SecurityFocus Linux Newsletter # 144

SecurityFocus Linux Newsletter # 144
------------------------------------

Precisely Define and Implement Network Security and Performance Policies
Integrated Intrusion Prevention and Traffic Shaping to:
  - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
  - Automatically Control P2P, IM and Spam Traffic
  - Ensure Reliable Performance of Mission Critical Applications
**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo

http://www.securityfocus.com/sponsor/CaptusNetworks_sf-news_030811

------------------------------------------------------------------------
I. FRONT AND CENTER
     1. Blogs: Another Tool in the Security Pro's Toolkit (Part Two)
     2. Demonstrating ROI for Penetration Testing (Part Two)
II. LINUX VULNERABILITY SUMMARY
     1. Linux Netfilter NAT Remote Denial of Service Vulnerability
     2. Netfilter Connection Tracking Denial of Service Vulnerabilit...
     3. Multiple Postfix Denial of Service Vulnerabilities
     4. Invision Board Overlapping IBF Formatting Tag HTML Injection...
     5. Xtokkaetama Nickname Local Buffer Overflow Vulnerability
     6. IBM DB2 db2job File Overwrite Vulnerability
     7. IBM DB2 Shared Library Injection Vulnerability
     8. TightVNC Win32 Server QueryAllowNoPass Access Control Bypass...
     9. gURLChecker HTML Parser Denial Of Service Vulnerability
     10. ERoaster Local Insecure Temporary File Creation Vulnerabilit...
     11. Postfix Connection Proxying Vulnerability
     12. Postfix SMTP Malformed E-mail Envelope Address Denial of Ser...
     13. VMware Workstation For Linux File Deletion Vulnerability

III. LINUX FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2003-08-04 to 2003-08-11.

IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. NetSecure Web
     2. Zorp
     3. Kerio MailServer
     4. PureSight
     5. CyberFusion
     6. SecurPass Suite

V. NEW TOOLS FOR LINUX PLATFORMS
     1. FIAIF is an Intelligent Firewall v1.16.0
     2. Webanalyse v1.13
     3. ngrep v1.41
     4. Automated Password Generator (APG) v2.3.0b (dev)
     5. Trinux 0.890
     6. Local Area Security Knoppix v0.3b

VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Blogs: Another Tool in the Security Pro's Toolkit (Part Two)
By Scott Granneman

Part Two on blogs covers RSS feeds that are highly relevant to the security
community. http://www.securityfocus.com/columnists/177

2. Demonstrating ROI for Penetration Testing (Part Two)
By Marcia Wilson

The second article in this series will introduce Risk Management concepts
as they relate to Information Asset valuation.
http://www.securityfocus.com/infocus/1718


II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. Linux Netfilter NAT Remote Denial of Service Vulnerability
BugTraq ID: 8330
Remote: Yes
Date Published: Aug 02 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8330
Summary:
The Netfilter project maintains the packet filter component of the Linux
kernel.  A fix for a denial of service vulnerability has been reported by
the Netfilter project.  

The vulnerability is present on systems with the ip_nat_ftp or ip_nat_irc
modules loaded or with a kernel built supporting options
CONFIG_IP_NF_NAT_FTP or CONFIG_IP_NF_NAT_IRC.  These optional subcomponents
implement limited stateful inspection of the FTP and IRC application
protocols, allowing for features such as active mode FTP and DCC through NAT.

A remotely exploitable denial of service vulnerability exists when at least
one of these features are enabled and communication to FTP/IRC servers is
permitted.

Version 2.4.20 of the Linux kernel is confirmed vulnerable.  A patch is
available.  According to the Netfilter team, the 2.4.20 kernels shipped
with Red Hat Linux include the patch.


2. Netfilter Connection Tracking Denial of Service Vulnerabilit...
BugTraq ID: 8331
Remote: Yes
Date Published: Aug 02 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8331
Summary:
The Netfilter project maintains the packet filter component of the Linux
kernel.  A fix for a denial of service vulnerability has been reported by
the Netfilter project.  

The vulnerability is present on systems with support for connection
tracking enabled.  Connection tracking allows for the firewall to identify
which packets belong to established connections.  Linux 2.4.20 systems with
kernels built supporting the CONFIG_IP_NF_CONNTRACK option or with the
ip_conntrack module loaded are vulnerable.  Other kernel versions are not
affected.

The vulnerability is due to the introduction into the Linux 2.4.20 kernel
of a new generic linked list implementation.  The reliance on the previous
linked list implementation resulted in a condition which could result in a
denial of service.

