SecurityFocus Linux Newsletter #159

SecurityFocus Linux Newsletter #159
------------------------------------
This issue is sponsored by: NeoScale - Enterprise Storage Security that's
Simple, Reliable Secure.

Got Storage Security Risks? Consolidation, Continuity, Compliance
Connected, accessible and distributed storage can enable unauthorized
access to sensitive, trusted and regulated information.  What are best
storage security practices?  Discover how to alleviate exposures within
shared and managed storage, disaster recovery, vaulting, as well as
auditing and compliance processes. Obtain your FREE whitepaper from
NeoScale at http://www.securityfocus.com/sponsor/NeoScale_linux-secnews_031124
------------------------------------------------------------------------

I. FRONT AND CENTER
     1. Home User Security: Your First Defense
     2. Oracle Row Level Security: Part 2
II. LINUX VULNERABILITY SUMMARY
     1. KDE 3.1 Global Configuration Files Insecure Default Permissi...
     2. monopd Race Condition Denial of Service Vulnerability
     3. Minimalist Unspecified Remote Command Execution Vulnerabilit...
     4. SAP DB Privilege Escalation and Buffer Overrun Vulnerabiliti...
     5. PostgreSQL 7.4 Release To Fix Several Security Vulnerabiliti...
     6. FreeRADIUS Tag Field Heap Corruption Vulnerability
     7. Sybase Adaptive Server Remote Password Array Heap Overflow V...
III. LINUX FOCUS LIST SUMMARY
     1. Status of Debian compromise? (Thread)
     2. New SecurityFocus article (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Sophos Anti-Virus
     2. ActiveScout Enterprise
     3. Immunity CANVAS
     4. SecretAgent
     5. Cyber-Ark  Inter-Business Vault
     6. EnCase Forensic Edition
V. NEW TOOLS FOR LINUX PLATFORMS
     1. dnsgraph 0.9 v0.9
     2. pmacct v0.5.3
     3. CryptoFS v0.2.1
     4. Distributed Checksum Clearinghouse v1.2.17
     5. WifiScanner v0.9.3
     6. DansGuardian v2.7.6(unstable)
VI. SPONSOR INFORMATION


I. FRONT AND CENTER
-------------------
1. Home User Security: Your First Defense
By Sarah Granger

This article focuses on protecting the home office through personal
firewall software, as well as general security measures that are often
overlooked by home users.

http://www.securityfocus.com/infocus/1746

2. Oracle Row Level Security: Part 2
By Pete Finnigan

This paper explores the row level security feature added to Oracle 8i and
above, and provides examples. One of the main uses of row level security
is to allow all of a company's data to be stored in one database for
different departments, or for a hosting company to store data for
different companies in one database. Part Two.

http://www.securityfocus.com/infocus/1744


II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. KDE 3.1 Global Configuration Files Insecure Default Permissi...
BugTraq ID: 9047
Remote: No
Date Published: Nov 14 2003
Relevant URL: http://www.securityfocus.com/bid/9047
Summary:
KDE is a graphical user interface (GUI) designed for the Linux operating
system. KDE implements the use of the QT graphical library.

The kdeglobals configuration file is referenced by KDE whenever a local
user attempts to invoke the interface. This file is used to define a
number of default directory and executable locations, as well as various
behavioral options.

It has been reported that this configuration file is stored with world
writeable permissions by default on SuSE 8.2 installations. The file is
stored in the /etc/opt/kde3/share/config directory, and due to it's
permissions may be modified by an arbitrary local user.

An attacker could take advantage of these permissions to place malicious
data within the configuration file, such as defining the location of
trojaned executable in place of legitimate ones. This new malformed data
will become part of the KDE environment when another system user invokes
KDE.

Ultimately this could be exploited to carry out actions with the
privileges of another use of KDE.

It should be noted that the following configuration files have also been
reported to be installed world writeable:
/etc/opt/kde3/share/config/kmailrc
/etc/opt/kde3/share/config/kioslaverc
/etc/opt/kde3/share/config/kdeglobals.SuSEconfig

The modification of these files could also potentially be used to gain
elevated privileges or carry out actions as another user.

Although unconfirmed, other versions of SuSE as well as other
distributions may also store these configuration files insecurely.

2. monopd Race Condition Denial of Service Vulnerability
BugTraq ID: 9048
Remote: Yes
Date Published: Nov 15 2003
Relevant URL: http://www.securityfocus.com/bid/9048
Summary:
monopd is a game server for Monopoly-like board games. It is designed for
use with Linux variant operating systems.

A race condition error in monopd has been reported that could cause a
denial of service.

