SecurityFocus Linux Newsletter #156

SecurityFocus Linux Newsletter #156
------------------------------------
This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_linux-secnews_031103
and use priority code SF4.
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Introduction to Nessus
     2. Pretty Good at Gettin' By
II. LINUX VULNERABILITY SUMMARY
     1. Opera Web Browser IFRAME Zone Restriction Bypass Vulnerabili...
     2. Multiple Advanced Poll PHP Vulnerabilities
     3. Sun Microsystems Java Virtual Machine Security Manager Denia...
     4. SH-HTTPD Character Filtering Remote Information Disclosure V...
     5. RedHat Apache Directory Index Default Configuration Error
     6. Musicqueue SIGSEGV Signal Handler Insecure File Creation Vul...
     7. IWConfig Local ARGV Command Line Buffer Overflow Vulnerabili...
     8. Les Visiteurs Multiple Remote File Include Vulnerabilities
     9. Musicqueue Multiple Buffer Overrun Vulnerabilities
     10. thttpd defang Remote Buffer Overflow Vulnerability
     11. kpopup Local Arguments Format String Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. Sendmail & Disk Quota on RedHat (Thread)
     2. NFS replacements for Linux (Thread)
     3. AntiVirus for Red Hat 9? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Sophos Anti-Virus
     2. Gordano Messaging Suite
     3. LANDesk Management Suite 7
     4. ActiveScout Enterprise
     5. Immunity CANVAS
     6. SecretAgent
V. NEW TOOLS FOR LINUX PLATFORMS
     1. BitDefender for Sendmail libmilter v1.5.5-BETA
     2. KAVClient v0.2.1
     3. sensorTrends v0.6
     4. mod_securid v2.0
     5. Socks Server 5 v2.4rl
     6. LinuxMagic magic-smtpd v0.8.0
VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Introduction to Nessus
By Harry Anderson

This article describes the installation, configuration and features of the
latest version of Nessus, a powerful and free client-server based security
scanner.

http://www.securityfocus.com/infocus/1741

2. Pretty Good at Gettin' By
By George Smith

Whether it's a student slipping contraband past airport metal detectors,
or a researcher modeling an unstoppable computer virus -- demonstrations
just don't do justice to the real state of security.

http://www.securityfocus.com/columnists/194


II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. Opera Web Browser IFRAME Zone Restriction Bypass Vulnerabili...
BugTraq ID: 8887
Remote: Yes
Date Published: Oct 24 2003
Relevant URL: http://www.securityfocus.com/bid/8887
Summary:
Opera is a web browser available for a number of platforms, including
Microsoft Windows, Linux and Unix variants and Apple MacOS.

A flaw in the Opera web browsers security model has been discovered that
could allow an attacker to access a users file system within the Local
Zone. The problem occurs when handling malformed HTML iframes which point
to local system locations. Exploitation of this vulnerability could result
in the exposure of sensitive data or could potentially lead to the
corruption of system critical files. Symantec has confirmed that the proof
of concept provided by the researcher effectively gains opens access to
the local file system, however it has not been confirmed whether the local
files may be modified.

It should be noted that due to the nature of this vulnerability it may
theoretically be possible to leverage the condition to execute arbitrary
code. However, Symantec is currently unaware if a method exists under
which Opera can be influenced to carry out this type of operation.

This vulnerability is believed to affect the latest release of Opera as
well as prior releases.

**UPDATE: The vendor has contacted Symantec and has stated that this is
not a vulnerability.  Symantec has not been able to reproduce the claims
made by the individual who reported this issue.  This record is being
retired, though it may be re-activated if further findings confirm
existence of the vulnerability.

2. Multiple Advanced Poll PHP Vulnerabilities
BugTraq ID: 8890
Remote: Yes
Date Published: Oct 25 2003
Relevant URL: http://www.securityfocus.com/bid/8890
Summary:
Advanced Poll is a freely available, open source PHP web application.  It
is available for the Unix, Linux, and Microsoft platforms.