A patch has been released that removes dependence on a specific kernel
linked list API.

3. Multiple Postfix Denial of Service Vulnerabilities
BugTraq ID: 8333
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8333
Summary:
Postfix is a free, open-source mailer that was designed to be an
alternative to Sendmail. It is written and maintained by Wietse Venema. 

Debian has reported two vulnerabilities in the Postfix mail transfer agent.
 The first vulnerability, CAN-2003-0468, can allow for an adversary to
"bounce-scan" a private network.  It has also been reported that this
vulnerability can be exploited to use the server as a distributed denial of
service tool.  This is reportedly possible through forcing the server to
connect to an arbitrary port on an arbitrary host.  

The second vulnerability, CAN-2003-0540, is another denial of service.  It
can be triggered by a malformed envelope address and can cause the queue
manager to lock up until the message is removed manually from the queue. 
It is also reportedly possible to lock the SMTP listener, also resulting in
a denial of service.

This BID has been divided into BIDs 8361 and 8362 and is being retired.


4. Invision Board Overlapping IBF Formatting Tag HTML Injection...
BugTraq ID: 8335
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8335
Summary:
Invision Board is web forum software.  It is implemented in PHP and is
available for Unix and Linux variants and Microsoft Windows operating systems.

Invision Board supports the use of formatting tags that allow users to
insert images and links into content as well as control certain aspects of
how content is rendered.  These tags are referred to as IBF codes.

It may be possible to inject hostile HTML  into Invision Board by using
overlapping IBF tags.  This could cause the hostile code to be interpreted
in the context of the site hosting the software.  Any input fields which
support inclusion of IBF code may be prone to this issue.

It should be noted that it may not be possible to inject arbitrary HTML
into Invision Board but it is more likely that this could be exploited to
spoof or manipulate links or include other abusive content.


5. Xtokkaetama Nickname Local Buffer Overflow Vulnerability
BugTraq ID: 8337
Remote: No
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8337
Summary:
xtokkaetama, also known as xkaetama, is a puzzle game similar to Tetris
available for Linux.

xtokkaetama is prone to a locally exploitable buffer overflow
vulnerability.  This is due to insufficient bounds checking of the
'-nickname' command line option.  By supplying an excessive long parameter
for this command line option, it is possible to corrupt adjacent regions of
stack memory with attacker-supplied values.  This could result in execution
of arbitrary code in the context of the software.  

The software is typically installed setgid 'games'.

It should be noted that this issue was not patched in the updates provided
in BID 8312. 

6. IBM DB2 db2job File Overwrite Vulnerability
BugTraq ID: 8344
Remote: No
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8344
Summary:
IBM's DB2 database ships with a utility, db2job, installed with permissions
4550 and owned by root.db2asgrp.  It has been reported that db2job writes
to a number of files with root privileges. 

When db2job runs, it does not drop privileges before writing data to the
following files:

db2jobht.prf
db2jobht.bak
db2jobsm.bak
0_1.out

The files written to are created with 0770 permissions (owner, group
writeable) and are owned by root.db2asgrp.  If a symbolic link is written
to, the file pointed to will be overwritten and given these permissions. 
This would be exploitable, however, db2job is allegedly not
world-executable by default (permissions are 4550).  The two members of
group db2asgrp, db2as and db2inst1, are the only users besides root that
would normally have execute access.  

This can be exploited by local attackers with effective groupid db2asgrp
privileges to gain write access to sensitive root-owned files (such as
/etc/passwd, /etc/shadow) that have been overwritten.  If the attacker can
run commands or gain the access level of that group (perhaps through one of
those two accounts), they may further elevate their access level through
exploitation of this vulnerability.  

7. IBM DB2 Shared Library Injection Vulnerability
BugTraq ID: 8346
Remote: No
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8346
Summary:
IBM DB2 ships with a number of shared libraries, stored in a directory
owned by the user and group 'bin'.

