SecurityFocus Linux Newsletter #150

SecurityFocus Linux Newsletter #150
------------------------------------
This Issue is Sponsored by: Captus Networks

Precisely Define and Implement Network Security and Performance Policies

Integrated Intrusion Prevention and Traffic Shaping to:
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
 - Automatically Control P2P, IM and Spam Traffic
 - Ensure Reliable Performance of Mission Critical Applications

**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo

http://www.securityfocus.com/sponsor/CaptusNetworks_linux-secnews_030922
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Wireless Policy Development (Part One)
     2. Dynamic Honeypots
     3. Does Microsoft Give a Damn?
     4. SPECIAL ANNOUNCEMENT
II. LINUX VULNERABILITY SUMMARY
     1. myServer cgi-lib.dll Remote Buffer Overflow Vulnerability
     2. ChatZilla Remote Denial of Service Attack
     3. OpenSSH Buffer Mismanagement Vulnerabilities
     4. Spider HOME Environment Variable Heap Overflow Vulnerability...
     5. Spider OPENWINHOME/XVIEWHOME Environment Variables Buffer Ov...
     6. KDE KDM PAM Module PAM_SetCred Privilege Escalation Vulnerab...
     7. KDE KDM Session Cookie Generation Weakness
     8. Sendmail Prescan() Variant Remote Buffer Overrun Vulnerabili...
     9. NetBSD Sysctl Argument Handling Vulnerabilities
     10. IBM AIX lpd Local Format String Vulnerability
     11. Sendmail Ruleset Parsing Buffer Overflow Vulnerability
III. LINUX FOCUS LIST SUMMARY
     NO NEW POSTS FOR THE WEEK 2003-09-15 to 2003-09-22.
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Sophos Anti-Virus
     2. Zorp
     3. F-Secure Policy Manager
     4. Gordano Messaging Suite
     5. LANDesk Management Suite 7
     6. ActiveScout Enterprise
V. NEW TOOLS FOR LINUX PLATFORMS
     1. NuFW v0.4
     2. Astaro Security Linux (Stable 4.x) v4.014
     3. procps v3.1.12
     4. Nmap v3.45
     5. Fireparse v3.1
     6. ICEWall Network Access System v0.0.1
VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Wireless Policy Development (Part One)
By Jamil Farschi

This is the first of a two-part series that will help create a framework
for the most important aspect of any wireless security strategy -- policy
development.

http://www.securityfocus.com/infocus/1732

2. Dynamic Honeypots
By Lance Spitzner

The search for the dream honeypot: dynamic honeypots, an appliance-like
plug-and-play solution.

http://www.securityfocus.com/infocus/1731

3. Does Microsoft Give a Damn?
By George Smith

The software-maker's dismal security record seems to have left it immune
to criticism and shame.

http://www.securityfocus.com/columnists/185

4. SPECIAL ANNOUNCEMENT

We are pleased to announce that The Basics infocus area has been renamed
to Foundations, in order to accommodate a wider range of security-related
articles that are not necessarily basic, but do not fit into one of the
seven other infocus areas either.

http://www.securityfocus.com/basics


II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. myServer cgi-lib.dll Remote Buffer Overflow Vulnerability
BugTraq ID: 8612
Remote: Yes
Date Published: Sep 12 2003
Relevant URL: http://www.securityfocus.com/bid/8612
Summary:
myServer is an application and web server for Microsoft Windows and Linux
operating systems.

myServer has been reported prone to a remote buffer overflow
vulnerability.  This issue is reported to exist in the cgi-lib.dll file.

The issue presents itself when the software attempts to process string
values of excessive length for URI variables.  This will cause adjacent
regions of memory to be corrupted with data contained in the malicious
string.  This will likely result in a crash due to the server attempting
to dereference an invalid memory address. However, it is possible that
this vulnerability may also allow the execution of arbitrary instructions
since the attacker may be able to leverage memory corruption to control
execution flow of the server process.  Any instructions carried out
through this vulnerability would be with the privileges of the web server
process.  However, the possibility of code execution has not been
confirmed.

This vulnerability was reported for myServer version 0.4.3 and earlier.