If a user who is part of a running game were to send a specially crafted
message under specific conditions, monopd will fail.  This may also cause
an excessive consumption of system and network resources.

3. Minimalist Unspecified Remote Command Execution Vulnerabilit...
BugTraq ID: 9049
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9049
Summary:
Minimalist is a mailing list manager available for Linux operating
systems.

It has been reported that Minimalist is vulnerable to an input validation
issue.  User-supplied input is not properly sanitized, which could allow a
remote user to execute arbitrary commands on the system running the
vulnerable software.  Commands would likely execute with the privileges of
Minimalist.

Specific details of this vulnerability are not currently known.  This BID
will be updated if and when more details about this vulnerability become
available.

4. SAP DB Privilege Escalation and Buffer Overrun Vulnerabiliti...
BugTraq ID: 9050
Remote: Yes
Date Published: Nov 17 2003
Relevant URL: http://www.securityfocus.com/bid/9050
Summary:
Multiple vulnerabilities have been reported in SAP DB.  The following
issues were reported:

A local privilege escalation issue (CAN-2003-0938) exists in SAP DB on
Windows platforms that may allow an attacker to load a malicious .DLL,
resulting in execution of arbitrary code with elevated privileges.  If a
local attacker has write permissions to the current working directory for
SAP DB, which is the case in default installations of the database, it is
possible to replace 'NETAPI32.DLL' with a malicious version.  When the
attacker-supplied library is loaded, code will be executed with elevated
privileges.  It is also reported that this issue may be exploited with the
'SQLAT' stored procedure included in SAP DB.

A buffer overrun (CAN-2003-0939) exists in SAP DB for multiple platforms
(Windows, Linux, HP-UX and Solaris).  The issue is present in the
'niserver' (on Unix-based systems) and 'serv.exe' (on Windows) and may
allow for remote attackers to execute code on a vulnerable host, resulting
in full system compromise.  In particular, the problem is due to
insufficient bounds checking while extracting strings from the
variable-sized segment of the connect packet.  As a result, it is possible
to corrupt adjacent regions of memory with attacker-supplied values,
allowing for control of program execution flow and execution of malicious
instructions.  The vulnerable service listens on TCP port 7269. (** It
should be noted that the @stake advisory reported an erroneous port number
for the service, the correct port number is 7269)

These issues are pending further analysis and will be divided into
individual BIDs when analysis is complete.

5. PostgreSQL 7.4 Release To Fix Several Security Vulnerabiliti...
BugTraq ID: 9066
Remote: Yes
Date Published: Nov 18 2003
Relevant URL: http://www.securityfocus.com/bid/9066
Summary:
PostgreSQL is a freely distributed Object-Relational DBMS.  It is
available for a number of platforms including Unix and Linux variants and
Microsoft Windows operating systems.

The PostgreSQL development group has reported the release of PostgreSQL
version 7.4.  This release contains feature and security enhancements.
The release also contains fixes for several potential security
vulnerabilities.  Issues fixed in this release include a contributed fix
for a condition where an ampersand character in an XML document could
trigger a violation in the PostgreSQL server and cause it to crash.  This
issue may be exploited to deny service to legitimate PostgreSQL users.

Additionally, a fix has been implemented that is designed to address a
condition where users without sufficient privileges may potentially
disable server log variables/logging that were added or enabled by the
administrator.  An attacker may potentially exploit this condition to hide
malicious activity.

This BID will be updated as further details regarding these
vulnerabilities are disclosed.

6. FreeRADIUS Tag Field Heap Corruption Vulnerability
BugTraq ID: 9079
Remote: Yes
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9079
Summary:
FreeRADIUS is a freely available, open source implementation of the RADIUS
protocol.  It is available for the Unix and Linux platforms.

A problem has been identified in the handling of tag field input by
FreeRADIUS.  Because of this, an attacker may be able to deny service to
legitimate users of a vulnerable FreeRADIUS server.

The problem is in the handling of tag field input when supplied with
specific constructs.  By supplying a malicious tag field to the server, an
attacker could force the invocation of the memcpy function with a negative
value.  This could potentially cause an error, resulting in the
overwriting of heap structures with roughly 3840 bytes of
attacker-supplied data.

Due to the method in which memcpy can be invoked, this vulnerability is
likely limited to resulting in a remote denial of service against
vulnerable servers.  This is because of the casting of the length
parameter of the memcpy function, which will interpret the negative value
as an overly large unsigned integer. As a result, an attempt to access an
excessive amount of heap memory will occur, likely resulting in the
dereferencing of invalid memory.  However, the possibility exists that
this issue could be exploited to execute code with the privileges of the
FreeRADIUS server process.