*In version 7.1, the directory /usr/IBMdb2/V7.1 contains the following
subdirectories:

drwxr-xr-x    2 bin      bin          4096 Jun 21  2002 java12
drwxr-xr-x    2 bin      bin          4096 Jul 30 19:54 lib
drwxr-xr-x    2 bin      bin          4096 Jun 21  2002 map

*In version 8.1, /opt/IBM/db2/V8.1/ contains:

drwxr-xr-x    2 bin      bin          4096 Dec 11  2002 java
drwxr-xr-x    2 bin      bin          4096 Dec 11  2002 lib
drwxr-xr-x   30 bin      bin          4096 Dec 11  2002 license
drwxr-xr-x    2 bin      bin          4096 Dec 11  2002 map
 
As setuid root utilities are linked to the libraries stored in these
directories, their ownership by a user and group of a lower privilege level
constitutes a vulnerability.  If an attacker can obtain user bin
privileges, the shared libraries can be overwritten with malicious
replacements designed to obtain root privileges from the setuid root
utilities that use them.

It is likely that root privileges can be obtained through all or most of
the setuid utilities shipped with DB2.

* - Local directory structure may vary.

8. TightVNC Win32 Server QueryAllowNoPass Access Control Bypass...
BugTraq ID: 8347
Remote: Yes
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8347
Summary:
TightVNC is a VNC implementation that is freely available for a number of
platforms including Linux variants and Microsoft Windows operating systems.

TightVNC for Win32 platforms is reported to be prone to an unspecified
vulnerability that could permit access controls to be bypassed.  This issue
is reportedly due to a failure of the software while acting on the
QueryAllowNoPass configuration directive.  This issue is known to affect
the TightVNC server.

It has been reported that this issue exists in versions prior to 1.2.9.

Precise technical details are not available at this time.  This BID will be
updated when further details become available.

9. gURLChecker HTML Parser Denial Of Service Vulnerability
BugTraq ID: 8348
Remote: Yes
Date Published: Aug 05 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8348
Summary:
gURLChecker is software that can validate web links.  It is available for
Unix and Linux variants.

gURLChecker is reported to be prone to a denial of service vulnerability. 
This issue is exposed when the HTML parser (html_parser.c) included with
the software encounters specifically malformed HTML tags of excessive
length.  The issue appears to be present in the
uc_html_parser_get_attributes() function.  This could be exploited to cause
gURLChecker to crash if the software is used to access an untrusted web
page that contains code designed to trigger the condition.  

Though unconfirmed, this condition could result in memory corruption.  Due
to the nature of memory corruption issues, it may be possible to exploit
this issue to execute arbitrary code in the context of the software.

10. ERoaster Local Insecure Temporary File Creation Vulnerabilit...
BugTraq ID: 8350
Remote: No
Date Published: Aug 06 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8350
Summary:
eroaster is a freely available graphical frontend to cdrecord.  It is
available for the Linux operating system.

A problem has been reported in the secure creation of temporary files by
the eroaster application.  This may allow an attacker to overwrite files
belonging to the eroaster user.

Few details are available about this vulnerability.  However, it is
theorized that this issue results from inadequate checks on the existence
of a predictable temporary file prior to an attempt to create the file
during program execution.  By creating a symbolic link, an attacker could
potentially destroy data at the end of the symbolic link, or perform other
nefarious deeds.

11. Postfix Connection Proxying Vulnerability
BugTraq ID: 8361
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8361
Summary:
Postfix is a free, open-source mailer that was designed to be an
alternative to Sendmail. It is written and maintained by Wietse Venema. 

A vulnerability has been reported in Postfix that may allow an adversary to
"bounce-scan" a private network.  

The problem is in handling an attempt to deliver a message to an address
with the following format:

<[server_ip]:service!@local-host-name>  

This will cause the server to make a connection to the port and IP address
that is specified.  Such an address can be included in the "RCPT TO" or
"MAIL FROM" / Errors-To SMTP header fields.  By designing requests that
create bounces, an adversary can abuse this issue to proxy scans to
networks that the adversary would not normally have direct access to. 

It has been reported that this vulnerability can be exploited to use the
server as a distributed denial of service tool.  This is reportedly
possible through forcing the server to connect repeatedly to an arbitrary
port on an arbitrary host.

This issue was described in BID 8333 and is now being assigned an
individual BID.

12. Postfix SMTP Malformed E-mail Envelope Address Denial of Ser...
BugTraq ID: 8362
Remote: Yes
Date Published: Aug 04 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8362
Summary:
Postfix is a free, open-source mailer that was designed to be an
alternative to Sendmail. It is written and maintained by Wietse Venema. 

Postfix is reported to be prone to a denial of service attack. It can be
triggered by a malformed envelope address and can cause the queue manager
to lock up until the message is removed manually from the queue. It is also
reportedly possible to lock the SMTP listener, also resulting in a denial
of service.  The vulnerability is present in the address parser code.

