SecurityFocus Linux Newsletter #126

SecurityFocus Linux Newsletter #126
-----------------------------------

I. FRONT AND CENTER
     1. U.S. Information Security Law, Part 2
     2. The Reality of Perception
     3. SecurityFocus DPP Program
II. LINUX VULNERABILITY SUMMARY
     1. Beanwebb Guestbook HTML Injection Vulnerability
     2. Sendmail Address Prescan Memory Corruption Vulnerability
     3. SAP DB RPM Install World Writable Binary Vulnerability
     4. PHP-Nuke Block-Forums.PHP Subject HTML Injection Vulnerability
     5. PostNuke File Path Disclosure Vulnerability
     6. D-Link DI-614+ IP Fragment Reassembly Denial of Service...
     7. Snort Evasion Echo Flag Port Scan Vulnerability
     8. Justice Guestbook Path Disclosure Vulnerability
     10. MyGuestBK Add.asp Cross Site Scripting Vulnerability
     11. MyGuestBK Unauthorized Admin Panel Access Vulnerability
     12. Multiple Name Server NXDomain Denial Of Service Vulnerability
     13. ScozBook Path Disclosure Vulnerability
     14. HP Instant TopTools Remote Denial Of Service Vulnerability
     15. PHP openlog() Buffer Overflow Vulnerability
     16. Beanwebb Guestbook Unauthorized Administrative Access...
     17. Justice Guestbook HTML Injection Vulnerability
     18. Mutt IMAP Remote Folder Buffer Overflow Vulnerabilities...
     19. ScozBook HTML Injection Vulnerability
     21. Apache Web Server Unspecified Denial Of Service Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. Live Upgrade for Linux (Thread)
     2. Red Hat: To patch or to upgrade? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. EasyCrypt
     2. EverLink Suite
     3. NetMAX Professional Suite
V.  NEW TOOLS FOR LINUX PLATFORMS
     1. SRG v1.0b1
     2. Trusted Debian v0.9.1
     3. Async Blockreport v1.0
VI. SPONSORSHIP INFORMATION



I. FRONT AND CENTER
-------------------
1. U.S. Information Security Law, Part 2
By Steven Robinson

This is the second part of a four-part series looking at U.S. information
security laws and the way those laws affect security professionals. In
this installment, we will look at the legal framework for security of an
enterprise's working environment from the perspective of information
security professionals, with particular emphasis on the protection of
communications.

http://www.securityfocus.com/infocus/1681

2. The Reality of Perception
By Tim Mullen

A new poll finds that seventy-seven percent of security professionals
believe Microsoft products are insecure. But a closer look at the survey
tells a far more interesting story.

http://www.securityfocus.com/columnists/152

3. SecurityFocus DPP Program

Attention Universities!! Sign-up now for preferred pricing on the only
global early-warning system for cyber attacks - SecurityFocus DeepSight
Threat Management System.

Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml


II. BUGTRAQ SUMMARY
-------------------
1. Beanwebb Guestbook HTML Injection Vulnerability
BugTraq ID: 7231
Remote: Yes
Date Published: Mar 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7231
Summary:

Beanwebb Guestbook is guestbook software implemented in PHP. It is
available for a variety of platforms including Linux and Unix variant
operating environments.

Guestbook does not adequately filter some HTML code thus making it prone
to HTML injection attacks.

It has been reported that Guestbook does not sufficiently filter
user-supplied values from the 'name', 'email' and 'comment' variables on
the 'add.php' page. As a result, attackers may embed malicious script code
or HTML into Guestbook posts. When a malicious post is viewed by another
user, the attacker-supplied code will be interpreted in their web browser
in the security context of the site hosting the software.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. The attacker may hijack the session of the legitimate by using
cookie-based authentication credentials. Other attacks are also possible.

This vulnerability was reported for Guestbook 1.0.

2. Sendmail Address Prescan Memory Corruption Vulnerability
BugTraq ID: 7230
Remote: Yes
Date Published: Mar 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7230
Summary:

It has been reported that Sendmail is affected by a memory corruption
condition that is likely remotely exploitable.  The flaw is present in the
prescan() procedure, one that is used for processing e-mail addresses in
SMTP headers.  This function is implemented in the source code file
"parseaddr.c".  It is at least theoretically possible that this condition
may be exploited by remote attackers to execute instructions on target
systems.  This vulnerability is due to a logic error in the conversion of
a char to an integer value.

