SecurityFocus Linux Newsletter #121

John Boletta <[email protected]> Mon, 3 Mar 2003 10:18:24 -0700 (MST)

Newsgroups	gmane.comp.security.news.linux
Message-ID	<[email protected]>

SecurityFocus Linux Newsletter #121
-----------------------------------

This Issue is sponsored by: SPI Dynamics

ALERT: How a Hacker Launches a SQL Injection Attack Step-by-Step It's as
simple as placing additional SQL commands into a Web Form input box giving
hackers complete access to all your backend systems! Firewalls and IDS
will not stop such attacks because SQL Injections are NOT seen as
intruders. Download this *FREE* white paper from SPI Dynamics for a
complete guide to protection!

http://www.spidynamics.com/mktg/sqlinjection30
-------------------------------------------------------------------------------

I. FRONT AND CENTER
1. Intrusion Prevention Systems: the Next Step in the Evolution...
2. U.S. Information Security Law, Part One
3. The Consequences of Criminalizing Crypto
4. Media Gone Mad
5. SecurityFocus DPP Program
6. InfoSec World Conference and Expo/2003(March10-12,2003,Orlando,FL)
II. LINUX VULNERABILITY SUMMARY
1. TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability
2. Smart IRC Daemon Remote Client DNS Buffer Overflow Vulnerability
3. Mambo Site Server Cookie Validation Vulnerability
4. ClarkConnect Linux clarkconnectd Remote Information Disclosure...
5. Hanterm-XF Loop-Based Escape Sequence Denial of Service...
6. AMX Mod Remote 'amx_say' Format String Vulnerability
7. Apache Web Server MIME Boundary Information Disclosure...
8. Hanterm-XF Window Title Reporting Escape Sequence Command...
9. ATerm Menu Bar Escape Sequence Command Execution Vulnerability...
10. Apple QuickTime/Darwin Streaming Server Command Execution...
11. Apple QuickTime/Darwin Streaming Administration Server...
12. Apple QuickTime/Darwin Streaming Server Parse_XML.CGI...
14. Electronic Arts Battlefield 1942 Remote Administration...
15. Netscape JavaScript Regular Expression Denial Of Service...
16. Frisk F-Prot Antivirus Command Line Scanner Buffer Overflow...
17. Typo3 Showpic.PHP File Enumeration Vulnerability
18. Apple QuickTime/Darwin Streaming Server parse_xml.cgi File...
19. RXVT Screen Dump Escape Sequence Local File Corruption...
20. XTerm Window Title Reporting Escape Sequence Command Execution...
21. Eterm Window Title Reporting Escape Sequence Command Execution...
22. RXVT Menu Bar Escape Sequence Command Execution Vulnerabilit...
23. RXVT Window Title Reporting Escape Sequence Command Execution...
24. Hypermail CGI Mail Open Relay Vulnerability
25. Typo3 Log HTML Injection Vulnerability
26. Typo3 Translations.PHP Remote File Include Vulnerability
27. Typo3 Translations.PHP File Disclosure Vulnerability
30. Zlib Compression Library gzprintf() Buffer Overrun Vulnerability
31. Eterm Screen Dump Escape Sequence Local File Corruption...
32. Netscape Style Sheet Denial Of Service Vulnerability
33. UXTerm Window Title Reporting Escape Sequence Command...
34. Gnome-Terminal Window Title Reporting Escape Sequence Command...
35. Xterm Loop-Based Escape Sequence Denial Of Service...
36. Apple Quicktime/Darwin MP3 Broadcaster Filename Buffer Overrun...
37. Apple QuickTime/Darwin Streaming Server Malicious Port Request...
38. Opera Automatic Redirection Cross Site Scripting Vulnerability
39. Hypermail Local Temporary File Race Condition Vulnerability
40. Ecartis Hidden Form Field Password Modification Vulnerability
41. Netscape Communicator Password Disclosure Weakness
42. Typo3 Runtime Error Page Information Disclosure Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. Article Announcement: Secure MySQL Database Design (Thread)
2. Red Hat Network updates (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORM
1. Security Analyzer
2. ServerCluster
3. NetVigil
V. NEW TOOLS FOR LINUX PLATFORMS
1. gpgdir v0.1
2. pam_require v0.1
3. ulogd-php v0.6
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. Intrusion Prevention Systems: the Next Step in the Evolution of IDS
By Neil Desai

Intrusion prevention systems combine the blocking capabilities of a
firewall with the deep packet inspection of intrusion detection systems.
this discussion will look at five different categories of IPSs that focus
on attack prevention at layers that most firewalls are not yet able to
decipher.

http://www.securityfocus.com/infocus/1670

2. U.S. Information Security Law, Part One: Protecting Private Sector
Systems, and Information Security Professionals and Trade Secrets
by Steven Robinson

Information security professionals work within an enterprise to protect it
from all non-physical threats to the integrity and availability of its
data and systems. Performing this function draws security professionals
into simultaneous, ongoing relationships between the enterprise on the one
hand and, successively on the other, the enterprise's employees and other
agents, its customers, suppliers, competitors, government officials and
regulators, to say nothing of unidentified and sometimes unidentifiable
actors.