Evidence of exploitation of this vulnerability can be detected in the mail
server logs.  Deleting the malicious message in the queue that is
associated to the "resolve_clnt_query: null recipient" error message
contained in Postfix logs and restarting the service can restore normal
functionality.

This issue was described in BID 8333 and is now being assigned an
individual BID.

13. VMware Workstation For Linux File Deletion Vulnerability
BugTraq ID: 8364
Remote: No
Date Published: Aug 07 2003 12:00A
Relevant URL: http://www.securityfocus.com/bid/8364
Summary:
VMWare Workstation is virtualization software that allows for multiple
virtual servers to run on a single host.

VMWare Workstation for Linux platforms is reported to be prone to an issue
that may allow unprivileged users on the host operating systems to delete
privileged files via manipulation of symbolic links.  This could result in
a denial of service if critical system files are deleted.  An attacker may
also exploit this issue to destroy data contained in sensitive files.  This
issue is likely due an insecure temporary file handling problem.

This issue is reported to affected VMWare Workstation for Linux 4.0.1 build
5289 and earlier releases.  Windows versions are not affected.



III. LINUX FOCUS LIST SUMMARY
-----------------------------
NO NEW POSTS FOR THE WEEK 2003-08-04 to 2003-08-11.

IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. NetSecure Web
By: NetSecure Software
Platforms: AIX, BSDI, Linux, Solaris, Windows NT
Relevant URL:
http://www.netsecuresoftware.com/netsecurenew/Products/NetSecureWeb/netsecureweb.html
Summary: 

NetSecure Web enables you to create Internet services guaranteeing full
protection of your information system network.

* Total access to internal database server 
* Fully transparent for internal and external users
* Preserves your private network from intrusion
* Ensures that only authorized requests are delivered
* Easy installation and operation


2. Zorp
By: Balabit IT Security Ltd.
Platforms: Linux
Relevant URL: http://www.balabit.com/products/zorp/
Summary: 

Zorp is a proxy firewall suite making it possible to finetune proxy
decisions (with its built in script language), to fully analyze complex
protocols (like SSH with several forwarded TCP connections), to use outband
authentication techniques (unlike common practices where proxy
authentication had to be hacked into the protocol). Combined the power
explained above, source code is provided under the GNU/GPL.

3. Kerio MailServer
By: Kerio Technologies Inc.
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.kerio.com/us/kms_home.html
Summary: 

Kerio MailServer represents a new generation of mail servers designed for
corporate networks. To help combat increasing security threats, Kerio
MailServer offers a wide range of features to keep email from being
intercepted, infected by computer viruses, or sent as spam

4. PureSight
By: iCognito
Platforms: Linux, Solaris, Windows 2000, Windows NT
Relevant URL: http://www.icognito.com/products/ps.shtml
Summary: 

PureSight Home is a powerful tool that helps parents and other concerned
users embrace technology in their homes while safeguarding the family from
intentional or accidental viewing of inappropriate content.

PureSight Home provides maximal protection from objectionable materials on
the web without the need for costly and time-consuming updates. Easily
installed and customized, the password-protected tool can be readily set
and modified according to parental preferences. 

5. CyberFusion
By: Proginet Corp
Platforms: AIX, HP-UX, Linux, OS/390, Solaris, SunOS, Windows 2000, Windows
95/98, Windows NT, Windows XP
Relevant URL: http://www.proginetuk.co.uk/products/cyberfusion/cyberfusion.htm
Summary: 

CyberFusion enables secure, reliable, scalable, automated and comprehensive
end-to-end management for secure file transfer across an extensive range of
disparate computing platforms, including all mainframes and client/server
environments.   
 
 
CyberFusion also provides extensive auditing, reporting and monitoring of
activity. Secure file transfers for data backup, data recovery, disaster
recovery, data archiving, data warehouse and other purposes are all easily
enabled using the many features which offer much more than basic secure FTP
(SFTP) or Secure Shell (SSH).  
 
Standard FTP software is not the cheap option it appears when total cost of
ownership (TCO) is properly examined and the improved computer security is
taken into account. 

6. SecurPass Suite
By: Proginet Corp
Platforms: AIX, AS/400, HP-UX, Linux, Netware, OS/2, OS/390, RACF, Solaris,
True64 UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.proginetuk.co.uk/products/securpass-home.htm
Summary: 

SecurPass suite may be installed together or stand-alone.

