SecurityFocus Linux Newsletter #81

SecurityFocus Linux Newsletter #81
--------------------------------

This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml
----------------------------------------------------------------

I. FRONT AND CENTER
     1. Bad Company
     2. Memo to Microsoft: Stay Secretive, Please
     3. PortSentry for Attack Detection, Part One
     4. Securing Privacy, Part Three: E-Mail Issues
     5. Cutting-Edge High Tech Crime Fighting: Best Practices in Computer Forensics
     6. Meeting IT Security Benchmarks Through IT Audits
II. LINUX VULNERABILITY SUMMARY
     1. id Software Quake II Server Remote Information Disclosure Vuln
     2. Opera Frame Location Same Origin Policy Circumvention Vuln
     3. GNU SharUtils UUDecode Symbolic Link Attack Vuln
     4. SuSE AAA_Base_Clean_Core Script RM Race Condition Vulnerability
     5. SuSE Shadow File Truncation Vulnerability
     6. LevCGI NetPad Unauthorized File Access Vulnerability
     7. Swatch Throttled Event Reporting Vulnerability
     8. Phorum Remote Command Execution Vulnerability
     10. Gaim Sensitive World Readable Temporary File Vulnerability
     11. NetWin DNews Remote Access Vulnerability
III. LINUX FOCUS LIST SUMMARY
     1. protecting DHCP servers (Thread)
     2. plain text vs. html (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
     1. Covalent Fast Start Server
     2. VFind Security Toolkit
     3. Stronghold Enterprise
V. NEW TOOLS FOR LINUX PLATFORMS
     1. mail2sh v1.0
     2. Poor Man's IDS v1.2
     3. Saint Jude v0.10 (Solaris)
VI. SPONSORSHIP INFORMATION

I. FRONT AND CENTER
-------------------
1. Bad Company
By George Smith

You don't have much choice in anti-virus products if you make your
purchasing decisions based on Consumer Reports.

http://online.securityfocus.com/columnists/83

2. Memo to Microsoft: Stay Secretive, Please
 By Jon Lasser

Unix and Linux security owes much to openness and public disclosure, but
Microsoft is too far gone for sunshine to do any good.

http://online.securityfocus.com/columnists/82

3.  PortSentry for Attack Detection, Part One
By Ido Dubrawsky

Portsentry is an attack detection tool developed by Psionic Technologies.
This article is the first of a two-part series that will describe in
detail how Portsentry works from both a theoretical and a technical point
of view.

http://online.securityfocus.com/infocus/1580

4. Securing Privacy, Part Three: E-Mail Issues
By Scott Granneman

This is the third article in a four-part series that will examine privacy
concerns as they relate to security. The first installment in the series
examined hardware-based privacy issues. The second part discussed
software-based issues. This article will discuss privacy issues that are
particularly relevant to e-mail.

http://online.securityfocus.com/infocus/1579

5. Cutting-Edge High Tech Crime Fighting: Best Practices in Computer Forensics
June 17-18, 2002
American Management Association, Washington, DC

Walk away able to perform computer forensic examinations that will not
only yield sound evidence but will also hold up in a court of law! Learn
to find, collect and preserve digital evidence, and present the evidence
in court. Also learn to successfully combine private and public computer
forensics forces to investigate computer crimes. Keynote speech by
Microsoft's Chief Security Strategist Scott Charney. Public sector
employee discounts available.

For more information, call 800-280-8440, or visit http://www.frallc.com
(see InfoTech events).

6. Meeting IT Security Benchmarks Through IT Audits
August 8-9, 2002, Washington, DC.
By Information Technology Research Associates

Agenda: http://www.frallc.com/ (see InfoTech Events)

Have your IT security solutions kept pace with evolving threats?  Until
you conduct a thorough IT security audit, you won't know until after a
breach has occurred. To help you achieve the most ROI on your security
investment, ITRA is proud to present a step-by-step practical guide to
auditing your enterprise's IT security. For more information, call
800-280-8440.


II. BUGTRAQ SUMMARY
-------------------

1. id Software Quake II Server Remote Information Disclosure Vulnerability
BugTraq ID: 4744
Remote: Yes
Date Published: May 15 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4744
Summary:

Quake II is a multiplayer game released by id Software. The source code
has been made publically available, and versions are available for Windows
and Linux. A vulnerability has been reported in some versions of the Quake
II server.