Several problems exist in Advanced Poll when handling input from remote
users.  Because of this, an attacker may be able to gain sensitive
information, include php files, or execute PHP code.

The following issues exist:

The comments.php file does not properly filter input in some fields.  If
magic_quotes_gpc=OFF has been set in PHP, an attacker could submit PHP
code in some fields to the script, which would execute the code on the
local host with the privileges of the web server process.

The following files allow the remote inclusion of arbitrary PHP files.
booth.php
poll_ssi.php
popup.php
index.php

(the above files are vulnerable with register_globals off or on)

admin_tpl_new.php
admin_tpl_misc_new.php
admin_templates_misc.php
admin_templates.php
admin_stats.php
admin_settings.php
admin_preview.php
admin_password.php
admin_logout.php
admin_license.php
admin_help.php
admin_embed.php
admin_edit.php
admin_comment.php

(the above files are vulnerable only with register_globals off)

An attacker could use this issue to reference PHP files on remote servers,
which would result in the execution of commands locally.

The file contained in misc/info.php allows a remote attacker to gain
information from the phpinfo() function.

3. Sun Microsystems Java Virtual Machine Security Manager Denia...
BugTraq ID: 8892
Remote: Yes
Date Published: Oct 26 2003
Relevant URL: http://www.securityfocus.com/bid/8892
Summary:
The Java Virtual Machine is a component of the Sun Microsystems Java
distributions.  It is available for Unix, Linux, and Microsoft Windows
platforms.

A problem has been reported in the Sun Microsystems Java Virtual Machine
that occurs when implementing the Security Manager.  Exploitation of this
condition can result in the crashing of the virtual machine itself.  The
specifics of the problem are not currently known.

Specific circumstances are not known in which exploitation of this issue
could occur.  The issue is, however, indicative of a problem in the
internals of the Java Virtual Machine.  It is conjectured that this is a
security issue, though this has not yet been confirmed.  This Bugtraq ID
will be further updated when further analysis and detail is available.

4. SH-HTTPD Character Filtering Remote Information Disclosure V...
BugTraq ID: 8897
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8897
Summary:
sh-httpd is a freely available, open source web server written in shell.
It is available for the Unix and Linux platforms.

A problem has been identified in the handling of some characters by
sh-httpd.  Because of this, an attacker may be able to gain unauthorized
access to information.

The problem is in the handling of the asterisk character.  When a request
is made to the service for a directory listing using the asterisk
character (*), it is possible to see the contents of the entire directory
requested.  An attacker could use this issue to gather information about
host design, services enabled, and other potentially restricted
information.

5. RedHat Apache Directory Index Default Configuration Error
BugTraq ID: 8898
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8898
Summary:
A vulnerability has been reported to be present in the RedHat Apache
configuration that may allow remote attacker to view directory listings by
sending a specific HTTP GET request.

It has been reported that this issue exist even when autoindex for the
root directory has been disabled and a default welcome page is supposed to
be displayed.  A request for '//' reportedly evades a rule designed to
prevent Apache from displaying directory listings with a request for '/'.

Successful exploitation of this issue result in disclosure of sensitive
information which may be useful in further attacks against the system.

This problem has been reported to exist in Apache 2.0.40 shipped with
RedHat Linux 9.0.  It is possible that other versions are affected as
well.

6. Musicqueue SIGSEGV Signal Handler Insecure File Creation Vul...
BugTraq ID: 8899
Remote: No
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8899
Summary:
Musicqueue is a CGI-based jukebox utility designed to invoke external
programs to carry out a variety of tasks. Musicqueue is available for the
Linux operating system. This program includes a make suid installation
option, which will install the utility with suid and sgid privileges of
the installing user.

When the Musicqueue utility is invoked, the crash() function is registered
as the handling procedure for any generated SIGSEGV signals. The functions
sole functionality is calling the gcgiSaveEnvVariables() library function,
which takes a single argument that is the name of a temporary file. The
CGI environment variable data of the program that encountered the
segmentation violation is then stored within this file.