http://www.securityfocus.com/infocus/1669

3. The Consequences of Criminalizing Crypto
By Mark Rasch

There is nothing like the fear of weapons of mass destruction to bring out
weary old legislative proposals. Earlier this month, it leaked out that
the Justice Department was considering a broad expansion of its
investigative authority, including the creation of new criminal offenses,
ostensibly to assist in the fight against terrorism. Many of the proposals
contained in the "Domestic Security Enhancement Act of 2003" had nothing
to do with fighting terrorism, but would substantially increase penalties
for such mundane offenses as wire fraud or claiming too many deductions on
a federal tax return.

http://www.securityfocus.com/columnists/145

4. Media Gone Mad
By Tim Mullen

"Windows XP Kills Dog, Steals Toaster"

That's the next headline I'm expecting to read after wallowing through a
week of technology press misreporting about the latest security issue in
Windows XP -- an "issue" that's really nothing of the sort.

http://www.securityfocus.com/columnists/144

5. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only
global early-warning system for cyber attacks - SecurityFocus DeepSight
Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml

6. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)

Optional Workshops March 8, 9, 12, 13, & 14 Vendor Expo March 10 & 11

Solutions to todays security concerns; hands-on experts; blockbuster
vendor expo; the CISO Executive Summit; invaluable networking
opportunities. InfoSec World has it all!

Go to: http://www.misti.com/10/os03nl37inf.html

II. BUGTRAQ SUMMARY
-------------------
1. TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability
BugTraq ID: 6974
Remote: Yes
Date Published: Feb 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6974
Summary:

tcpdump is a freely available, open source network monitoring tool. It is
available for the Unix, Linux, and Microsoft Windows operating systems.

A vulnerability in the processing of some packet types may result in an
inability to further use the tcpdump application.

It has been reported that tcpdump is vulnerable to a denial of service
when some packet types are received. By sending a maliciously formatted
packet to a system using a vulnerable version of tcpdump, it is possible
for a remote user to cause tcpdump to ignore network traffic from the time
the packet is received until the application is terminated and restarted.

The problem is in the handling of ISAKMP packets. When tcpdump receives a
maliciously crafted ISAKMP packet, the application enters an infinite loop
and ceases to further monitor network traffic. This could allow the
passing of undetected network traffic that would typically be seen by
tcpdump.

2. Smart IRC Daemon Remote Client DNS Buffer Overflow Vulnerability
BugTraq ID: 6924
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6924
Summary:

Smart IRC Daemon (sircd) is a freely available, open source implementation
of an IRCd. It is available for the Unix and Linux operating systems.

A problem with sircd may make possible the execution of arbitrary code.

It has been reported that sircd is vulnerable to a boundary condition
error. Under certain circumstances, a client with malicious DNS
information may be able to cause a stack-based overflow in the IRC server.
This could lead to denial of service, and potentially code execution.

The problem is in the handling of clients with large amounts of DNS
information. When the server initially attempts to resolve the client's
DNS information, a string of data greater than 94 bytes will result in a
stack overflow. Through this, an attacker could send arbitrary
instructions that would be executed with the permissions of the IRC
server.

It should be noted that the execution of arbitrary code may be limited to
the ASCII printable character set, which is a requirement of DNS. This
may make exploitation of this issue more difficult.

3. Mambo Site Server Cookie Validation Vulnerability
BugTraq ID: 6926
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6926
Summary:

Mambo Site Server is a freely available, open source web content
management tool. It is written in PHP, and available for Unix, Linux, and
Microsoft Windows operating systems.

Mambo Site Server may grant access without sufficiently validating cookie
based authentication credentials. It has been reported that Mambo will
accept a user cookie sent by the site as an administrative credential.
To exploit this issue, the attacker must receive a cookie and then use MD5
to encode their session ID in the cookie. The attacker may then access
administrative pages using the modified cookie. Reportedly, session IDs
are not issued during normal use of Mambo, but will be issued during
logout. A session ID issued during logout is sufficient to exploit this
issue.

The attacker may gain unauthorized access to the underlying database
through an administrative account. Other administrative actions are also
possible.

This issue was reported in Mambo Site Server 4.0.12 RC2. Earlier versions
may also be affected.

4. ClarkConnect Linux clarkconnectd Remote Information Disclosure Vulnerability
BugTraq ID: 6934
Remote: Yes
Date Published: Feb 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6934
Summary:

ClarkConnect Linux is an environment designed to provide gateway and other
services to home users.

An information disclosure vulnerability has been reported for ClarkConnect
Linux that may result in the clarkconnectd service divulging potentially
sensitive information to remote attackers.

An attacker can exploit this vulnerability by connecting to the remote
system on port 10005 and sending special character codes. This will cause
the service to send various system information to a remote party.

Any information obtained in this manner may be used by an attacker to
launch further attacks against a vulnerable system.

This vulnerability has been reported for ClarkConnect Linux 1.2.

5. Hanterm-XF Loop-Based Escape Sequence Denial of Service Vulnerability
BugTraq ID: 6944
Remote: No
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6944
Summary:

hanterm-XF is terminal emulation software derived from Xterm and designed
to support Hangul input and output. It is available for platforms which
support the X Windowing system, such as Unix and Linux variants.

It has been reported that the DEC implementation of hanterm-xf is prone to
a denial of service vulnerability.

The hanterm-xf terminal fails to sufficiently filter certain potentially
malicious loop-based escape sequences, leaving the terminal open to
attacks including attacker initiated tight loops that may exhaust CPU
resources.

The problem exists in the DEC UDK processing which is implemented by the
vulnerable terminal emulator.