The condition occurs when Sendmail converts an externally supplied
character byte to an integer type.  It is possible for the byte to be
converted to a special control value (-1) that will result in disabling of
bounds checking.  This is because the integer type is assigned to the
value of a signed char without casting it as unsigned:

c = *p++;

The char value 0xFF will cause c to be assigned to the integer
representation of -1, the 'NOCHAR' control value.  Bounds checking is
disabled when the value of the current character (c) is 'NOCHAR'.

This leads to the potential for malicious data to be written beyond the
boundaries of the buffer allocated to store it.  Attackers may exploit
this condition to overwrite potentially sensitive values on the stack with
some degree of control.

The discoverer of this condition has reported that it was successfully
exploited to execute code locally.  It is likely that this vulnerability
can be exploited remotely as well.

This vulnerability is eliminated in Sendmail version 8.12.9.
Administrators are advised to upgrade as soon as possible.

3. SAP DB RPM Install World Writable Binary Vulnerability
BugTraq ID: 7242
Remote: No
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7242
Summary:

SAP DB is a free enterprise level database available for Microsoft
Windows, Linux, Solaris, AIX, Tru64, and HP-UX platforms.

When SAP DB is installed using RPM packages, insecure permissions are left
on two binaries.

After performing the installation, the lserver and dbmsrv binaries have
'777' permissions.  This allows any user on the system to write to the
binaries.

It should be noted that this vulnerability only exists when SAP DB is
installed using RPM packages.  Installing SAP DB from tgz packages will
leave these binaries with '755' permissions.

4. PHP-Nuke Block-Forums.PHP Subject HTML Injection Vulnerability
BugTraq ID: 7248
Remote: Yes
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7248
Summary:

PHP-Nuke is a web-based portal system. Implemented in PHP, it is available
for a range of systems, including Unix, Linux, and Microsoft Windows.

The PHP-Nuke 'block-Forums.php' script does not sufficiently sanitize data
supplied via form fields, making it prone to HTML injection attacks.  In
particular, the subject field is not sanitized of HTML tags.  This could
allow for execution of hostile HTML and script code in the web client of a
user who visits a web page that contains the malicious code.  This would
occur in the security context of the site hosting the software.

Exploitation could allow for theft of cookie-based authentication
credentials or other attacks.

5. PostNuke File Path Disclosure Vulnerability
BugTraq ID: 7218
Remote: Yes
Date Published: Mar 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7218
Summary:

PHP-Nuke is a web based Portal system. Implemented in PHP, it is available
for a range of systems, including Unix, Linux, and Microsoft Windows.

Multiple path disclosure vulnerabilities have been reported in various PHP
scripts used by PHP-Nuke. The issue occurs when a request is made which
includes invalid URI 'file' parameters to the 'Stats' or 'Members_List'
pages.

The affected scripts do not provide sufficient error handling for this
circumstance and as such, may display an error page containing sensitive
information path information. Access to sensitive filesystem information
may aid an attacker in launching further attacks against a target system.

6. D-Link DI-614+ IP Fragment Reassembly Denial of Service Vulnerability
BugTraq ID: 7219
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7219
Summary:

It has been reported that the implementation of the Internet Protocol (IP)
in the firmware of the D-Link DI-614+ wireless router is vulnerable to a
remotely exploitable denial of service condition.  The vulnerability is
related to the reassembly of fragmented IP packets and can be triggered by
transmission of fragments with malicious size parameters to an affected
device.

There is existing exploit code that exploits older vulnerabilities which
are similar, and that can be used to successfully trigger this
vulnerability.  The exploit code is for an attack known as "nestea" that
affected several implementations of IP, including the Linux kernel.  The
vulnerability in many of those implementations was due to an error
calculating the total amount of buffer space required for a reassembled
packet.  When malicious fragments are sent to hosts affected by that
vulnerability, the reassembled packet would incorrectly overwrite kernel
memory outside of the allocated buffer.  It is highly likely that the
firmware of this device is vulnerable to a very similar condition.

When exploited, the device will reboot instantly.  This will result in a
denial of service until the device has restarted.  Repeated attacks may
result in a prolonged denial of service.

7. Snort Evasion Echo Flag Port Scan Vulnerability
BugTraq ID: 7220
Remote: Yes
Date Published: Mar 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7220
Summary:

Snort is a freely available, open source intrusion detection system.  It
is available for Unix, Linux, and Microsoft Windows platforms.

It has been reported that a vulnerability exists in the default
configuration of Snort.  Due to this issue it is possible for a user to
evade detection while performing some types of scans.