It has been discovered that the crash() signal handler incorrectly passes
the aforementioned library function a predictable filename for the storage
of environment information, specifically "/tmp/musicqueue.crash". As a
result, when handling a SIGSEGV signals, Musicqueue may be prone to
symbolic link attacks.

Due to the potentially attacker-controllable data contained within
environment variables, it is believed to be trivial for an attacker to
elevated privileges to those of the owner or group of the executable. On
some installations, this may effectively result in root compromise.

This vulnerability is said to affect Musicqueue 1.2.0, however earlier
versions may also be affected.

7. IWConfig Local ARGV Command Line Buffer Overflow Vulnerabili...
BugTraq ID: 8901
Remote: No
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8901
Summary:
iwconfig is a freely available, open source wireless connection management
tool for Linux.

A problem has been identified in the iwconfig program when handling
strings on the commandline.  Because of this, a local attacker may be able
to gain elevated privileges.

The problem is in bounds checking.  It is possible to produce an
exploitable stack overflow by passing an argument of 96 or more bytes of
data as an argument to the program.  This problem is likely an overflow in
a function to which the data from ARGV is passed.

It should be noted that the iwconfig program is typically installed as a
setuid executable by default.

8. Les Visiteurs Multiple Remote File Include Vulnerabilities
BugTraq ID: 8902
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8902
Summary:
Les Visiteurs is a freely available, open source web site statistics
script.  It is written in PHP, and available for the Unix, Linux, and
Microsoft platforms.

A problem has been reported in the handling of some types of input by Les
Visiteurs.  Because of this, an attacker may be able to execute arbitrary
commands on the system.

The problem is in the handling of include files.  The config.inc.php and
new-visitor.inc.php scripts do not sufficiently validate include variables
at multiple locations within the script.  An attacker could supply a
remote location containing a malicious file and execute commands on the
host with the privileges of the web server.

9. Musicqueue Multiple Buffer Overrun Vulnerabilities
BugTraq ID: 8903
Remote: No
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8903
Summary:
Musicqueue is a CGI-based jukebox utility designed to invoke external
programs to carry out a variety of tasks. Musicqueue is available for the
Linux operating system. This program includes a make suid installation
option, which will install the utility with suid and sgid privileges of
the installing user.

Multiple buffer overrun vulnerabilities have been discovered in
Musicqueue. Both issues stem from the lack of bounds checking when passing
user-supplied input to the sprintf() libc function. As a result, it may be
possible for an attacker to exploit arbitrary code with the privileges the
affected application, possibly installed suid or sgid.

The problems specifically occur within the openLang() and langExists()
functions, passed the user-controllable 'language' parameter. It has been
reported that the openLang() issue may not be exploitable to due the
malicious data being limited to a range of ascii characters from 'a' to
'z'. However, it may be possible to carry out a partial pointer overwrite
in such a way that execution flow can be controlled. The langExists()
overrun is said to be trivially exploitable.

It should be noted that due to the nature of both of these issues,
triggering the bugs will potentially cause a SIGSEGV signal to be
generated. As a result, these vulnerabilities may be used in conjunction
with the vulnerability described in BID 8899, to effectively allowing for
privilege elevation.

10. thttpd defang Remote Buffer Overflow Vulnerability
BugTraq ID: 8906
Remote: Yes
Date Published: Oct 27 2003
Relevant URL: http://www.securityfocus.com/bid/8906
Summary:
thttpd is a HTTP web server application.

A vulnerability has been reported to exist in thttpd that may allow a
remote attacker to gain unauthorized access by executing arbitrary code on
a vulnerable system. The condition is present due to insufficient boundary
checking.

The problem is reported to exist due to the defang() function in
libhttpd.c.  The issue presents itself due to insufficient bounds
checking. A remote attacker may ultimately exploit this issue remotely and
execute arbitrary code in the context of the user who is running the
vulnerable software. Successful exploitation may allow a attacker to gain
unauthorized access to the vulnerable host.

