-on, online demo--launch and
mitigate live attacks.  Visit us at:
http://www.captusnetworks.com/landing_pages/sflx
-------------------------------------------------------------------------------