It is possible to exploit this issue if an attacker can cause malicious
escape sequences to be displayed in a terminal window of a vulnerable
terminal emulator. Malicious escape sequences can be injected into a
terminal session through various means, such as programs which log user
input without removing potentially dangerous escape sequences. Untrusted
applications or servers may also send malicious escape sequences to the
terminal. In addition, any systems which allow a user to broadcast
messages to other users may provide a means of exploitation. Many UNIX
systems support this with the "wall" service.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

6. AMX Mod Remote 'amx_say' Format String Vulnerability
BugTraq ID: 6968
Remote: Yes
Date Published: Feb 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6968
Summary:

AMX Mod is a plugin for Half-Life and expands game servers to include
additional functionality. It is available for the Linux and Microsoft
Windows operating systems.

A format string vulnerability has been discovered in AMX Mod. The issue
occurs in the 'amx_say' command and may be exploited to execute arbitrary
code on an affected Half-Life server. This vulnerability likely exists due
to the insecure implementation of printf-like functions.

An attacker can exploit this bug by supplying specially crafted format
specifiers as an argument to the 'amx_say' command. By using specifiers,
such as '%hn', it is possible for an attacker to overwrite arbitrary
locations in memory.

Successful exploitation of this issue would allow an attacker to execute
arbitrary code on a target Half-Life server. As servers are typically run
with root/admin level privileges this may result in the complete
compromise of an affected server.

It should be noted that the affected command can be accessed only by those
who have been authenticated by rcon.

7. Apache Web Server MIME Boundary Information Disclosure Vulnerability
BugTraq ID: 6943
Remote: Yes
Date Published: Feb 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6943
Summary:

Apache is a freely available web server. It is available for a variety of
platforms including the Unix, Linux and, Microsoft Windows operating
systems.

A vulnerability has been discovered in the Apache web server that may
result in the disclosure of sensitive information. Specifically, the
getpid() function is used when generating MIME message boundaries. This
will effectively disclose the Apache child process identification (PID) to
a remote attacker.

Access to this information may aid an attacker in launching attacks
further attacks against target services.

OpenBSD has released a patch that addresses this issue. MIME boundaries
are now generated by the server using BASE64 encoded random numbers.

8. Hanterm-XF Window Title Reporting Escape Sequence Command Execution Vulnerability
BugTraq ID: 6946
Remote: Unknown
Date Published: Feb 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6946
Summary:

Hanterm-XF is terminal emulation software derived from Xterm and designed
to support Hangul input and output. It is available for platforms which
support the X Windowing system, such as Unix and Linux variants.

Hanterm-XF's window title reporting feature may be abused to execute
arbitrary commands on the system running the vulnerable terminal emulator.
The terminal software supports escape sequences which can change the title
of a terminal window and then report the title back to the command line.
In this manner, an attacker can inject malicious escape sequences which
include arbitrary commands in the terminal window title and then cause the
commands to be displayed on the command line.

Exploitation will still require the user to press 'Enter' once the
malicious commands are dumped from the window title to the command line.
Other emulator features may be used to obfuscate the attack and trick the
user into pressing 'Enter'. If successfully exploited, commands will be
executed with the privileges of the current terminal user.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

9. ATerm Menu Bar Escape Sequence Command Execution Vulnerability
BugTraq ID: 6949
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6949
Summary:

aterm is terminal emulation software that is available for Unix and Linux
variants.

aterm supports a feature that allows MenuBar items to be added from the
command line. It is possible to trigger this feature via escape sequences
in the terminal window. This feature may be abused to create an arbitrary
menu item that contains arbitrary commands. If this menu item is later
accessed by the terminal user, the arbitrary commands may be executed.

Exploitation may lead to remote compromise or local privilege escalation.

It is possible to exploit this issue if an attacker can cause malicious
escape sequences to be displayed in a terminal window of a vulnerable
terminal emulator. Malicious escape sequences can be injected into a
terminal session through various means, such as programs that log user
input without removing potentially dangerous escape sequences. Untrusted
applications or servers may also send malicious escape sequences to the
terminal. In addition, any systems which allow a user to broadcast
messages to other users may provide a means of exploitation. Many UNIX
systems support this with the "wall" service.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

10. Apple QuickTime/Darwin Streaming Server Command Execution Vulnerability
BugTraq ID: 6954
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6954
Summary:

The Darwin/QuickTime Streaming Servers are used as a web interface for
Streaming Server configuration. They are available for the Linux, Solaris,
Microsoft Windows and MacOS X operating systems.

A command execution vulnerability has been discovered in the
Darwin/QuickTime Streaming Servers. The vulnerability exists due to
insufficient sanitization performed on some user-supplied input.
Specifically, input supplied to the parse_xml.cgi is not sufficiently
sanitized of pipe ('|') characters.

An attacker can exploit this vulnerability by submitting a specially
crafted string to the parse_xml.cgi application that include malicious
shell commands. These commands, when received by the Streaming Servers,
will be executed and may be used to compromise a vulnerable system.

This vulnerability was originally described in BID 6932 "Multiple Remote
QuickTime/Darwin Streaming Administration Server Vulnerabilities". It is
now being assigned a separate BID.

11. Apple QuickTime/Darwin Streaming Administration Server Parse_XML.CGI Directory Listing Vulnerability
BugTraq ID: 6955
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6955
Summary:

The QuickTime/Darwin Streaming Adminstration Servers are used as a web
interface for Streaming Server configuration. They are available for the
Linux, Solaris, Microsoft Windows and MacOS X operating systems.