2. ChatZilla Remote Denial of Service Attack
BugTraq ID: 8627
Remote: Yes
Date Published: Sep 15 2003
Relevant URL: http://www.securityfocus.com/bid/8627
Summary:
ChatZilla is an IRC-client for Linux operating systems.  ChatZilla is
based on JavaScript and XUL and it is shipped with Mozilla web browser.

A vulnerability has been reported to exist in the software, that may allow
a remote attacker to cause a denial of service condition in ChatZilla.
The issue presents itself when a remote attacker posing as an IRC server
sends specially crafted requests containing long string values to a
vulnerable system.  The attack may cause the software to behave in an
unstable manner leading to a crash.

Successful exploitation of this vulnerability may allow a remote attacker
to cause the vulnerable software to crash.

It is not known if this condition could also be exploited to execute
arbitrary code on the client.

ChatZilla versions 0.8.23 and prior are reported to be prone to this
issue.

3. OpenSSH Buffer Mismanagement Vulnerabilities
BugTraq ID: 8628
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8628
Summary:
A buffer mismanagement vulnerability has been reported in OpenSSH.  This
issue exists in the 'buffer.c' source file.

The source of a problem is that a buffer structure size value may be
expanded before the program attempts to reallocate the buffer using this
size.  If the expanded buffer size triggers a call to fatal(), a series of
cleanup functions registered by the daemon will be called prior to exiting
the program.  As one of these functions may then reference the data within
the buffer, including the unused expanded value, a miscalculation could
potentially occur.  Depending on how the cleanup functions reference this
data, it may be theoretically possible for heap-based memory to be
corrupted.  This condition can reportedly be triggered by an overly large
packet.

External sources, including the vendor, do not believe that this issue
could be exploited to execute arbitrary code though it may potentially be
used to cause a denial of service.

There are also unconfirmed rumors of an exploit for this vulnerability
circulating in the wild.  The impact may be reduced by the implementation
of privilege separation on affected versions of OpenSSH.

OpenSSH has revised their advisory, pointing out a similar issue in the
channels.c source file and an additional issue.   Solar Designer has also
reportedly pointed out additional instances of the problem that may also
present vulnerabilities.  Individual BIDs will be created for these
additional issues when further analysis is complete.

4. Spider HOME Environment Variable Heap Overflow Vulnerability...
BugTraq ID: 8630
Remote: No
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8630
Summary:
Spider is a solitaire game for the X Window System. It is distributed as
part of the Debian Linux distribution.

Spider has been reported prone to a heap overflow condition when handling
HOME environment variables of excessive length.

The issue presents itself, because a call to calloc() allocates
'(strlen(str) + 256)' bytes as a buffer size, it is possible for an
attacker to trigger the allocation of an insufficient buffer, by crafting
a value for the 'str' variable that contains, '~/' sequences, these
sequences will later be expanded to equal the data contained in the 'HOME'
environment variable. An attacker may lever this condition to corrupt
adjacent malloc chunk headers with attacker-supplied data.

Although unconfirmed ultimately it may be possible that a local attacker
may exploit this condition to execute arbitrary instructions with GID
Games privileges.

It should be noted that although this vulnerability has been reported to
affect Spider version 1.1 other versions might also be affected.

5. Spider OPENWINHOME/XVIEWHOME Environment Variables Buffer Ov...
BugTraq ID: 8631
Remote: No
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8631
Summary:
Spider is a solitaire game for the X Window System. It is distributed as
part of the Debian Linux distribution.

Spider has been reported prone to a buffer overflow condition when
handling OPENWINHOME or XVIEWHOME environment variables of excessive
length.

The issue presents itself, due to a lack of sufficient boundary checks
performed on data contained in the OPENWINHOME or XVIEWHOME environment
variables before they are copied as part of an interpolated string into a
reserved 256 byte buffer in stack based memory.

Data that exceeds the size of the affected buffer may overrun its bounds
and corrupt adjacent memory. It has been reported that a local attacker
may exploit this condition to execute arbitrary instructions with GID
Games privileges.

It should be noted that although this vulnerability has been reported to
affect Spider version 1.1 other versions might also be affected.