The problem is in the detection of specifically crafted packets.  When a
port scan is initiated with the TCP SYN, FIN, and ECN flags set, the
default configuration of snort will not register these packets as an IDS
event.  This could permit an attacker to gather information on network
resources that could be used for more organized attack against systems.

This problem has been reported in version 1.9.1, though earlier versions
may be affected.

8. Justice Guestbook Path Disclosure Vulnerability
BugTraq ID: 7234
Remote: Yes
Date Published: Mar 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7234
Summary:

Justice Guestbook is guestbook software implemented in PHP. It is
available for a variety of platforms including Linux and Unix variant
operating environments.

A path disclosure vulnerability has been reported for Guestbook. The issue
occurs when a request is made to the cfooter.php3 PHP script page.

The affected script does not provide sufficient error handling for this
circumstance and as such, may display an error page containing sensitive
information path information. Access to sensitive filesystem information
may aid an attacker in launching further attacks against a target system.

This vulnerability was reported for Justice Guestbook 1.3.

9. Red Hat Linux 9 vsftpd Compiling Error Weakness
BugTraq ID: 7253
Remote: Yes
Date Published: Apr 01 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7253
Summary:

vsftpd is a GPL licensed secure FTP server for UNIX and Linux platforms.

tcp_wrappers is an IP packet filtering facility for UNIX and Linux
platforms.

In Red Hat Linux 9, vsftpd was switched to a standalone service instead of
being run by xinetd.  When this change was made, vsftpd was not compiled
against tcp_wrappers.

Because of this, the vsftpd user is unable to perform any IP packet
filtering on access to the FTP server.

This issue only affects Red Hat Linux 9 boxed sets that were manufactured
for sale in the United States.  The affected part numbers are RHF0120US
and RHF0121US.  Versions of Red Hat 9 that were downloaded or purchased
from international boxed sets are not affected.

10. MyGuestBK Add.asp Cross Site Scripting Vulnerability
BugTraq ID: 7211
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7211
Summary:

MyGuestBK is freely available guestbook software. It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

It has been reported that MyGuestBK does not sufficiently filter
user-supplied URI parameters from the 'message' variable on the MyGuestBK
Information Server 'add.asp' page.

As a result of this reported deficiency, it may be possible for a remote
attacker to create a malicious link containing script code that will be
executed in the browser of a legitimate user. All code will be executed
within the context of the website running MyGuestBK Server.

This may allow for theft of cookie-based authentication credentials and
other attacks.

11. MyGuestBK Unauthorized Admin Panel Access Vulnerability
BugTraq ID: 7213
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7213
Summary:

MyGuestBK is freely available guestbook software. It will run on most Unix
and Linux variants, as well as Microsoft Windows operating systems.

It has been reported that an attacker may access arbitrary myGuestBK
administrative functions through the MyGuestBK administration panel
without prior authorization.

This vulnerability is likely due to misconfigured directory permissions
for the 'admin' directory. Typically, the contents of this directory
should be restricted to trusted individuals only.

12. Multiple Name Server NXDomain Denial Of Service Vulnerability
BugTraq ID: 7217
Remote: Yes
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7217
Summary:

DNS is the RFC-specified domain name system.  It exists in multiple
implementations for UNIX, Linux, and Microsoft Windows.

A problem in the implementation of some name servers could lead to denial
of service attacks.

It has been reported that an issue in the handling of some types of DNS
requests exists.  Because of response codes sent for some queries, an
attacker could abuse this handling problem to deny name resolution to
users of one name server to hosts of another domain.

The problem is in the handling of NXDOMAIN responses.  When certain
responses are received by a name server, such as NXDOMAIN (RCODE 3), the
name server will attempt no further resolution of the host for which the
response was received until the negative cache expires.  An attacker could
exploit this issue in some circumstances to make a host unresolvable via
DNS.

Caching DNS resolvers may also be prone to this issue.

This issue is likely to occur most frequently in IPv6/IPv4 dual stack
implementations.

13. ScozBook Path Disclosure Vulnerability
BugTraq ID: 7236
Remote: Yes
Date Published: Mar 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7236
Summary:

ScozBook is guestbook software implemented in PHP. It is available for a
variety of platforms including Linux and Unix variant operating
environments.

A path disclosure vulnerability has been reported for ScozBook. The issue
occurs when a request is made to the view.php script page with an
arbitrary value for the 'PG' URI variable.

The affected script does not provide sufficient error handling for this
circumstance and as such, may display an error page containing sensitive
information path information. Access to sensitive filesystem information
may aid an attacker in launching further attacks against a target system.

This vulnerability was reported for ScozBook 1.1 BETA.