Successful exploitation of this issue may allow an attacker to execute
arbitrary code in the context of the web server in order to gain
unauthorized access to a vulnerable system.

thttpd versions 2.21 to 2.23b1 have been reported to be prone to this
issue, however other versions may be affected as well.

11. kpopup Local Arguments Format String Vulnerability
BugTraq ID: 8918
Remote: No
Date Published: Oct 28 2003
Relevant URL: http://www.securityfocus.com/bid/8918
Summary:
kpopup is a KDE utility designed to allow hosts to transmit and receive
"WinPopup" messages.  It is available for Unix and Linux platforms.

It has been alleged that it is possible for local attackers to take
advantage of format string vulnerabilities in kpopup, which is installed
setuid root by default. According to the report, kpopup does not correctly
handle format strings when passed to the program as arguments.

Preliminary reports indicate that this issue can be used to cause the
program to crash with a segmentation violation error.  This is usually
indicative of memory management issues that typically can be exploited to
execute attacker-supplied instructions.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Sendmail & Disk Quota on RedHat (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/342823

2. NFS replacements for Linux (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/342758

3. AntiVirus for Red Hat 9? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/342660


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Sophos Anti-Virus
By: Sophos
Platforms: AIX, DOS, FreeBSD, HP-UX, Linux, MacOS, Netware, OS/2, Solaris,
UNIX, VMS, Windows 3.x, Windows 95/98, Windows NT
Relevant URL: http://www.sophos.com/products/sav/
Summary:

Sophos Anti-Virus is a unique solution to the virus problem, providing
true cross-platform protection in a single, fully integrated product. The
network-centric design provides a host of benefits for the protection of
servers, workstations and portables. Sophos's ground-breaking architecture
maximises protection, while minimising performance and administrative
overheads.

2. Gordano Messaging Suite
By: Gordano
Platforms: AIX, Linux, Solaris, Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.gordano.com/
Summary:

Gordano's Messaging Suite provides robust and secure email, instant and
SMS messaging for small, medium and large businesses.

3. LANDesk Management Suite 7
By: LANDesk Software
Platforms: AIX, HP-UX, Linux, MacOS, Solaris, Windows 2000, Windows 95/98,
Windows NT, Windows XP
Relevant URL: http://www.landesk.com/products/ilms/
Summary:

LANDesk Management Suite 7 is a comprehensive, integrated management
solution that's easy to use. Enabling proactive management of desktops,
server and mobile devices across heterogeneous IT environments.
 - Keep up with security patches and virus updates
 - Efficiently install and maintain software on the desktop
 - Decrease software license costs and respond to audits
 - Reduce the cost of helpdesk support
 - Discover and manage hardware and software assets
 - Migrate many users and their profiles to new operating systems

4. ActiveScout Enterprise
By: ForeScout Technologies
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.forescout.com/enterprise.html
Summary:

ActiveScout Enterprises actively protects a network with multiple access
points. In addition to the identification of attackers and automatic
action to stop them, this solution offers full management capabilities,
from configuration and reporting, to the sharing of threat information
between multiple deployed scouts.

5. Immunity CANVAS
By: Immunity, Inc.
Platforms: Linux, Windows 2000
Relevant URL: http://www.immunitysec.com/CANVAS/
Summary:

Immunity CANVAS is 100% pure Python, and every license includes full
access to the entire CANVAS codebase. Python is one of the easiest
languages to learn, so even novice programmers can be productive on the
CANVAS API, should they so chose.

Immunity CANVAS is both a valuable demonstration tool for enterprise
information security teams or system adminstrators, and an advanced
development platform for exploit developers, or people learning to become
exploit developers.