QuickTime/Darwin Streaming Administration Server is prone to an issue
which may allow remote attackers to browse the contents of directories.
This is due to insufficient sanitization of user-supplied input, which is
passed through an open() function in the 'parse_xml.cgi' script.

Exploitation may lead to disclosure of sensitive information which may aid
in further attacks against the system hosting the software. The attacker
may need to view the source code of the page to view the directory listing
output.

This vulnerability was originally described in BID 6932 "Multiple Remote
QuickTime/Darwin Streaming Administration Server Vulnerabilities". It is
now being assigned a separate BID.

12. Apple QuickTime/Darwin Streaming Server Parse_XML.CGI Cross-Site Scripting Vulnerability
BugTraq ID: 6958
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6958
Summary:

The Apple QuickTime/Darwin Streaming Servers are used as a web interface
for Streaming Server configuration. They are available for the Linux,
Solaris, Microsoft Windows and MacOS X operating systems.

The Apple QuickTime/Darwin Streaming Server is prone to cross-site
scripting attacks. When an invalid filename is specified from this page,
it is output to an error page without sufficient sanitization of HTML and
script code. The filename may be specified as a URI parameter. This
issue exists in the 'parse_xml.cgi' script.

An attacker may take advantage of this lack of sanitization to embed
malicious HTML and script code in a link to the vulnerable script. If the
link is visited, the attacker-supplied code may be interpreted in the web
client of the user who visits the malicious link.

Successful exploitation may allow the attacker to steal cookie-based
authentication credentials from a legitimate user of the site hosting the
software. Other attacks will also be possible.

This vulnerability was originally described in BID 6932 "Multiple Remote
QuickTime/Darwin Streaming Administration Server Vulnerabilities". It is
now being assigned a separate BID.

13. Apache Web Server ETag Header Information Disclosure Weakness
BugTraq ID: 6939
Remote: Yes
Date Published: Feb 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6939
Summary:

Apache is a freely available web server. It is available for a variety of
platforms including the Unix, Linux and, Microsoft Windows operating
systems.

A cache management feature is available for Apache that makes use of an
entity tag (ETag) header. When this option is enabled and a request is
made for a document relating to a file, for caching purposes, an ETag
response header is returned containing various file attributes. ETag
information allows further requests for files to contain specific
information, such as the file's inode number, which allows for faster
lookup times.

A weakness has been found in the generation of ETag headers under certain
configurations implementing the FileETag directive. Among the file
attributes included in the header is the file inode number that is
returned to a client. This poses a security risk, as this information may
aid in launching attacks against other network-based services. For
instance, NFS uses inode numbers to generate file handles.

OpenBSD has released a patch that addresses this issue. Inode numbers
returned from the server are now encoded using a private hash to avoid the
release of sensitive information.

Apache 1.3.22 and earlier are not configurable to disable the use of
inodes in ETag headers. However, default behaviour in later versions will
still release this sensitive information.

14. Electronic Arts Battlefield 1942 Remote Administration Authentication Buffer Overflow Vulnerability
BugTraq ID: 6967
Remote: Yes
Date Published: Feb 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6967
Summary:

Battlefield 1942 is a video game distributed and maintained by Electronic
Arts. The server software is available for the Linux and Microsoft
Windows platforms.

A problem with the software could make it possible for a remote user to
potentially perform denial of service or code execution.

It has been reported that Battlefield 1942 does not properly check input
sent to the administration port of a game server. By sending a string of
excessive length, a remote attacker could crash the server, resulting in a
denial of service. A manual restart of the server process would be
required to resume normal service.

The problem has been reported as a heap overflow in the authentication
infrastructure for the game server. When a user with access to the
administrative interface of the game server connects via default port
4711, a long string sent to the port will cause the corruption of heap
memory. This could also potentially result in the overwriting of heap
memory to execute malicious instructions with the privileges of the game
server process. Execution of code through this vulnerability has not been
confirmed.

15. Netscape JavaScript Regular Expression Denial Of Service Vulnerability
BugTraq ID: 6959
Remote: Yes
Date Published: Feb 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6959
Summary:

Netscape is a Web browser developed for a variety of platforms including
Microsoft Windows and Linux and Unix variant operating environments.

It has been reported that Netscape based browsers may be vulnerable to a
persistent denial of service condition when executing maliciously crafted
JavaScript regular expression methods.

If a malicious page containing a specially crafted JavaScript regular
expression method is viewed the browser reportedly becomes un-stable this
may result in a critical failure of the affected browser. Specifically, by
making a malformed split() function call, it is possible to trigger this
Denial of Service condition.

This vulnerability was reported for Netscape version 7. It is not known if
previous versions are also affected.

16. Frisk F-Prot Antivirus Command Line Scanner Buffer Overflow Vulnerability
BugTraq ID: 6969
Remote: No
Date Published: Feb 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6969
Summary:

Frisk F-Prot Antivirus for Linux and BSD contains a command line antivirus
scanner that can be used in conjunction with scheduled backup scripts.

The F-Prot command line scanner is prone to a buffer overflow due to
insufficient bounds checking on the file name argument.

If an unusually long file name is supplied as a parameter to the command
line scanner, the buffer will be overrun, potentially resulting in the
execution of arbitrary code. While the scanner is not setuid or setgid,
if the scanner was run through a backup script (or similar third-party
application) by a privileged user to scan the filesystem, a malicious user
could insert a file with an unusually long name, causing code to be
executed in the security context of the user initiating the scan.