14. HP Instant TopTools Remote Denial Of Service Vulnerability
BugTraq ID: 7246
Remote: Yes
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7246
Summary:

Instant TopTools is a remote system monitoring software package
distributed by HP.  Instant TopTools is available for Unix, Linux, and
Microsoft operating systems.

A problem with the software could make a denial of service possible.

It has been reported that Instant TopTools does not properly handle some
types of requests.  Because of this, a remote user could potentially deny
service to a host using the vulnerable software.

The problem is in the handling of the Instant TopTools calling itself.
When a request is issued where the Instant TopTools hpnst.exe program
calls itself, the program enters a loop, and begins consuming resources.
Multiple requests will render the vulnerable host unusable, requiring a
reboot to resume normal function.

This problem has been reported to affect Instant TopTools on the Microsoft
Windows platform.  Other platforms may also be affected.

15. PHP openlog() Buffer Overflow Vulnerability
BugTraq ID: 7210
Remote: No
Date Published: Mar 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7210
Summary:

PHP is a freely available, open source web scripting language package. It
is available for Microsoft Windows, Linux, and Unix operating systems.

A buffer overflow has been reported in PHP version 4.3.1 on the Microsoft
Windows operating system. The problem occurs in the openlog() function and
can be triggered by passing excessive data as the 'string ident'. This
argument is used to prepend a string to logged data however, passing a
string containing roughly 1500 bytes of data will cause a buffer to be
overrun.

The exploitation of this vulnerability may allow an attacker to trigger a
denial of service.

Although unconfirmed, it may also be possible for an attacker to leverage
an attack to execute arbitrary code within the PHP interpreter.

This vulnerability was reported for PHP 4.3.1. It is likely that other
versions are affected.

16. Beanwebb Guestbook Unauthorized Administrative Access Vulnerability
BugTraq ID: 7232
Remote: Yes
Date Published: Mar 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7232
Summary:

Beanwebb Guestbook is guestbook software implemented in PHP. It is
available for a variety of platforms including Linux and Unix variant
operating environments.

A vulnerability has been reported for Guestbook that may allow remote
attackers to obtain unauthorized access to administrative functions.

The vulnerability is likely due to insufficient permissions on the
'admin.php' script file. Typically, access to this script file should be
restricted to trustworthy individuals only.

This vulnerability has been reported for Guestbook 1.0.

17. Justice Guestbook HTML Injection Vulnerability
BugTraq ID: 7233
Remote: Yes
Date Published: Mar 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7233
Summary:

Justice Guestbook is guestbook software implemented in PHP. It is
available for a variety of platforms including Linux and Unix variant
operating environments.

It has been reported that Guestbook does not sufficiently filter
user-supplied values from the 'name', 'homepage', 'aim', 'yim' 'location'
and 'comment' variables on the 'jgb.php3' page. As a result, attackers may
embed malicious script code or HTML into Guestbook posts. When a malicious
post is viewed by another user, the attacker-supplied code will be
interpreted in their web browser in the security context of the site
hosting the software.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. The attacker may hijack the session of the legitimate by using
cookie-based authentication credentials. Other attacks are also possible.

This vulnerability was reported for Guestbook 1.3.

18. Mutt IMAP Remote Folder Buffer Overflow Vulnerabilities
BugTraq ID: 7229
Remote: Yes
Date Published: Mar 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7229
Summary:

Mutt is a freely available, open source mail user agent. It is available
for the Unix and Linux operating systems.

Buffer overrun vulnerabilities have been reported for Mutt. These
vulnerabilities are similar to the issues described in BID 7120, Mutt
UTF-7 Internationalized Remote Folder Buffer Overrun Vulnerability.

Mutt provides functionality that allows a remote user to read e-mail from
folders through Internet Message Access Protocol (IMAP). A specially
crafted folder on an IMAP server may be able to trigger these overflow
conditions to cause the vulnerable mutt client to crash. Although
unconfirmed, it may be possible to execute attacker-supplied code with the
privileges of the mutt process.

Further details of this vulnerability are currently unknown. This BID will
be updated as more information becomes available.

These vulnerabilities were reported for Mutt 1.3.28 and earlier.

19. ScozBook HTML Injection Vulnerability
BugTraq ID: 7235
Remote: Yes
Date Published: Mar 29 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7235
Summary:

ScozBook is guestbook software implemented in PHP. It is available for a
variety of platforms including Linux and Unix variant operating
environments.