6. KDE KDM PAM Module PAM_SetCred Privilege Escalation Vulnerab...
BugTraq ID: 8635
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8635
Summary:
KDM is the KDE Display Manager, a component of the KDE Desktop
Environment.  It is available for Linux/Unix operating systems.  KDM
provides a graphical login interface for KDE.

A problem has been reported in the KDE Display Manager (KDM) when used in
combination with Pluggable Authentication Modules (PAM).  Because of this,
an attacker may be able to gain unauthorized access to systems.

The problem is in the handling of specific authentication requests passed
through pam_setcred.  Under some circumstances, the results of the
pam_setcred call is not checked.  An attacker could create a malicious
request that circumvents authentication checking to gain unauthorized
access to a system.

It should be noted that this problem occurs when KDM is used in
combination with the pam_krb5 module.

7. KDE KDM Session Cookie Generation Weakness
BugTraq ID: 8636
Remote: Yes
Date Published: Sep 16 2003
Relevant URL: http://www.securityfocus.com/bid/8636
Summary:
KDM is the KDE Display Manager, a component of the KDE Desktop
Environment.  It is available for Linux/Unix operating systems.  KDM
provides a graphical login interface for KDE.

KDM uses a weak algorithm to generate session cookies.  In particular, the
session cookie generation algorithm is not sufficient for generating 128
bits of entropy.  This may potentially make brute-forcing of session
cookies a practical endeavor, inevitably enabling an adversary to hijack a
KDM user session.

For exploitation to be successful, the adversary must also be able to
bypass any host-based restrictions.  It is most likely that a malicious
local user could potentially exploit this to gain unauthorized access to
another user's existing session.

8. Sendmail Prescan() Variant Remote Buffer Overrun Vulnerabili...
BugTraq ID: 8641
Remote: Yes
Date Published: Sep 17 2003
Relevant URL: http://www.securityfocus.com/bid/8641
Summary:
Sendmail is prone to a buffer overrun vulnerability in the prescan()
function.  This issue is different than the vulnerability described in BID
7230.  The issue exists in the parseaddr.c source file and could allow for
corruption of stack or heap memory depending on where in the code the
function is called from.  One possible attack vector is if the function is
indirectly invoked via parseaddr(), though others may also exist.

This vulnerability could permit remote attackers to execute arbitrary code
via vulnerable versions of Sendmail.  This would occur with the privileges
of the server.

The vendor has reported that versions prior to version 8.12.10, are
vulnerable. Additionally it has been reported that commercial releases
including all versions of Sendmail Advanced Message Server, Sendmail Pro,
Sendmail Switch and Sendmail for NT are also vulnerable.

9. NetBSD Sysctl Argument Handling Vulnerabilities
BugTraq ID: 8643
Remote: No
Date Published: Sep 18 2003
Relevant URL: http://www.securityfocus.com/bid/8643
Summary:
Multiple vulnerabilities have been reported in the sysctl system call for
NetBSD systems.

A kernel panic could be the result of some sysctl nodes attempting to
dereference a NULL pointer.  In particular, a pointer variable was
mistakenly used for pointing to a user-level and a kernel level address.
A NULL pointer could be set to the variable by a user, potentially causing
a kernel panic and denying service to legitimate users of the system.

If the process ID of a zombie process is passed to the system call, this
could cause a kernel panic.  This could occur if the proc.* sysctl tree is
invoked on a zombie process, which would have invalid or non-existent
process information.  This could potentially be exploited by a user to
cause a kernel panic, denying service to legitimate users of the system.

Some sysctl nodes do not implement sufficient range checking, potentially
allowing kernel memory to be read.  The proc.curproc.rlimit subtree has a
number of nodes that contain information about process limits.  sysctl
provides a helper that is used to manipulate these values, which does not
implement sufficient range checking, potentially allowing values outside
of the rlimit structure to be read.  This could permit a local user to
browse kernel memory, potentially gaining access to sensitive information
such as credentials.  This issue may be similar to the vulnerability
described in BID 2364, which affects the Linux kernel.

It is not known if other BSD derivatives are similarly affected by these
issues.

These issues will be separated into individual BIDs when further analysis
is complete.