This vulnerability was reported to affect F-Prot 3.12b, however, earlier
versions may also be vulnerable.

17. Typo3 Showpic.PHP File Enumeration Vulnerability
BugTraq ID: 6982
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6982
Summary:

TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.

TYPO3 is prone to a vulnerability that will allow remote attackers to
enumerate whether or not files exist on the system hosting the software.
This issue exists in the 'showpic.php' and 'thumbs.php' scripts and may be
exploited by submitting a malicious request for a file (including the
relative path). These scripts will return information about whether or
not a file exists.

This type of information may be useful in mounting further attacks against
the host system, since the scripts will reveal information about the
layout of the host's filesystem.

18. Apple QuickTime/Darwin Streaming Server parse_xml.cgi File Disclosure Vulnerability
BugTraq ID: 6990
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6990
Summary:

QuickTime/Darwin Streaming Administration Server is server technology
which allows you to send streaming QuickTime data to clients across the
Internet.

A file retrieval vulnerability has been reported for QuickTime/Darwin
Streaming Server (SS). The vulnerability exists due to insufficient
sanitization of some parameters given to the parse_xml.cgi script.
Specifically, directory traversal sequences are not sanitized from the
value supplied to the 'filename' URI parameter. Information obtained in
this manner may be used by an attacker to launch more organinzed attacks
against a vulnerable system.

An attacker may exploit this vulnerability by making a request to the
parse_xml.cgi script containing dot-dot-slash ('../') sequences followed
by a filename. When the malicious request is processed, the Streaming
Server will disclose the contents of the file to an attacker.

This vulnerability was tested on SS for Microsoft Windows systems. Linux
versions of Darwin SS are reportedly not vulnerable to this issue.

19. RXVT Screen Dump Escape Sequence Local File Corruption Vulnerability
BugTraq ID: 6938
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6938
Summary:

rxvt is terminal emulation software which is available for Unix and Linux
variants.

rxvt supports a feature which allows screen contents to be dumped to a
local file. It is possible to trigger this feature via escape sequences
in the terminal window. This feature may be abused to any corrupt local
files which are writeable by the terminal user. These files may be
overwritten with custom data, which may result in remote compromise or
local privilege escalation.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

20. XTerm Window Title Reporting Escape Sequence Command Execution Vulnerability
BugTraq ID: 6940
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6940
Summary:

xterm is X11-based terminal emulation software. It is available for
platforms which support the X Windowing system, such as Unix and Linux
variants.

xterm's window title reporting feature may be abused to execute arbitrary
commands on the system running the vulnerable terminal emulator. The
terminal software supports escape sequences which can change the title of
a terminal window and then report the title back to the command line. In
this manner, an attacker can inject malicious escape sequences which
include arbitrary commands in the terminal window title and then cause the
commands to be displayed on the command line.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

21. Eterm Window Title Reporting Escape Sequence Command Execution Vulnerability
BugTraq ID: 6941
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6941
Summary:

Eterm is X11-based terminal emulation software. It is available for
platforms which support the X Windowing system, such as Unix and Linux
variants.

Eterm's window title reporting feature may be abused to execute arbitrary
commands on the system running the vulnerable terminal emulator. The
terminal software supports escape sequences which can change the title of
a terminal window and then report the title back to the command line. In
this manner, an attacker can inject malicious escape sequences which
include arbitrary commands in the terminal window title and then cause the
commands to be displayed on the command line.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

22. RXVT Menu Bar Escape Sequence Command Execution Vulnerability
BugTraq ID: 6947
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6947
Summary:

rxvt is terminal emulation software that is available for Unix and Linux
variants.

rxvt supports a feature that allows MenuBar items to be added from the
command line. It is possible to trigger this feature via escape sequences
in the terminal window. This feature may be abused to create an arbitrary
menu item that contains arbitrary commands. If this menu item is later
accessed by the terminal user, the arbitrary commands may be executed.

Exploitation may lead to remote compromise or local privilege escalation.

It is possible to exploit this issue if an attacker can cause malicious
escape sequences to be displayed in a terminal window of a vulnerable
terminal emulator. Malicious escape sequences can be injected into a
terminal session through various means, such as programs that log user
input without removing potentially dangerous escape sequences. Untrusted
applications or servers may also send malicious escape sequences to the
terminal. In addition, any systems which allow a user to broadcast
messages to other users may provide a means of exploitation. Many UNIX
systems support this with the "wall" service.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

23. RXVT Window Title Reporting Escape Sequence Command Execution Vulnerability
BugTraq ID: 6953
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6953
Summary:

rxvt is X11-based terminal emulation software. It is available for
platforms which support the X Windowing system, such as Unix and Linux
variants.

rxvt's window title reporting feature may be abused to execute arbitrary
commands on the system running the vulnerable terminal emulator. The
terminal software supports escape sequences which can change the title of
a terminal window and then report the title back to the command line. In
this manner, an attacker can inject malicious escape sequences which
include arbitrary commands in the terminal window title and then cause the
commands to be displayed on the command line.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

24. Hypermail CGI Mail Open Relay Vulnerability
BugTraq ID: 6973
Remote: Yes
Date Published: Feb 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6973
Summary:

Hypermail is a freely available tool that converts email into HTML format.

It has been reported that Hypermail's CGI-based mail program is prone to a
condition that may allow attackers to abuse the service as an open mail
relay.