It has been reported that ScozBook does not sufficiently filter
user-supplied values from the 'username', 'useremail', 'aim', 'msn',
'sitename' and 'siteaddy' variables on the 'add.php' page. As a result,
attackers may embed malicious script code or HTML into ScozBook posts.
When a malicious post is viewed by another user, the attacker-supplied
code will be interpreted in their web browser in the security context of
the site hosting the software.

This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. The attacker may hijack the session of the legitimate by using
cookie-based authentication credentials. Other attacks are also possible.

This vulnerability was reported for ScozBook 1.1 BETA.

20. Oracle JDBC Daylight Savings Time Timestamp Weakness
BugTraq ID: 7241
Remote: No
Date Published: Mar 31 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7241
Summary:

The JDBC thin driver is a component of the Oracle Database.  Oracle is
available for Unix, Linux, and Microsoft operating systems.

A problem with the software may lead to log inconsistency.

It has been reported that the JDBC thin driver distributed with Oracle
databases does not sufficiently handle some timestamps.  Because of this,
transaction times in Oracle logs and databases may be inaccurate.

The problem is in the handling of daylight savings time.  It has been
reported that errors occur during the hour in which daylight savings time
occurs.  Timestamps entered by the driver may be inaccurate, and could
thus lead to a loss of integrity of log files.

21. Apache Web Server Unspecified Denial Of Service Vulnerability
BugTraq ID: 7254
Remote: Yes
Date Published: Apr 02 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7254
Summary:

Apache is a freely available web server. It is available for a variety of
platforms including the Unix, Linux and, Microsoft Windows operating
systems.

A vulnerability has been reported for the Apache web server that will
result in a denial of service condition. This vulnerability only affects
Apache 2.0 series web servers.  It is not known if this affects Apache
running on only specific platforms, or Apache on all platforms.

Further details of this vulnerability are currently unknown. This BID will
be updated as more information becomes available.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Live Upgrade for Linux (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/317101

2. Red Hat: To patch or to upgrade? (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/317094


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. EasyCrypt
by Eon Solutions Ltd.
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Relevant URL:
http://www.easycrypt.co.uk/
Summary:

EasyCrypt is a file encryption software program - a cryptographic product
with the versatility to protect all PC based files or folders from
unauthorised disclosure, even where the PC itself is shared between
individuals.

2. EverLink Suite
by Anyware Technology
Platforms: Linux, MacOS, Netware, OS/2, Solaris, Windows 95/98, Windows NT
Relevant URL:
http://www.anywaretechnology.com/products/everlink/overview.html
Summary:

EverLink is a client/server software product that provides secure and
instant file transfer, email, instant messaging and secure web server
access over the Internet, intranets and extranets. It gives users a method
of exchanging information securely, privately and in real time.

3. NetMAX Professional Suite
by Cybernet Systems
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT
Relevant URL:

Summary:

NetMAX Professional Suite provides a complete set of networking tools,
integrating NetMAX's FireWall ProSuite, Internet Server ProSuite, and
FileServer Suite (Linux) or FireWall, WebServer, and FileServer (FreeBSD)
into one comprehensive Internet appliance package. Our Professional Suite
enables you to use the power and reliability of either Linux or FreeBSD as
well as popular applications such as Apache, Sendmail, and Samba which are
integrated into this product. The browser-based interface helps you to
quickly and easily configure and manage the required network services,
freeing network administrators from routine tasks.


V.  NEW TOOLS FOR LINUX PLATFORMS
---------------------------------
1. SRG v1.0b1
by Matt Brown
Relevant URL:
http://www.crc.net.nz/software/srg.php
Platforms: Linux
Summary:

SRG (Squid Report Generator) is a log file analyzer and report generator
for the Squid Web proxy. It was created to allow easy integration with
authentication systems such as those that are used for squid itself. It is
fast and flexible, and can report details down to the individual files
fetched.

2. Trusted Debian v0.9.1
by Peter
Relevant URL:
http://www.trusteddebian.org/
Platforms: Linux
Summary:

The Trusted Debian project aims to create a highly secure but usable Linux
platform. It brings together security solutions including kernel patches,
compiler patches, security related programs, and techniques.

3. Async Blockreport v1.0
by Christian Reis
Relevant URL:
http://freshmeat.net/redir/blockreport/38774/url_tgz/blockreport
Platforms: Linux
Summary:

Async Blockreport processes sendmail logs and produces reports of the
messages blocked using DNSBLs for each system user. Blockreport can be set
up as a cron job to mail these reports to your users periodically,
providing them with an idea of how much spam they would be getting if the
spam filters didn't work, and also telling them if any false positives
occurred.


VI. SPONSORSHIP INFORMATION
---------------------------