10. IBM AIX lpd Local Format String Vulnerability
BugTraq ID: 8646
Remote: No
Date Published: Sep 18 2003
Relevant URL: http://www.securityfocus.com/bid/8646
Summary:
lpd is a printing daemon designed to handle and queue print requests from
multiple users. It is a standard daemon found on most Unix and Linux
distributions.

IBM has released a security advisory stating that a local format string
vulnerability has been discovered in lpd on AIX systems. The problem
occurs due to incorrect usage of programming functions designed to take
formatted arguments. As a result, an attacker who is a member of the
'printq' group may be capable of feeding data to the vulnerable
application that may be interpreted as format specifiers. This may allow
for the attacker to overwrite arbitrary locations in memory, ultimately
resulting in the execution of attacker-supplied code.

11. Sendmail Ruleset Parsing Buffer Overflow Vulnerability
BugTraq ID: 8649
Remote: Unknown
Date Published: Sep 17 2003
Relevant URL: http://www.securityfocus.com/bid/8649
Summary:
Sendmail is a widely used MTA for Unix and Microsoft Windows systems.

Sendmail has been reported prone to a buffer overflow condition when
parsing non-standard rulesets.

It has been reported that an attacker may trigger a buffer overflow
condition in Sendmail, when Sendmail parses specific rulesets.
Non-standard rulesets recipient(2), final(4) and mailer-specific envelope
recipient may be used as an attack vector to trigger this vulnerability.
It should be noted that Sendmail under a default configuration is not
vulnerable to this condition. It is not currently known, if this
vulnerability may potentially be exploited to execute arbitrary code.
However due to the nature of the condition, although unconfirmed, it has
been conjectured that ultimately an attacker may exploit this condition to
execute arbitrary code in the context of the affected Sendmail server.

It is not currently known if this vulnerability is restricted to local
exploitation or if the issue may also be exploited remotely.

Explicit technical details regarding this vulnerability are not currently
available; this BID will be updated as further details are disclosed.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
NO NEW POSTS FOR THE WEEK 2003-09-15 to 2003-09-22.


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Sophos Anti-Virus
By: Sophos
Platforms: AIX, DOS, FreeBSD, HP-UX, Linux, MacOS, Netware, OS/2, Solaris,
UNIX, VMS, Windows 3.x, Windows 95/98, Windows NT
Relevant URL: http://www.sophos.com/products/sav/
Summary:

Sophos Anti-Virus is a unique solution to the virus problem, providing
true cross-platform protection in a single, fully integrated product. The
network-centric design provides a host of benefits for the protection of
servers, workstations and portables. Sophos's ground-breaking architecture
maximises protection, while minimising performance and administrative
overheads.

2. Zorp
By: Balabit IT Security Ltd.
Platforms: Linux
Relevant URL: http://www.balabit.com/products/zorp/
Summary:

Zorp is a proxy firewall suite making it possible to finetune proxy
decisions (with its built in script language), to fully analyze complex
protocols (like SSH with several forwarded TCP connections), to use
outband authentication techniques (unlike common practices where proxy
authentication had to be hacked into the protocol). Combined the power
explained above, source code is provided under the GNU/GPL.

3. F-Secure Policy Manager
By: F-Secure Corporation
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.f-secure.com/products/policy-man/index.shtml
Summary:

With F-Secure Policy Manager, your system administrator can manage all the
critical security applications from antivirus protection to file and
network encryption from one single console. The administrator can
automatically and remotely install, configure and update the applications.
It is possible to manage the security applications on almost any device
and across the enterprise so that even the security of mobile workers'
laptops is guaranteed. In addition to all this, the administrator can
easily monitor the network by generating extensive reports on the security
status of the network.

4. Gordano Messaging Suite
By: Gordano
Platforms: AIX, Linux, Solaris, Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.gordano.com/
Summary:

Gordano's Messaging Suite provides robust and secure email, instant and
SMS messaging for small, medium and large businesses.