SecurPass-Sync Password Synchronisation in the enterprise across multiple
platforms & applications to enhance security & save helpdesk costs. Users
have the same password to all applications & on all platforms with any
change in one always propagated to all. Security is enhanced by enforcing
better policies, removes the likelihood of users writing down passwords,
users may be revoked, resumed or deleted instantly from all points of
entry. SecurPass-Sync offers the advantages of single sign-on without the
costs & complexities in implementation and with benefits typically seen
within a few weeks. 

SecurPass-Reset Password Reset - user self-reset of passwords without
helpdesk intervention in the enterprise to enhance security & save help
desk calls in multi or single-platform environments. Resets are enabled via
a browser-based self-help utility in accordance with enterprise security
standards that ensure type & numbers of questions fit the needs. Users
re-enable their own accounts if they have forgotten their passwords &
accidentally get locked out. Enterprise & user efficiency is increased &
the significant reduction in helpdesk calls will ensure a rapid ROI.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. FIAIF is an Intelligent Firewall v1.16.0
By: Anders Fugmann
Relevant URL: http://www.fiaif.net/
Platforms: Linux, POSIX
Summary: 

FIAIF is an Intelligent Firewall. It provides a highly customizable script
for setting up an iptables-based firewall. Configuration is done through
one configuration file for each network interface, to ease configuration.
FIAIF supports masquerading, port forwarding, traffic shaping, and more. 

2. Webanalyse v1.13
By: Ranx <[email protected]>
Relevant URL: http://www.nanobody.net/
Platforms: Linux, POSIX
Summary: 

Webanalyse is a Web site traffic statistics tool written in PHP 4. It
doesn't use any databases or Apache logs. Its reports include Web site
statistics by day, week, month, and year, referer, host, IP, browser. The
big advantage lies primarily in detail of each visit--you can follow the
pages or articles which are visited on your site. WebAnalyse can be added
very easily on all the pages where you wish to follow the activity. 

3. ngrep v1.41
By: Jordan Ritter <[email protected]>
Relevant URL: http://ngrep.sourceforge.net/
Platforms: AIX, Digital UNIX/Alpha, FreeBSD, IRIX, Linux, OpenBSD, Solaris,
Windows 2000, Windows 95/98, Windows NT
Summary: 

ngrep strives to provide most of GNU grep's common features, applying them
to the network layer. ngrep a pcap-aware tool that will allow you to
specify extended regular expressions to match against data payloads of
packets. It currently recognizes TCP and UDP across ethernet, ppp and slip
interfaces, and understands bpf filter logic in the same fashion as more
common packet sniffing tools like tcpdump and snoop.

4. Automated Password Generator (APG) v2.3.0b (dev)
By: Adel I. Mirzazhanov
Relevant URL: http://www.adel.nursat.kz/apg/
Platforms: FreeBSD, Linux, Solaris
Summary: 

Automated Password Generator is a set of tools for random password
generation including a standalone password generator, an RFC972 password
generation server, and a Perl client for the password generation server.
These feature a built-in X9.17 random number generator, and 35 modes of
password generation, including pronounceable password generation. 


5. Trinux 0.890
By: Matthew Franz
Relevant URL: http://trinux.sourceforge.net/
Platforms: Linux
Summary: 

Port scanning, packet sniffing, vulnerability scanning, sniffer detection,
packet construction, active/passive OS fingerprinting, network monitoring,
session hijacking, intrusion detection, and more--Trinux gives you the
power of Linux security tools without requiring a full-blown  Linux install
or the need to download, compile, and install a complete suite of security
tools that are typically not found in mainstream distributions.

6. Local Area Security Knoppix v0.3b
By: Jascha
Relevant URL: http://localareasecurity.com/
Platforms: Linux, POSIX
Summary: 

Local Area Security Knoppix is a 'Live CD' distribution based on Knoppix
but with a strong emphasis on security tools and small footprint. There are
four different versions of L.A.S. Knoppix to fit three specific needs.
These are a Firewall/IDS-centric version, a penetration testing/forensics
version, a MiniCD-size version covering a full spectrum of tools, and a
SECSERV secure mini-server that runs off CD. 



VI. SPONSOR INFORMATION
-----------------------

Precisely Define and Implement Network Security and Performance Policies
Integrated Intrusion Prevention and Traffic Shaping to:
  - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
  - Automatically Control P2P, IM and Spam Traffic
  - Ensure Reliable Performance of Mission Critical Applications
**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo

http://www.securityfocus.com/sponsor/CaptusNetworks_sf-news_030811

------------------------------------------------------------------------