SecurityFocus Linux Newsletter #80

John Boletta <[email protected]> Mon, 13 May 2002 10:42:16 -0600 (MDT)
Newsgroups gmane.comp.security.news.linux
Message-ID <[email protected]> 
SecurityFocus Linux Newsletter #80
----------------------------------

This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml

-------------------------------------------------------------------------------

I. FRONT AND CENTER
     1. IDS Evasion Techniques and Tactics
     2. Slot Machine Justice for Melissa Author
     3. Information Resilience and Homeland Security
II. LINUX VULNERABILITY SUMMARY
     1. Webmin / Usermin Authentication Bypass Vulnerability
     2. B2 B2Config.PHP Remote Command Execution Vulnerability
     3. AstroCam Buffer Overflow Vulnerability
     4. C-Note Squid_Auth_LDAP Pam Logging Format String Vulnerability
     5. Webmin / Usermin Login Cross Site Scripting Vulnerability
     6. Evolution Mailer Malformed MIME Header Denial Of Service...
     7. SuSE IfUp-DHCP Script Remote Arbitrary Command Execution...
     8. Linux NetFilter NAT Information Leakage Vulnerability
     9. Wu-imapd Partial Mailbox Attribute Remote Buffer Overflow...
III. LINUX FOCUS LIST SUMMARY
     1. plain text vs. html (Thread)
     2. AW: AW: entry in /etc/passwd (Thread)
     3. AW: plain text vs. html (Thread)
     4. AW: entry in /etc/passwd (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Covalent Fast Start Server
     2. Stronghold Enterprise
     3. TARA-PRO
V. NEW TOOLS FOR LINUX PLATFORMS
     1. fireflier v0.8
     2. OpenAI v0.2
     3. netcat (unix)
     4. Fenris v0.02
VI. SPONSORSHIP INFORMATION



I. FRONT AND CENTER
-------------------
1. IDS Evasion Techniques and Tactics
by Kevin Timm

Blackhats, security researchers and network intrusion detection system
(NIDS) developers have continually played a game of point-counterpoint
when it comes to NIDS technology. The BlackHat community continually
develops methods to evade or bypass NIDS sensors while NIDS vendors
continually counter act these methods with patches and new releases. Due
to the inherent complexities involved in capturing, analyzing and
understanding network traffic there are several common techniques that can
be used to exploit inherent weaknesses in NIDSs.

http://online.securityfocus.com/infocus/1577

2. Slot Machine Justice for Melissa Author
By Mark Rasch

Under capricious computer crime sentencing rules, virus-writer David Smith
managed to get the right prison term for all the wrong reasons.

http://online.securityfocus.com/columnists/81

3. Information Resilience and Homeland Security
By Richard Forno

In the current security-conscious environment, many people seem willing to
sacrifice their most fundamental democratic rights to support anything
that is promoted as good for homeland security. In many cases, an
unwillingness to do so is perceived as being ‘unpatriotic’. However, as
has been pointed out in this column many times since September 11, we must
make sure that we are not throwing out the baby with the bathwater. More
to the point, while fulfilling reasonable patriotic duty, we must be sure
that we continue to hold our government and corporations accountable for
their actions, despite the fact that current challenges may appear to
demand unflappable unity in the face of external attack.

http://online.securityfocus.com/columnists/80


II. BUGTRAQ SUMMARY
-------------------
1. Webmin / Usermin Authentication Bypass Vulnerability
BugTraq ID: 4700
Remote: Yes
Date Published: May 08 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4700
Summary:

Webmin is a web-based interface for system administration of Unix and
Linux operating systems. Usermin is a related product designed for user
level tasks.

It is possible to bypass authentication for a known user account in some
versions of Webmin and Usermin. A remote attacker may gain access as any
known username without requiring the password for that account.

Reportedly, both scripts communicate with another process during the
authentication process. It is possible to include control characters in
the authentication information passed between the processes. Under some
circumstances, this ability allows an attacker to authenticate as any
known username.

Webmin defines the user 'admin' with administrative privileges by default.
This user has access to a command shell by default.

This vulnerability requires that the password timeout configuration option
be set.

No further technical details are currently available.

2. B2 B2Config.PHP Remote Command Execution Vulnerability
BugTraq ID: 4673
Remote: Yes
Date Published: May 06 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4673
Summary:

B2 is a news/weblog tool written in php.  b2 allows webmasters to quickly
post news on the frontpage, and let viewers interact with each other.  It
is available primarily for Unix and Linux.

A problem in the program may allow an attacker to remotely execute
commands.

A variable that is referenced in the PHP scripts does not actually exist.
Thus, an attacker may be able to define the value of the variable. By
creating a PHP script on the remote side and embedding commands in it, the
attacker is able to reference the remote file. This could potentially
allow the attacker to execute commands on the vulnerable system.

This may lead to the execution of arbitrary commands on the vulnerable
system, with the privileges of the web server process.  This may also
potentially result in the disclosure of sensitive information.

