SecurityFocus Linux Newsletter #154
John Boletta <[email protected]> Mon, 20 Oct 2003 10:55:56 -0600 (MDT)
| Newsgroups | gmane.comp.security.news.linux |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Linux Newsletter #154
------------------------------------
This Issue is Sponsored by: Tenable Security
Tenable provides security software which enables enterprises to
distribute, manage, and communicate vulnerability and intrusion detection
information across the entire organization. Tenable?s breakthrough
Lightning? technology elegantly simplifies the complex nature of network
security by offering detailed useable reports for network and security
administrators and high-level organizational reports for CxOs.
In addition, Tenable offers both active (NeWT) and passive (NeVO)
vulnerability detection solutions to further enhance your network
vulnerability identification. For more information, Tenable can be reached
at 410-872-0555 or on the Internet at
http://www.securityfocus.com/sponsor/TenableSecurity_linux-secnews_031020
------------------------------------------------------------------------
I. FRONT AND CENTER
1. Incident Response Tools For Unix, Part Two: File-System Tools
2. Transparent, Bridging Firewall Devices
3. Disclosure Plan Won't Help
4. Too Many Hacks
5. The Flaw of Security Through Diversification
6. Counterpoint: Linux vs. Windows Viruses
II. LINUX VULNERABILITY SUMMARY
1. IRCnet IRCD Local Buffer Overflow Vulnerability
2. Apache Mod_Throttle Module Local Shared Memory Corruption Vu...
3. Macromedia ColdFusion MX SQL Error Message Cross-Site Scrip...
4. Bajie HTTP Server Example Scripts And Servlets Cross-Site Sc...
III. LINUX FOCUS LIST SUMMARY
1. Synflooding a Linux (Thread)
2. Administrivia: Your Response Requested (Thread)
3. New articles on the SecurityFocus site (Thread)
4. curious port activity (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. Sophos Anti-Virus
2. F-Secure Policy Manager
3. Gordano Messaging Suite
4. LANDesk Management Suite 7
5. ActiveScout Enterprise
6. Immunity CANVAS
V. NEW TOOLS FOR LINUX PLATFORMS
1. Webmin Usermonitor v0.11a
2. radmind v1.2.0
3. Steghide v0.5.1
4. flexbackup v1.2.1
5. FireHOL R5 v1.159
6. Samhain v1.7.12
VI. SPONSOR INFORMATION
I. FRONT AND CENTER
-------------------
1. Incident Response Tools For Unix, Part Two: File-System Tools
By Holt Sorenson
This article is the second in a three-part series on tools that are useful
during incident response and investigation after a compromise has occurred
on a OpenBSD, Linux, or Solaris system. This installment will focus on
file system tools.
http://www.securityfocus.com/infocus/1738
2. Transparent, Bridging Firewall Devices
By Matthew Tanase
This article examines the concept of a transparent or bridging firewall
which sits hidden in-line with the network it protects.
http://www.securityfocus.com/infocus/1737
3. Disclosure Plan Won't Help
By Mark Rasch
Encouraging publicly-traded companies to disclose their cyber security
efforts would only force them to choose between providing vague and
useless platitudes, or
specific and dangerous details.
http://www.securityfocus.com/columnists/192
4. Too Many Hacks
By Hal Flynn
The open-source community should abandon its piecemeal approach to
securing Linux-- and soon.
http://www.securityfocus.com/columnists/191
5. The Flaw of Security Through Diversification
by Mark Burnett
In the recent CCIA paper at
http://www.ccianet.org/papers/cyberinsecurity.pdf the authors Geer,
Pfleeger, Schneier, Quarterman, Metzger, Bace, and Gutmann introduce the
concept of "risk diversification as a primary defense against aggregated
risk when that risk cannot otherwise be addressed."
http://www.securityfocus.com/guest/23184
6. Counterpoint: Linux vs. Windows Viruses
by Thor Larholm
The debate over which Operating System is the most secure is an age-old
debate, which is filled with a vigor and passion similar to those debating
their religious beliefs. However, in the end it all boils down to reliable
management, adherence to policies and procedures and proper use.
http://www.securityfocus.com/guest/23028
II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. IRCnet IRCD Local Buffer Overflow Vulnerability
BugTraq ID: 8817
Remote: Yes
Date Published: Oct 13 2003
Relevant URL: http://www.securityfocus.com/bid/8817
Summary:
IRCnet IRCD is an IRC implementation that is available for a number of
platforms including Linux/Unix variants.