This issue was initially reported as a vulnerability in how the
"Tunnel-Password" attribute in Access-Request packets is handled.  The
issue turned out to have wider scope, affecting tag field input in
general.

This vulnerability affects version 0.4.0 through 0.9.2.

7. Sybase Adaptive Server Remote Password Array Heap Overflow V...
BugTraq ID: 9080
Remote: Yes
Date Published: Nov 20 2003
Relevant URL: http://www.securityfocus.com/bid/9080
Summary:
Sybase Adaptive Server is a full SQL relational database management
system. It is available for a variety of platforms including Microsoft
Windows operating systems.

Sybase adaptive server has been reported prone to heap overflow
vulnerability. The issue has been reported to present itself when invalid
password and servername buffer lengths in a remote password array are
passed to the affected server. A heap overflow condition may be triggered,
potentially causing heap memory management structures to be corrupted.

It has been reported that an attacker may exploit this vulnerability to
trigger a denial of service condition. The impact of this denial of
service differs depending on the platform that the Adaptive Server is
installed.

On a Windows platform a single successful exploit attempt on a client
thread, will cause the server to cease to negotiate login attempts and
will additionally prevent the server from responding to all commands.

On a Linux platform the exploited client process will crash, but other
clients and the server process will remain unaffected. However the
attacker may exploit the issue in quick succession and in doing so may
potentially prevent clients from successfully negotiating Adaptive Server
login attempts.

It has been conjectured that due to the nature of this vulnerability an
exploit may be written that manipulates heap management structures in a
manner that is sufficient so that remote arbitrary code execution occurs,
this however has not been confirmed.


III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. Status of Debian compromise? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/345357

2. New SecurityFocus article (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/344766


IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Sophos Anti-Virus
By: Sophos
Platforms: AIX, DOS, FreeBSD, HP-UX, Linux, MacOS, Netware, OS/2, Solaris,
UNIX, VMS, Windows 3.x, Windows 95/98, Windows NT
Relevant URL: http://www.sophos.com/products/sav/
Summary:

Sophos Anti-Virus is a unique solution to the virus problem, providing
true cross-platform protection in a single, fully integrated product. The
network-centric design provides a host of benefits for the protection of
servers, workstations and portables. Sophos's ground-breaking architecture
maximises protection, while minimising performance and administrative
overheads.

2. ActiveScout Enterprise
By: ForeScout Technologies
Platforms: Linux, Solaris, Windows 2000, Windows 95/98, Windows NT
Relevant URL: http://www.forescout.com/enterprise.html
Summary:

ActiveScout Enterprises actively protects a network with multiple access
points. In addition to the identification of attackers and automatic
action to stop them, this solution offers full management capabilities,
from configuration and reporting, to the sharing of threat information
between multiple deployed scouts.

3. Immunity CANVAS
By: Immunity, Inc.
Platforms: Linux, Windows 2000
Relevant URL: http://www.immunitysec.com/CANVAS/
Summary:

Immunity CANVAS is 100% pure Python, and every license includes full
access to the entire CANVAS codebase. Python is one of the easiest
languages to learn, so even novice programmers can be productive on the
CANVAS API, should they so chose.

Immunity CANVAS is both a valuable demonstration tool for enterprise
information security teams or system adminstrators, and an advanced
development platform for exploit developers, or people learning to become
exploit developers.

4. SecretAgent
By: Information Security Corporation (ISC)
Platforms: Linux, MacOS, UNIX, Windows 2000, Windows 95/98, Windows NT,
Windows XP
Relevant URL: http://www.infoseccorp.com/products/secretagent/contents.htm
Summary:

SecretAgent is a file encryption and digital signature utility, supporting
cross-platform interoperability over a wide range of platforms: Windows,
Linux, Mac OS X, and UNIX systems.

It's the perfect solution for your data security requirements, regardless
of the size of your organization.

Using the latest recognized standards in encryption and digital signature
technology, SecretAgent ensures the confidentiality, integrity, and
authenticity of your data.