This may allow attackers to send mass mails through the vulnerable
software. It may also be possible to forge a source address to masquerade
as a trusted email user in an attempt to gather information that may be
useful in further attacks against the vulnerable system.

Full details of this vulnerability are not currently known. BID will be
updated as further details are disclosed.

25. Typo3 Log HTML Injection Vulnerability
BugTraq ID: 6983
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6983
Summary:

TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.

TYP03 logs all system and access related errors in the TYPO3 database and
provides a facility for administrators to view this information from the
web. However, data is not sanitized of HTML before being logged. As a
result, remote attackers may inject malicious HTML and script code into
log files. When these logs are viewed, the hostile code will be
interpreted in the web client of the user viewing the logs.

This may allow for theft of administrative cookie-based authentication
credentials and other attacks.

26. Typo3 Translations.PHP Remote File Include Vulnerability
BugTraq ID: 6984
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6984
Summary:

TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.

TYPO3 is prone to an issue that may allow remote attackers to include
files located on attacker-controlled servers.

This vulnerability is as a result of insufficient sanitization performed
on remote user supplied data used by a URI parameter of the
'translations.php' PHP page.

Under some circumstances, it is possible for remote attackers to influence
the path for an include file to point to an external file by manipulating
the '$ONLY' URI parameter.

If the remote file is a malicious file, this may be exploited to execute
arbitrary system commands in the context of the web server.

27. Typo3 Translations.PHP File Disclosure Vulnerability
BugTraq ID: 6985
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6985
Summary:

TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.

TYPO3 does not sufficiently sanitize input submitted via URI parameters of
potentially malicious data. This issue exists in the 'translations.php'
script. Specifically, variations of directory traversal sequences and
null characters (%00) may be specified as a value for the 'ONLY' URI
parameter. By submitting a malicious web request to this script that
contains a relative path to a resource and a null character (%00), it is
possible to retrieve arbitrary files that are readable by the web server
process.

Successful exploitation will permit the attacker to gain access to
sensitive information that may aid in mounting further attacks against the
system hosting the software.

28. Typo3 Webroot Folders Information Disclosure Weakness
BugTraq ID: 6988
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6988
Summary:

TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.

It has been reported that TYPO3 installs, by default, several directories
into the TYPO3 webroot. These directories are reportedly readable or
lacking sufficient authentication mechanisms and contain log,
configuration and script files. This weakness may result in the disclosure
of sensitive system based information to malicious web users.

The following directories and files have been reported to be prone to this
issue: /install /fileadmin/ /typo3conf/

The information gathered as a result of this weakness may be used in
further attacks against the system.

29. Typo3 HTML Hidden Form Field Information Disclosure Weakness
BugTraq ID: 6993
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6993
Summary:

TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.

Clients of TYPO3 systems may access potentially sensitive data that have
been obfuscated through hidden form fields. Such fields may contain
potentially sensitive information which may provide determined attackers
with valuable information which may be useful in exploiting other known
issues in the software.

This vulnerability was reported for TYPO3 3.5b5.

30. Zlib Compression Library gzprintf() Buffer Overrun Vulnerability
BugTraq ID: 6913
Remote: Yes
Date Published: Feb 23 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6913
Summary:

A vulnerability has been reported in the zlib compression library. The
problem occurs in the internal gzprintf() function, which is similar to
fprintf().

The gzprintf() function implements the use of vsprintf() without carrying
out sufficient bounds checking. As a result, by supplying data greater
then the defined Z_PRINTF_BUFSIZE value, it is possible to trigger a
buffer overrun condition.

By exploiting this issue it may be possible for an attacker to overwrite
sensitive locations. This situation may then be leveraged to execute
malicious instructions supplied by the attacker.

It should be noted that, depending on the program linking to the
vulnerable zlib compression library, this vulnerability may pose a local
or remote threat.

Only zlib 1.1.4 has been reported vulnerable to this issue. It is not yet
known whether earlier versions are also affected.

31. Eterm Screen Dump Escape Sequence Local File Corruption Vulnerability
BugTraq ID: 6936
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6936
Summary:

Eterm is terminal emulation software which is available for Unix and Linux
variants.

Eterm supports a feature which allows screen contents to be dumped to a
local file. It is possible to trigger this feature via escape sequences
in the terminal window. This feature may be abused to any corrupt local
files which are writeable by the terminal user. These files may be
overwritten with custom data, which may result in remote compromise or
local privilege escalation.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

32. Netscape Style Sheet Denial Of Service Vulnerability
BugTraq ID: 6937
Remote: Yes
Date Published: Feb 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6937
Summary:

Netscape is a Web browser developed for a variety of platforms including
Microsoft Windows and Linux and Unix variant operating environments.

It has been reported that Netscape based browsers may be vulnerable to a
persistent denial of service or performance degradation condition when
rendering certain style sheet code.

If a malicious page is viewed, the browser reportedly becomes unstable.
One possible condition mentioned was critical failure of the browser while
another condition reportedly utilized all CPU resources.

This vulnerability was reported for Netscape browser version 6 and 7. It
is not known if previous versions are also affected.