IRCnet IRCD has been reported prone to a buffer overflow vulnerability
that may be exploited by local users. The issue likely presents itself due
to a lack of sufficient bounds checking performed on user-supplied data
before it is copied into a reserved buffer in memory. Supplied data that
exceeds the size of the affected buffer may overrun its bounds and corrupt
adjacent memory. This issue may be exploited to crash the affected server.
Although unconfirmed, due to the nature of this vulnerability it has been
conjectured that a local attacker may also leverage this condition to
potentially have arbitrary instructions executed in the context of the
affected server.
This vulnerability has been reported to affect all versions of IRCnet IRCD
in the 2.10 development tree up to and including 2.10.3p3.
2. Apache Mod_Throttle Module Local Shared Memory Corruption Vu...
BugTraq ID: 8822
Remote: No
Date Published: Oct 14 2003
Relevant URL: http://www.securityfocus.com/bid/8822
Summary:
The mod_throttle Apache module is an application developed by sert.com. It
is designed to reduce the load used when handling specified server
requests. mod_throttle is available for the BSD, Linux, and Solaris
operating systems.
The mod_throttle Apache module is said to be prone to a vulnerability that
could allow for local privilege elevation. The problem occurs due to the
mod_throttle module incorrectly storing critical data within shared memory
that is accessible by a user with 'apache' privileges. As a result, an
attacker may be capable of corrupting memory pointers and a data file
located in a shared memory segment. These pointers may have previously
pointed to internal module procedures or may point to critical data
required to unload the module while Apache is terminating.
This could ultimately lead to privilege elevation during the startup or
shutdown procedures of Apache, ultimately allowing for an attacker to gain
root privileges.
To successfully exploit this issue, it has been reported that an attacker
must somehow cause Apache to reload its configuration file. As a result,
this vulnerability may be exploited in conjunction with the issue
described in BID 5884. Other methods of loading the configuration file may
also be used.
3. Macromedia ColdFusion MX SQL Error Message Cross-Site Scrip...
BugTraq ID: 8840
Remote: Yes
Date Published: Oct 15 2003
Relevant URL: http://www.securityfocus.com/bid/8840
Summary:
ColdFusion MX is the application server for developing and hosting
infrastructure distributed by Macromedia. It is available as a standalone
product for Unix, Linux, and Microsoft Operating Systems.
A vulnerability has been reported to exist in the software that may allow
a remote attacker to execute HTML or script code in the browser of a user
running the vulnerable version of ColdFusion MX.
The problem is due to a lack of sanitization of user-supplied input by the
software. Although unconfirmed, it has been reported to occur when the
software displays error messages generated by the underlying database.
Therefore making it possible for an attacker to construct a malicious link
containing HTML or script code that may be rendered in a user's browser
upon visiting that link. This attack would occur in the security context
of the vulnerable site.
Successful exploitation of this vulnerability may allow an attacker to
steal cookie-based authentication credentials. Other attacks are also
possible.
Macromedia ColdFusion MX version 6.0 was reported to be vulnerable to this
issue, however other versions may be affected as well.
4. Bajie HTTP Server Example Scripts And Servlets Cross-Site Sc...
BugTraq ID: 8841
Remote: Yes
Date Published: Oct 16 2003
Relevant URL: http://www.securityfocus.com/bid/8841
Summary:
Bajie HTTP Web Server is a Java web server. It is available for Microsoft
Windows and Unix and Linux variants.
Demonstration scripts and servlets that are distributed as part of Bajie
HTTP Server have been reported prone to multiple cross-site scripting
vulnerabilities. These demonstration scripts and servlets are likely not
supposed to be published for external access, but rather supposed to act
as a demonstration of the functionality contained in the Bajie HTTP
server.