Quake II allows variable expansion in commands. For example, the
$rcon_password variable will be automatically expanded to the system
password. Under normal usage, these variables are expanded on the client
side before being transmitted to the server.

However, it has been reported that a modified or artifically constructed
client may fail to expand this variable. When the server then processes
the command, it will expand the variable within it's local context. As a
result, a number of system parameters may be disclosed to a remote
attacker, including the server password.

An attacker may exploit this vulnerability to gain administrative rights
to the vulnerable server.

2. Opera Frame Location Same Origin Policy Circumvention Vulnerability
BugTraq ID: 4745
Remote: Yes
Date Published: May 15 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4745
Summary:

Opera is a web browser product created by Opera Software, and is available
for a range of operating systems including Windows and Linux. A
vulnerability has been reported in some versions of the Opera Browser.

In modern browsers, script code executing in the context of one website
should not be able to access the properties of another. This is a security
feature known as the 'same origin policy', and it is put in place to
prevent malicious websites from interacting with and possibly stealing
sensitive information from others in different windows.

It is possible to bypass the same origin policy in some versions of Opera.
Javascript executing within the context of a page is able to modify the
location parameter of an IFRAME or FRAME within the page. By setting the
location to a javascript: URL, code may be injected into the context of
the frame.

Exploitation of this vulnerability results in arbitrary Javascript code
executing within an arbitrary context. The consequences can be severe. It
may be possible to access cookie data, including auhentication
credentials, or to take actions as an authenticated user.

It has also been demonstrated possible to execute script code, accessing
some elements of the local system. A provided proof of concept provides
access to information about the local file system layout.

3. GNU SharUtils UUDecode Symbolic Link Attack Vulnerability
BugTraq ID: 4742
Remote: No
Date Published: May 14 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4742
Summary:

Sharutils is a freely available, open source suite of tools maintained by
the GNU.  It is designed for use on Unix and Linux operating systems.

A problem with sharutils may make it possible to exploit symbolic link
attacks.  The problem is in the uudecode program.

Prior to decoding a uuencoded file, uudecode does not check for the
existence of the file to be created from the decoded archive.  As a
result, a decoded file may overwrite another file in the temporary
directory, provided the user of uudecode has write permission to the file.

This problem is further compounded by the fact that uudecode does not
check whether or not the file is a symbolic link.  In the event of the
temporary file being a symbolic link, the file at the end of the symbolic
link would be overwritten.  This could result in a corruption or loss of
data.

This problem makes it possible to exploit a symbolic link attack, and
potentially overwrite files.  It could additionally lead to elevated
privileges.

4. SuSE AAA_Base_Clean_Core Script RM Race Condition Vulnerability
BugTraq ID: 4758
Remote: No
Date Published: May 16 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4758
Summary:

SuSE Linux is a freely available, open source operating system.  It is
maintained by SuSE.

A problem in the operating system could result in a denial of service.
The problem is in the creation of temporary directories.

A user could create a deeply nested directory structure that would be
descended by the recursive rm command, executed by the aaa_base_clean_core
script daily.  Upon descent into this directory tree, a user could move
the current working directory of the process higher in the directory
structure, causing the rm process to ascend higher than intended and
remove system files, including the root directory.

This problem could make it possible for a local user to deny service to
legitimate users of the system.  This vulnerability based on the problem
described in Bugtraq ID 4266, though the problem in this case is insecure
creation of a temporary directory by the aaa_base_clean_core script.

5. SuSE Shadow File Truncation Vulnerability
BugTraq ID: 4757
Remote: No
Date Published: May 16 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4757
Summary:

SuSE Linux is a freely available, open source distribution of the Linux
operating system.  It is maintained by SuSE.  shadow is a set of utilities
for maintaining entries in the /etc/passwd and /etc/shadow files.

A vulnerability has been discovered in the shadow package that ships with
SuSE Linux.  It has been reported that a local attacker may be able to
cause data in /etc/passwd and /etc/shadow to be truncated or possibly even
appended to with attacker-supplied data.  This can occur of the attacker
sets filesize limitations prior to invoking the shadow utilities that
operate on these files.

At the very least, local users can corrupt vital files.  This may result
in a denial of service.  Under some circumstances successful exploitation
of this vulnerability may enable a local attacker to elevate privileges,
possibly even gaining root privileges.  SuSE has stated that it is not
possible for local attackers to obtain root privileges with the default
configuration of SuSE Linux.