33. UXTerm Window Title Reporting Escape Sequence Command Execution Vulnerability
BugTraq ID: 6945
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6945
Summary:

uxterm is X11-based terminal emulation software, writtent to specifically
support Unicode. It is available for platforms which support the X
Windowing system, such as Unix and Linux variants.

uxterm's window title reporting feature may be abused to execute arbitrary
commands on the system running the vulnerable terminal emulator. The
terminal software supports escape sequences which can change the title of
a terminal window and then report the title back to the command line. In
this manner, an attacker can inject malicious escape sequences which
include arbitrary commands in the terminal window title and then cause the
commands to be displayed on the command line.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

34. Gnome-Terminal Window Title Reporting Escape Sequence Command Execution Vulnerability
BugTraq ID: 6948
Remote: Yes
Date Published: Feb 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6948
Summary:

Gnome-Terminal is X11-based terminal emulation software. It is available
for platforms which support the X Windowing system, such as Unix and Linux
variants.

Gnome-Terminal's window title reporting feature may be abused to execute
arbitrary commands on the system running the vulnerable terminal emulator.
The terminal software supports escape sequences which can change the title
of a terminal window and then report the title back to the command line.
In this manner, an attacker can inject malicious escape sequences which
include arbitrary commands in the terminal window title and then cause the
commands to be displayed on the command line.

It should be noted that Gnome-Terminal is only affected by this issue when
implementing the VTE component.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

35. Xterm Loop-Based Escape Sequence Denial Of Service Vulnerability
BugTraq ID: 6950
Remote: No
Date Published: Feb 25 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6950
Summary:

Xterm is X11-based terminal emulation software. It is available for
platforms which support the X Windowing system, such as Unix and Linux
variants.

It has been reported that the DEC implementation of Xterm is prone to a
denial of service vulnerability.

The Xterm terminal fails to sufficiently filter certain potentially
malicious loop-based escape sequences, leaving the terminal open to
attacks including attacker initiated tight loops that may exhaust CPU
resources.

The problem exists in the DEC UDK processing which is implemented by the
vulnerable terminal emulator.

This vulnerability was originally described in BID 6931 "Multiple Vendor
Terminal Emulator Escape Sequence Vulnerabilities". It is now being
assigned a separate BID.

36. Apple Quicktime/Darwin MP3 Broadcaster Filename Buffer Overrun Vulnerability
BugTraq ID: 6957
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6957
Summary:

The Apple QuickTime/Darwin MP3 Broadcaster is encoding software used to
stream online broadcasts. They are available for the Linux, Solaris,
Microsoft Windows and MacOS X operating systems.

A vulnerability has been discovered in MP3 Broadcaster. The problem occurs
due to insufficient bounds checking on MP3 filenames. Processing an MP3
file with a name containing 256 or more bytes of data will trigger this
condition. When this overflow occurs, sensitive locations in memory will
be overwritten.

By overwriting sensitive memory, such as a return address, this issue may
be exploitable by a remote attacker to execute arbitrary commands. All
instructions run in this manner would be executed with the privileges of
the user running the vulnerable application.

This vulnerability was originally described in BID 6932 "Multiple Remote
QuickTime/Darwin Streaming Administration Server Vulnerabilities". It is
now being assigned a separate BID.

37. Apple QuickTime/Darwin Streaming Server Malicious Port Request Code Injection Vulnerability
BugTraq ID: 6960
Remote: Yes
Date Published: Feb 24 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6960
Summary:

A problem with QuickTime/Darwin Streaming Server could make the execution
of arbitrary script code possible.

It has been reported that a vulnerability exists in the handling of
malicious requests for streaming media in the Apple QuickTime/Darwin
Streaming Server. By placing a malicious request to the streaming port of
the software, an attacker could potentially cause execution of script code
in the security context of an administrator.

Because of the method in which the QuickTime/Darwin Streaming Server
administrative interface handles log input, script code inserted into to
log files by way of malicious streaming media requests would be executed
in the security context of a vulnerable administrator. This is performed
through the DESCRIBE option supplied through rtsp, and could result in the
execution of malicious HTML and script code when logs containing injected
code are viewed. The request will not be sanitized of script code when it
is logged.

This vulnerability was originally described in BID 6932 "Multiple Remote
QuickTime/Darwin Streaming Administration Server Vulnerabilities". It is
now being assigned a separate BID.

38. Opera Automatic Redirection Cross Site Scripting Vulnerability
BugTraq ID: 6962
Remote: Yes
Date Published: Feb 26 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6962
Summary:

Opera is a web client available for a number of platforms, including
Microsoft Windows, Linux and Unix variants and Apple MacOS.

A cross site scripting vulnerability has been reported in Opera browsers
for Windows and Linux platforms. The vulnerability exists due to
insufficient sanitization of some user-supplied input when redirecting
visitors to another page or site. Specifically, Opera generates a
temporary page to display a redirection URL. The generated page does not
filter out any malicious HTML code before being displayed to a user.

When a user visits a site that redirects a user to another page,
attacker-supplied script code will be interpreted by Opera in the security
context of the malicious site.

Exploitation of this issue may enable an attacker to steal cookie-based
authentication credentials of victim users. Other attacks are also
possible.

This vulnerability was reported for Opera 7.01 and earlier for Windows
operating systems and Opera 6 for Linux systems.

39. Hypermail Local Temporary File Race Condition Vulnerability
BugTraq ID: 6975
Remote: No
Date Published: Feb 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6975
Summary:

Hypermail is a freely available tool that converts email into HTML format.

A problem with Hypermail may make local symbolic link attacks possible.