5. LANDesk Management Suite 7
By: LANDesk Software
Platforms: AIX, HP-UX, Linux, MacOS, Solaris, Windows 2000, Windows 95/98,
Windows NT, Windows XP
Relevant URL: http://www.landesk.com/products/ilms/
Summary:

LANDesk Management Suite 7 is a comprehensive, integrated management
solution that's easy to use. Enabling proactive management of desktops,
server and mobile devices across heterogeneous IT environments.
 - Keep up with security patches and virus updates
 - Efficiently install and maintain software on the desktop
 - Decrease software license costs and respond to audits
 - Reduce the cost of helpdesk support
 - Discover and manage hardware and software assets
 - Migrate many users and their profiles to new operating systems

6. ActiveScout Enterprise
By: ForeScout Technologies
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.forescout.com/enterprise.html
Summary:

ActiveScout Enterprises actively protects a network with multiple access
points. In addition to the identification of attackers and automatic
action to stop them, this solution offers full management capabilities,
from configuration and reporting, to the sharing of threat information
between multiple deployed scouts.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. NuFW v0.4
By: regit
Relevant URL: http://www.nufw.org
Platforms: Linux, POSIX
Summary:

NuFW is a set of daemons providing filtering of packets at the user level.
On the client side, users have to run a client that sends authentication
packets to the gateway. On the server side, the gateway associates userids
to packets, thus enabling the possibility to filter packets on a user
basis. Furthermore, the server architecture is done to use external
authentication source such as an LDAP server.

2. Astaro Security Linux (Stable 4.x) v4.014
By: astaro
Relevant URL: http://www.astaro.com/
Platforms: Linux, POSIX
Summary:

Astaro Security Linux is a firewall solution. It does stateful packet
inspection filtering, content filtering, user authentication, virus
scanning, VPN with IPSec and PPTP, and much more. With its Web-based
management tool, WebAdmin, and the ability to pull updates via the
Internet, it is pretty easy to manage. It is based on a special hardened
Linux 2.4 distribution where most daemons are running in change-roots and
are protected by kernel capabilities.

3. procps v3.1.12
By: Albert Cahalan
Relevant URL: http://procps.sf.net/
Platforms: Linux
Summary:

procps is a package of utilities which report on the state of the system,
including the states of running processes, amount of memory available and
currently-logged-in users.

4. Nmap v3.45
By: Fyodor
Relevant URL: http://www.insecure.org/nmap/
Platforms: AIX, BSDI, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD,
Solaris, SunOS
Summary:

Nmap is a utility for network exploration or security auditing. It
supports ping scanning (determine which hosts are up), many port scanning
techniques (determine what services the hosts are offering), and TCP/IP
fingerprinting (remote host OS or device identification). Nmap also offers
flexible target and port specification, decoy/stealth scanning, sunRPC
scanning, and more. Most Unix and Windows platforms are supported in both
GUI and commandline modes. Several popular handheld devices are also
supported, including the Sharp Zaurus and the iPAQ.

5. Fireparse v3.1
By: Aaron D. Marasco
Relevant URL: http://www.fireparse.com
Platforms: Linux
Summary:

fireparse is an ADMLogger plugin that emails a report of all packets that
have been logged by the kernel's packet filtering subsystem
(iptables/netfilter or ipchains). The report includes source and
destination ports, direction, logged packet count, matched rule, and fully
resolved host names (if available). The email report can be formatted to
plain text or a colored HTML table.

6. ICEWall Network Access System v0.0.1
By: Arsen G. Petrosyan <[email protected]>
Relevant URL: http://icewall.ru/
Platforms: Linux, POSIX
Summary:

ICEWall Network Access System is a modular billing and security system.
The main module is "IC-Radius" (a Radius protocol implementation); it is
needed to work with VPN clients. It can set traffic limits and time
limits, block viewing of external sites, etc. Th statistics module
provides information about individual clients and total usage.


VI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Captus Networks

Precisely Define and Implement Network Security and Performance Policies

Integrated Intrusion Prevention and Traffic Shaping to:
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
 - Automatically Control P2P, IM and Spam Traffic
 - Ensure Reliable Performance of Mission Critical Applications
**FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo

http://www.securityfocus.com/sponsor/CaptusNetworks_linux-secnews_030922
------------------------------------------------------------------------