3. AstroCam Buffer Overflow Vulnerability
BugTraq ID: 4684
Remote: Yes
Date Published: May 07 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4684
Summary:

AstroCam is used to control web cams on BSD and Linux systems. AstroCam
has a web interface/server for remote administration and is maintained by
Steffen Wendzel.

Versions of AstroCam prior to 1.4.1 Gtk Beta are susceptible to an
exploitable buffer overflow. A remote attacker able to exploit this
condition may be able to crash the server and create a denial of service
condition. Additionally, due to the nature of this vulnerability it is
likely that it is possible to execute arbitrary code as the server. This
possibility has not, however, been confirmed.

No additional technical details are currently available.

4. C-Note Squid_Auth_LDAP Pam Logging Format String Vulnerability
BugTraq ID: 4679
Remote: Yes
Date Published: May 06 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4679
Summary:

mysql_auth_ldap is a freely available, open source authentication package
distributed by C-Note.  It is available for the Linux operating system.

A problem with mysql_auth_ldap could make it possible for a remote user to
execute arbitrary code.  The problem is in logging of authentication.

Due to a problem in the design of the program, it may be possible to
exploit a format string vulnerability.  The logging() function in the
program calls syslog insecurely.  As a result, it may be possible for a
remote user attempting to connect to the host to supply format specifiers
that will cause memory to be overwritten.

This problem could result in the execution of attacker supplied code, and
result in elevated privileges.

5. Webmin / Usermin Login Cross Site Scripting Vulnerability
BugTraq ID: 4694
Remote: Yes
Date Published: May 08 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4694
Summary:

Webmin is a web-based interface for system administration of Unix and
Linux operating systems. Usermin is a related product designed for user
level tasks.

A cross site scripting issue has been reported with the login process for
both systems. User supplied input, under some circumstances, is included
in HTML content used to display an error message.

If a malicious link to this page is constructed, JavaScript code may be
injected into the page. The script will then execute within the context of
the Webmin domain.

Reportedly, this vulnerability can only be exploited if a user has not
authenticated to the system. As a result, authentication data can not
easily be acquired. However, information associated with other pages on
the same domain may be freely accessed.

6. Evolution Mailer Malformed MIME Header Denial Of Service Vulnerability
BugTraq ID: 4715
Remote: Yes
Date Published: May 06 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4715
Summary:

Evolution is personal and workgroup information management software for
Linux and Unix based systems.  It provides a mailer, calendaring, and a
contact manager.

Evolution is prone to a denial of service condition.  This condition is
known to occur when the Evolution mailer attempts to handle e-mail with a
malformed MIME header.  This causes the software to go into an infinite
loop, consuming large amounts of system resources and eventually causing
Evolution to crash.

A remote attacker may exploit this condition by sending maliciously
crafted e-mail to a user of the Evolution mailer.

7. SuSE IfUp-DHCP Script Remote Arbitrary Command Execution Vulnerability
BugTraq ID: 4695
Remote: Yes
Date Published: May 08 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4695
Summary:

ifup-dhcp is part of the sysconfig package included with SuSE Linux.  It
is freely available, and open source.

A problem with the package could make remote command execution possible.
The problem is in the handling of input.

It is possible to remotely execute commands on a system using the
ifup-dhcp script.  Due to insufficient handling of input by the ifup-dhcp
script, it is possible to send custom-crafted packets to a vulnerable host
that will be interpreted as commands.  This could allow an attacker to
execute commands as the user executing the ifup-dhcp script (typically
root).

This problem can allow the execution of commands by a remote user.  It
should be noted that this vulnerability must be exploited by a system
capable of sending DHCP packets to a vulnerable host, which most likely
must occur on a network local to the vulnerable host.

8. Linux NetFilter NAT Information Leakage Vulnerability
BugTraq ID: 4699
Remote: Yes
Date Published: May 08 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4699
Summary:

The Linux Kernel is the core of all Linux operating systems.  It is
developed and maintained by public domain.

A problem with the Netfilter portion of the kernel could allow an attacker
to gain information about hosts behind NAT firewalls.  The problem is in
the handling of some types of traffic.

It is possible for a remote user to discover ports on a firewall that are
mapped to systems behind the firewall via NAT using iptables.  By sending
a TCP packet to a port on a system with a TTL less than the total amount
of hops to the firewall, when the packet is routed to the host via NAT, a
ICMP TTL Expired response will be generated.  This response, generated by
the host at the end of the NAT rule, will not be translated by the NAT
system.

This problem can make it possible for a remote to gain information about a
system behind a NAT firewall.  This information may include the IP address
of the host, and may additionally include information such as the
operating system of the host.

9. Wu-imapd Partial Mailbox Attribute Remote Buffer Overflow Vulnerability
BugTraq ID: 4713
Remote: Yes
Date Published: May 10 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4713
Summary:

Washington University produces an IMAP (Internet Message Access Protocol)
server implementation, wu-imapd. It is available for Linux and most Unix
platforms. A vulnerability has been reported in some versions of this
server.

Under some circumstances, wu-imapd may perform an unsafe copy operation
using user supplied data. The length of this data is not properly checked,
and as a result a memory buffer may overflow. Reportedly it is possible to
corrupt stack data, including stack frame information. This may in turn
lead to the server executing arbitrary, attacker supplied code. An
attacker may also be able to crash the server, resulting in a denial of
service condition.