It has been reported that a remote attacker may construct a malicious link
containing script and HTML code to any one of the vulnerable demonstration
scripts or servlets on the affected server. If this link is followed the
code contained therein will be rendered in the browser of the user who
followed the link. Code execution will occur in the context of the
vulnerable script running on the Bajie HTTP Server.
A remote attacker may exploit this vulnerability to steal cookie based
authentication tokens. Other attacks are also possible.
It should be noted that although this vulnerability has been reported to
affect Bajie HTTP server version 0.95zxv4, previous versions that are
bundled with the same demonstration scripts are also likely vulnerable.
III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Synflooding a Linux (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/341718
2. Administrivia: Your Response Requested (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/341508
3. New articles on the SecurityFocus site (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/341504
4. curious port activity (Thread)
Relevant URL:
http://www.securityfocus.com/archive/91/341168
IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Sophos Anti-Virus
By: Sophos
Platforms: AIX, DOS, FreeBSD, HP-UX, Linux, MacOS, Netware, OS/2, Solaris,
UNIX, VMS, Windows 3.x, Windows 95/98, Windows NT
Relevant URL: http://www.sophos.com/products/sav/
Summary:
Sophos Anti-Virus is a unique solution to the virus problem, providing
true cross-platform protection in a single, fully integrated product. The
network-centric design provides a host of benefits for the protection of
servers, workstations and portables. Sophos's ground-breaking architecture
maximises protection, while minimising performance and administrative
overheads.
2. F-Secure Policy Manager
By: F-Secure Corporation
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.f-secure.com/products/policy-man/index.shtml
Summary:
With F-Secure Policy Manager, your system administrator can manage all the
critical security applications from antivirus protection to file and
network encryption from one single console. The administrator can
automatically and remotely install, configure and update the applications.
It is possible to manage the security applications on almost any device
and across the enterprise so that even the security of mobile workers'
laptops is guaranteed. In addition to all this, the administrator can
easily monitor the network by generating extensive reports on the security
status of the network.
3. Gordano Messaging Suite
By: Gordano
Platforms: AIX, Linux, Solaris, Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.gordano.com/
Summary:
Gordano's Messaging Suite provides robust and secure email, instant and
SMS messaging for small, medium and large businesses.
4. LANDesk Management Suite 7
By: LANDesk Software
Platforms: AIX, HP-UX, Linux, MacOS, Solaris, Windows 2000, Windows 95/98,
Windows NT, Windows XP
Relevant URL: http://www.landesk.com/products/ilms/
Summary:
LANDesk Management Suite 7 is a comprehensive, integrated management
solution that's easy to use. Enabling proactive management of desktops,
server and mobile devices across heterogeneous IT environments.
- Keep up with security patches and virus updates
- Efficiently install and maintain software on the desktop
- Decrease software license costs and respond to audits
- Reduce the cost of helpdesk support
- Discover and manage hardware and software assets
- Migrate many users and their profiles to new operating systems
5. ActiveScout Enterprise
By: ForeScout Technologies
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.forescout.com/enterprise.html
Summary:
ActiveScout Enterprises actively protects a network with multiple access
points. In addition to the identification of attackers and automatic
action to stop them, this solution offers full management capabilities,
from configuration and reporting, to the sharing of threat information
between multiple deployed scouts.
6. Immunity CANVAS
By: Immunity, Inc.
Platforms: Linux, Windows 2000
Relevant URL: http://www.immunitysec.com/CANVAS/
Summary:
Immunity CANVAS is 100% pure Python, and every license includes full
access to the entire CANVAS codebase. Python is one of the easiest
languages to learn, so even novice programmers can be productive on the
CANVAS API, should they so chose.
Immunity CANVAS is both a valuable demonstration tool for enterprise
information security teams or system adminstrators, and an advanced
development platform for exploit developers, or people learning to become
exploit developers.
V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Webmin Usermonitor v0.11a
By: Alexander Gehrig <[email protected]>
Relevant URL: http://www.gehrigal.net/projects/webmin_usermonitor/
Platforms: AIX, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD, SCO,
Solaris, SunOS, UNIX
Summary:
Webmin Usermonitor is a Webmin module that allows you to view all user
connections to the system which are based on Telnet, SSH, or Samba. It is
able to kill a user's connection or send a message to the user.