6. SecretAgent
By: Information Security Corporation (ISC)
Platforms: Linux, MacOS, UNIX, Windows 2000, Windows 95/98, Windows NT,
Windows XP
Relevant URL: http://www.infoseccorp.com/products/secretagent/contents.htm
Summary:

SecretAgent is a file encryption and digital signature utility, supporting
cross-platform interoperability over a wide range of platforms: Windows,
Linux, Mac OS X, and UNIX systems.

It's the perfect solution for your data security requirements, regardless
of the size of your organization.

Using the latest recognized standards in encryption and digital signature
technology, SecretAgent ensures the confidentiality, integrity, and
authenticity of your data.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. BitDefender for Sendmail libmilter v1.5.5-BETA
By: Mircea MITU
Relevant URL: http://www.bitdefender.com/bd/site/products.php?p_id=35
Platforms: Linux
Summary:

BitDefender for Sendmail libmilter is a powerful antivirus solution for
Linux mail servers. It provides proactive protection for message traffic
at the email server level, eliminating the risk to the entire network that
could be caused by a negligent user. Both sent and received messages are
scanned in real time, avoiding the possible infections and preventing
anyone from sending an infected message. It claims a 100% detection rate
for all viruses in the wild through its powerful scanning engines, which
are certified by the most prestigious testing labs.

2. KAVClient v0.2.1
By: Leonid Zeitlin
Relevant URL: http://kavclient.sourceforge.net/
Platforms: Linux
Summary:

KAVClient is a C language interface to the Kaspersky Anti-Virus daemon. It
allows users to check files and memory for viruses.

3. sensorTrends v0.6
By: John Weidley
Relevant URL: http://www.packetshack.org/index.php?page=sensorTrends
Platforms: Linux
Summary:

sensorTrends is a Web-based application that displays a high-level view of
the ports that are being scanned over the course of time. The display is
similar to the look and feel of incidents.org and Dshield.com. There are
also quick links to correlate your data with incidents.org and
Dshield.com. Supported log formats are Cisco router Access Control Lists
(ACLs) syslog output, Cisco PIX firewall syslog output, Snort's
portscan.log files, and NetScreen syslog output.

4. mod_securid v2.0
By: Erwan Legrand
Relevant URL: http://www.deny-all.com/mod_securid/v2/
Platforms: Linux, POSIX, Solaris, SunOS
Summary:

The mod_securid Apache module implements RSA SecurID authentication for
the Apache Web server. It allows administrators to restrict access to Web
sites (or parts of Web sites) to users authenticated using a SecurID token
and an ACE server.

5. Socks Server 5 v2.4rl
By: Matteo Ricchetti
Relevant URL: http://digilander.iol.it/matteo.ricchetti/
Platforms: Linux
Summary:

Socks Server 5 is a socks server for the Linux platform which supports the
Socks protocol versions 4 and 5.

6. LinuxMagic magic-smtpd v0.8.0
By: LinuxMagic Inc. <[email protected]>
Relevant URL: http://www.linuxmagic.com/opensource/magicmail/magic-smtpd/
Platforms: Linux, POSIX
Summary:

MAGIC-SMTPD is a drop-in replacement for Dan Bernstein's qmail-smtpd, and
was originally designed to be part of the LinuxMagic Magic Mail Server.
This opensource version has been released to allow others to benefit from
its anti-spam components, and valid user checking to reduce server loads
and spam volumes. It is designed to support stock qmail installations,
qmail/vpopmail installations, and database connectivity. Designed for ISP
service, this will work for all mail servers large and small.


VI. SPONSOR INFORMATION
-----------------------
This Issue Sponsored by: RSA Conference 2004

Network with over 10,000 of the brightest minds in information security at
the largest, most highly-anticipated industry event of the year. Don't
miss RSA Conference 2004! Choose from over 200 class sessions and see
demos from more than 250 industry vendors. If your job touches security,
you need to be here. Learn more or register at:
http://www.securityfocus.com/sponsor/RSA_linux-secnews_031103
and use priority code SF4.
------------------------------------------------------------------------