Reportedly, this vulnerability may be exploited when the remote user
requests partial mailbox attributes.

This only affects versions of imapd with legacy RFC 1730 support, which is
disabled by default in imapd 2001.313 and imap-2001.315.


III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. plain text vs. html (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/20020508220710.GA1383@localhost

2. AW: AW: entry in /etc/passwd (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

3. AW: plain text vs. html (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

4. AW: entry in /etc/passwd (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/F9B05628BAE2414A99980964199E954A08FB52@VOYAGER.brisbane.hatfields.com.au


IV.NEW PRODUCTS FOR LINUX PLATFORMS
-----------------------------------
1. Covalent Fast Start Server
by Covalent Technologies
Platforms: AIX, BSDI, DG-UX, FreeBSD, HP-UX, Linux, NetBSD, OpenBSD,
Solaris, UNIX, Unixware
Relevant URL:
http://www.covalent.net/products/faststart/
Summary:

Covalent Fast Start Server automatically produces an Apache configuration
suitable for many enterprise applications. Because of Apache's
standards-based interoperability, Fast Start Server is able to serve as
the presentation layer for all major application servers, databases and
Web-based applications, reducing the complexity of Web infrastructures. It
includes a streamlined installer for rapid deployment.

2. Stronghold Enterprise
by C2Net Software
Platforms: BSDI, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD, SCO,
Solaris, SunOS, True64 UNIX, Unixware
Relevnat URL:
http://www.redhat.com/software/apache/stronghold/
Summary:

Red Hat's Stronghold Enterprise is the most mature Apache-based web server
available today with over seven years of development and more than 14,000
servers running it to protect their data (E-Softs Security Space Web
Server Survey). Stronghold provides the tools to quickly install and
configure the popular Apache Web Server with the security features that
customers and business partners expect when they interact with your site.

3. TARA-PRO
by Advanced Research Corporation
Platforms: FreeBSD, HP-UX, IRIX, Linux, OpenBSD, SINIX, Solaris, SunOS,
True64 UNIX, Ultrix, UNIX
Relevant URL:
http://www-arc.com/tara/index.shtml
Summary:

Tiger Analytical Research Assistant (TARA) is an upgrade to the TAMU
'tiger' program. Since 'tiger' has not been updated since 1994, there were
numerous changes made to the 'systems' directories. Output was streamlined
to provide a more readable report file. Also, minor bugs in the 'scripts'
directory were corrected. TARA was tested under Red Hat Version 5.x, 6.x,
SGI IRIX 5.3, 6.x, and SunOS 5.x. This upgrade was performed by the
Advanced Research Corporation under a contract from the the United States
Government.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. fireflier v0.8
by Martin Maurer
Relevant URL:
http://sourceforge.net/projects/fireflier
Platforms: Linux, POSIX
Summary:

Fireflier is a firewall tool which is built on top of the iptables
framework. It allows you to create rules based on single incoming network
packets or to simply allow/deny single packets to pass. It features a
client-server approach for administering from another PC, SSL connection
between client and server, rules with timeouts (rules are deleted after
some time or when fireflier-server shuts down), and filtering based on
applications.

2. OpenAI v0.2
by thornhalo [email protected]
Relevant URL:
http://openai.sourceforge.net/downloads.html
Platforms: Linux, POSIX, Solaris, SunOS, Windows 2000, Windows 95/98,
Windows NT, Windows XP
Summary:

The OpenAI site is centered around an Open Source project and community
involving artificial intelligence. The project itself is the creation of a
set of tools that are considered to be models of human intelligence or
biomimicry. These tools are intended to be integrated into applications or
used stand alone for research.

3. netcat (unix)
by Hobbit
Relevant URL:
http://www.l0pht.com/~weld/netcat/
Platforms: AIX, BSDI, DG-UX, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD,
SCO, Solaris, SunOS, True64 UNIX, UNIX
Summary:

Netcat is a simple Unix utility which reads and writes data across network
connections, using TCP or UDP protocol. It is designed to be a reliable
"back-end" tool that can be used directly or easily driven by other
programs and scripts. At the same time, it is a feature-rich network
debugging and exploration tool, since it can create almost any kind of
connection you would need and has several interesting built-in
capabilities. Perhaps some equivalent to netcat, or "nc" should have been
written and distributed ten years earlier as another one of those cryptic
but fundamental Unix tools that we all use daily without even thinking
about it.

4. Fenris v0.02
by Michal Zalewski [email protected]
Relevant URL:
http://razor.bindview.com/tools/fenris/
Platforms: Linux
Summary:

Fenris is an attempt to fill the gap between currently used tools by
providing a freely available program analysis utility, suitable for
black-box code audits, algorithm analysis, rapid reconnaissance in
open-source projects, tracking down bugs, evaluating security subsystems,
etc.


VI. SPONSORSHIP INFORMATION
---------------------------
This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml

-------------------------------------------------------------------------------