5. Cyber-Ark  Inter-Business Vault
By: Cyber-Ark
Platforms: Linux, Windows 2000, Windows NT, Windows XP
Relevant URL:
http://www.cyber-ark.com/datasecuritysoftware/inter-business_vault.htm
Summary:

Based on Cyber-Ark Software's Vaulting Technology, the Inter-Business
Vault, an information security solution that enables organizations to
safely overcome traditional network boundaries in order to securely share
business information among customers, business partners, and remote
branches. It provides a seamless, LAN-like experience over the Internet
that includes all the security, performance, accessibility, and ease of
administration required to allow organizations to share everyday
information worldwide. To learn more about these core attributes of the
Inter-Business Vault click on the relevant link below:

6. EnCase Forensic Edition
By: Guidance Software Inc.
Platforms: DOS, FreeBSD, Linux, MacOS, NetBSD, OpenBSD, PalmOS, Solaris,
UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL:
http://www.guidancesoftware.com/products/EnCaseForensic/index.shtm
Summary:

EnCase Forensic Edition Version 4 delivers the most advanced features for
computer forensics and investigations. With an intuitive GUI and superior
performance, EnCase Version 4 provides investigators with the tools to
conduct large-scale and complex investigations with accuracy and
efficiency. Guidance Software?s award winning solution yields completely
non-invasive computer forensic investigations while allowing examiners to
easily manage large volumes of computer evidence and view all relevant
files, including "deleted" files, file slack and unallocated space.

The integrated functionality of EnCase allows the examiner to perform all
functions of the computer forensic investigation process. EnCase's
EnScript, a powerful macro-programming language and API included within
EnCase, allows investigators to build customized and reusable forensic
scripts.


V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. dnsgraph 0.9 v0.9
By: Przemek Sztoch
Relevant URL: http://dnsgraph.sourceforge.net
Platforms: Linux
Summary:

dnsgraph is a very simple DNS statistics RRDtool frontend for Bind that
produces daily, weekly, monthly, and yearly graphs of success/failure,
recursion/referral, and nxrrset/nxdomain.

2. pmacct v0.5.3
By: Paolo Lucente
Relevant URL: http://www.ba.cnr.it/~paolo/pmacct/
Platforms: Linux, OpenBSD
Summary:

pmacct is a network tool to gather IP traffic information (source address,
bytes counter, and number of packets). Data is stored in an in-memory
table whose content could be retrieved by a client program via a local
stream-oriented connection. Gathering packets off the wire is done using
the pcap library and one or more network interfaces in promiscuous mode.

3. CryptoFS v0.2.1
By: Christoph Hohmann
Relevant URL: http://reboot.animeirc.de/cryptofs/
Platforms: Linux
Summary:

CryptoFS is a encryption filesystem for the Linux Userland Filesystem.
Files written to the mount point will be stored encrypted (data and
filename) in a directory on a normal filesystem.

4. Distributed Checksum Clearinghouse v1.2.17
By: Vernon Schryver
Relevant URL: http://www.rhyolite.com/anti-spam/dcc/
Platforms: FreeBSD, Linux, NetBSD, POSIX, Solaris, SunOS
Summary:

Distributed Checksum Clearinghouse (DCC) is a system of clients and
servers that collect and count checksums related to mail messages. The
counts can be used by SMTP servers and mail user agents to detect and
reject bulk mail. DCC servers can exchange common checksums. The checksums
include values that are "fuzzy", or constant across common variations in
bulk messages

5. WifiScanner v0.9.3
By: Jerome Poggi <jerome.poggi@hsc -labs.fr>
Relevant URL: http://wifiscanner.sourceforge.net/
Platforms: Linux, POSIX
Summary:

WifiScanner is an analyzer and detector of 802.11b stations and access
points. It can listen alternatively on all the 14 channels, write packet
information in real time, can search access points and associated client
stations, and can generate a graphic of the architecture using GraphViz.
All network traffic can be saved in the libpcap format for post analysis.
It works under Linux with a PrismII or CISCO card and with the linux-wlan,
hostap, or Aironet driver

6. DansGuardian v2.7.6(unstable)
By: Daniel Barron
Relevant URL: http://dansguardian.org/
Platforms: Linux
Summary:

DansGuardian is a Web content filtering proxy that uses Squid to do all
the fetching. It filters using multiple methods including, but not limited
to, phrase matching, file extension matching, MIME type matching, PICS
filtering, and URL/domain blocking. It has the ability to switch off
filtering by certain criteria including username, domain name, source IP,
etc. The configurable logging produces a log in an easy to read format. It
has the option to only log text-based pages, thus significantly reducing
redundant information (such as every image on a page).


VI. SPONSOR INFORMATION
-----------------------
This issue is sponsored by: NeoScale - Enterprise Storage Security that's
Simple, Reliable Secure.

Got Storage Security Risks? Consolidation, Continuity, Compliance
Connected, accessible and distributed storage can enable unauthorized
access to sensitive, trusted and regulated information.  What are best
storage security practices?  Discover how to alleviate exposures within
shared and managed storage, disaster recovery, vaulting, as well as
auditing and compliance processes. Obtain your FREE whitepaper from
NeoScale at http://www.securityfocus.com/sponsor/NeoScale_linux-secnews_031124
------------------------------------------------------------------------