It has been reported that Hypermail is vulnerable to a race condition
error. Under some circumstances, Hypermail creates files in the temporary
directory. However, it may be possible to create a symbolic link in a
crucial point of program execution that would result in the overwriting of
files pointed to by the link. This will only occur if the files are
writeable by the Hypermail process.

Successful exploitation may cause local files to be corrupted. If files
can be corrupted with custom data, this may result in privilege elevation.

Full details of this vulnerability are not currently known. The BID will
be updated as further details are disclosed.

40. Ecartis Hidden Form Field Password Modification Vulnerability
BugTraq ID: 6971
Remote: Yes
Date Published: Feb 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6971
Summary:

Ecartis is a mailing list management package for Linux, BSD, and other
Unix variant operating systems.

A vulnerability has been reported for Ecartis that may allow attackers to
modify passwords.

An attacker can exploit this vulnerability by first saving a form locally
and modifying hidden fields in the saved HTML pages and submitting them.
This will allow an attacker to authenticate as a privileged user of
Ecartis and modify passwords.

It is also possible to use tools such as curl to post arbitrary form data.

This vulnerability was reported for Ecartis 1.0.0-snap20021013. It is
likely that other version are affected.

41. Netscape Communicator Password Disclosure Weakness
BugTraq ID: 6981
Remote: No
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6981
Summary:

Netscape Communicator is a combined web browser and e-Mail Client
developed for a variety of platforms including Microsoft Windows, Linux
and Unix variant operating environments.

It has been reported that the Netscape Communicator roaming profile
function may store sensitive user credentials in the 'prefs.js'
configuration file using plaintext or easily disclosed format.

This weakness may result in an attacker accessing sensitive user
credentials that may be used in further attacks launched against the
system.

Conflicting details have been reported suggesting that perhaps this issue
may be due to a user initiated configuration change and that password data
may be encrypted using a trivial XOR based encryption algorithm by
default.

This report is closely related to the issue described in BID 6215.

42. Typo3 Runtime Error Page Information Disclosure Vulnerability
BugTraq ID: 6986
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6986
Summary:

TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.

An information disclosure vulnerability has been reported for TYPO3. The
vulnerability exists in several 'test', 'class' and 'library' scripts that
are included with TYPO3.

These scripts may be forced to execute and generate runtime errors. When
these errors occur, the scripts will output path information.

Information obtained in this manner may be used by an attacker to launch
further attacks against a vulnerable system.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Article Announcement: Secure MySQL Database Design (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/313541

2. Red Hat Network updates (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/313522

IV. NEW PRODUCTS FOR LINUX PLATFORM
-----------------------------------
1. Security Analyzer
by NetIQ
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
http://www.netiq.com/products/sa/default.asp
Summary:

NetIQ's Security Analyzer helps you secure your corporate systems and
networks by automatically detecting the latest known security
vulnerabilities and providing extensive reports and guidance on how to
address them.

2. ServerCluster
by Stonesoft
Platforms: Linux, Solaris
http://www.stonesoft.com/products/ServerCluster/
Summary:

ServerCluster is a High Availability software solution that: clusters up
to 32 servers and applications such as databases, web, mail etc.
Provides continuous 24x7 monitoring with comprehensive fault detection and
automated failover to secondary nodes in the cluster and therefore service
continuity in the event of a failure, without the need for immediate
on-site manual intervention.

3. NetVigil
by Fidelia
Platforms: Linux, Solaris, Windows NT
http://www.fidelia.com/products/index.phtml
Summary:

Fidelia NetVigil is a real-time integrated fault and performance
management tool that provides end-to-end business visibility of your
company's IT infrastructure. Fidelia NetVigil's unique architecture will
scale with your organization and allow you to view and correlate data
across your servers, applications and network devices. Fidelia NetVigil's
instant configuration capabilities and multi-level views combine to
expedite isolation and repair of IT problems, minimize downtime and reduce
the cost of labor and implementation. This translates into savings for
your bottom line.

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. gpgdir v0.1
by Michael Rash
Relevant URL:
http://www.cipherdyne.com/gpgdir/
Platforms: Perl (any system supporting perl)
Summary:

gpgdir is a Perl script that uses the CPAN GnuPG module to encrypt and
decrypt directories using a GPG key specified in ~/.gpgdirrc. It supports
recursively descending through a directory in order to make sure it
encrypts or decrypts every file in a directory and all of its
subdirectories. In order to help save space all files are compressed using
gzip before being encrypted and decompressed upon decryption. In addition,
gpgdir is careful not to encrypt hidden files and directories.

2. pam_require v0.1
by Andreas Gohr
Relevant URL:
http://www.splitbrain.org/[..].php?x=.%2FProgramming%2FC%2Fpam_require
Platforms: Linux, POSIX
Summary:

pam_require is a simple Plugable Authentication Module (PAM) for Linux
(and maybe other systems which use PAM). It is an account module that
allows you to require a special group or user to access a service.

3. ulogd-php v0.6
by regit
Relevant URL:
http://home.regit.org/ulogd-php.html
Platforms: Linux, POSIX
Summary:

ulogd-php is a php interface for the MySQL plugin for the ulogd netfilter
log daemon. It displays hosts that recently broke packets on your firewall
and the last ports that were probed. A simple search function allows
packets to be searched by host or by a given port.

VI. SPONSORSHIP INFORMATION
---------------------------
This Issue is sponsored by: SPI Dynamics

http://www.spidynamics.com/mktg/sqlinjection30
-------------------------------------------------------------------------------