2. radmind v1.2.0
By: UMich RSUG
Relevant URL: http://rsug.itd.umich.edu/software/radmind
Platforms: FreeBSD, Linux, MacOS, OpenBSD, Solaris, SunOS, UNIX
Summary:
radmind is a suite of Unix command-line tools and a server designed to
remotely administer the file systems of multiple Unix machines. At its
core, radmind operates as a tripwire. It is able to detect changes to any
managed filesystem object, e.g. files, directories, links, etc. However,
radmind goes further than just integrity checking: once a change is
detected, radmind can optionally reverse the change. Each managed machine
may have its own loadset composed of multiple, layered overloads. This
allows, for example, the operating system to be described separately from
applications. Loadsets are stored on a remote server. By updating a
loadset on the server, changes can be pushed to managed machines.
3. Steghide v0.5.1
By: Stefan Hetzl
Relevant URL: http://steghide.sourceforge.net
Platforms: AIX, BSDI, Digital UNIX/Alpha, FreeBSD, HP-UX, IRIX, Linux,
NetBSD, OpenBSD, SCO, Solaris, SunOS, True64 UNIX, Ultrix, UNIX, Unixware,
Windows 95/98, Windows NT
Summary:
Steghide is steganography program which hides bits of a data file in some
of the least significant bits of another file in such a way that the
existence of the data file is not visible and cannot be proven. Steghide
is designed to be portable and configurable and features hiding data in
bmp, wav and au files, blowfish encryption, MD5 hashing of passphrases to
blowfish keys, and pseudo-random distribution of hidden bits in the
container data.
4. flexbackup v1.2.1
By: Paul Holcomb
Relevant URL: http://www.flexbackup.org
Platforms: Linux, Perl (any system supporting perl), Solaris, SunOS
Summary:
flexbackup is a configurable and easy to use Perl-based backup tool, that
can backup local files as well as remote machines (using ssh). It allows
the backup itself to be made with afio, cpio, tar, dump, star, or pax. It
can work with tape drives, on-disk archive files, or on-disk directory
trees.
5. FireHOL R5 v1.159
By: Costa Tsaousis
Relevant URL: http://firehol.sourceforge.net/
Platforms: Linux, POSIX, UNIX
Summary:
FireHOL is a script producing stateful iptables firewalls. It can control
any number of internal/external interfaces, offers control on any
combination of routed traffic, sets up DMZ routers and servers and all
kinds of NAT, provides strong protection (flooding, spoofing, etc),
transparent caches, and more. Its goal is to be completely abstracted and
powerful but also easy to use, audit, and understand.
6. Samhain v1.7.12
By: rainer
Relevant URL: http://la-samhna.de/samhain/
Platforms: AIX, Digital UNIX/Alpha, FreeBSD, HP-UX, Linux, Solaris,
Unixware
Summary:
samhain is a daemon that can check file integrity, search the file tree
for SUID files, and detect kernel module rootkits (Linux only). It can be
used either standalone or as a client/server system for centralized
monitoring, with strong (192-bit AES) encryption for client/server
connections and the option to store databases and configuration files on
the server. For tamper resistance, it supports signed
database/configuration files and signed reports/audit logs. It has been
tested on Linux, FreeBSD, Solaris, AIX, HP-UX, and Unixware.
VI. SPONSOR INFORMATION
-----------------------
This Issue is Sponsored by: Tenable Security
Tenable provides security software which enables enterprises to
distribute, manage, and communicate vulnerability and intrusion detection
information across the entire organization. Tenable?s breakthrough
Lightning? technology elegantly simplifies the complex nature of network
security by offering detailed useable reports for network and security
administrators and high-level organizational reports for CxOs.
In addition, Tenable offers both active (NeWT) and passive (NeVO)
vulnerability detection solutions to further enhance your network
vulnerability identification. For more information, Tenable can be reached
at 410-872-0555 or on the Internet at
http://www.securityfocus.com/sponsor/TenableSecurity_linux-secnews_031020
------------------------------------------------------------------------