6. LevCGI NetPad Unauthorized File Access Vulnerability
BugTraq ID: 4741
Remote: Yes
Date Published: May 14 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4741
Summary:

LevCGI NetPad is a web-based text editor.  It is available for Linux and
Unix variants as well as Microsoft Windows operating systems.

Write access to NetPad documents is password-protected.  However,
authentication is not required to read the contents of NetPad documents.

Arbitrary web users may request existing documents and view their
contents, causing sensitive information in the documents to be disclosed.

7. Swatch Throttled Event Reporting Vulnerability
BugTraq ID: 4746
Remote: Yes
Date Published: May 15 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4746
Summary:

Swatch is a freely available, open source log watching utility.  It is
available for the Unix and Linux platforms.

Swatch may fail to report activities.  The problem is in the design of the
program.

Under some circumstances, a message may not be reported by swatch.  When
an event occurs on a system numerous times, and swatch has placed a
throttle on the event to prevent multiple alerts, swatch does not
sufficiently handle events of the same type afterwards.  When an event has
occurred and alerts for the event are throttled, a bug in the swatch
throttle code prevents swatch from reporting the event if it occurs a
month later.

This problem could allow an attacker with knowledge of an event that has
previously occurred and been throttled on a system to reproduce the event
without being noticed by swatch.

8. Phorum Remote Command Execution Vulnerability
BugTraq ID: 4763
Remote: Yes
Date Published: May 17 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4763
Summary:

Phorum is a PHP based web forums package designed for most UNIX variants,
Linux, and Microsoft Windows operating systems.

A vulnerability has been reported in Phorum that will allow remote
attackers to specify external PHP scripts and potentially execute
commands.

The vulnerability exists in 'plugin.php', 'admin.php' and 'del.php' files
found in the distribution of Phorum version 3.3.2a.  It is possible for a
malicious attacker to specify the location of a parameter to the
vulnerable PHP files by passing an argument via URL to the PHP files.  As
a consequence, the vulnerable system will interpret the arbitrary
attacker-supplied remote file (such as a PHP script).  The remote file may
potentially contain destructive commands that will be executed by the
vulnerable system.

9. GRSecurity Linux Kernel Memory Protection Weakness
BugTraq ID: 4762
Remote: No
Date Published: May 17 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4762
Summary:

The grsecurity Linux Kernel patch is a source-code patch developed and
maintained by the grsecurity development team.

A design error may allow for attackers to bypass the protection of the
patch.

The patch operates by redirecting the write() system call when it is being
used to write to a memory device.  Unfortunately, there are other methods
that can be used to write to system memory (such as mapping the device to
memory using mmap()).

Local attackers with root access may exploit this weakness to modify
kernel data structures or inject backdoor code, evading the protection of
the patch.

10. Gaim Sensitive World Readable Temporary File Vulnerability
BugTraq ID: 4730
Remote: No
Date Published: May 13 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4730
Summary:

Gaim is a chat client which supports AOL Instant Messenger, ICQ, MSN
Instant Messenger, Yahoo Instant Messenger, Jabber and IRC. Gaim runs on a
number of Unix-based platforms, including Linux.

An issue has been reported in versions of Gaim, which could enable an
unauthorized user to gain access to sensitive files.

A feature exists which enables a user to configure Gaim to check for new
email messages from configured web mail services. This feature runs when
Gaim is started, and creates two /tmp files which are world readable.

Reportedly, these temporary files may include sensitive information,
including authentication credentials for the specified mail service.

This issue has been known to specifically affect Hotmail accounts,
although other configured email web services may be affected. There may be
a limited time window in which this information may be used to
authenticate to Hotmail, possibly based on timeout mechanisms inherent in
Hotmail.

11. NetWin DNews Remote Access Vulnerability
BugTraq ID: 4737
Remote: Yes
Date Published: May 14 2002 12:00A
Relevant URL:
http://www.securityfocus.com/bid/4737
Summary:

DNews is a commercially available NNTP server.  It is available for
various operating systems, including Linux, Unix, and Microsoft Windows.

A vulnerability has been announced by the distributors of DNews.
Information concerning this vulnerability is not readily available.  It
is, however, possible that this vulnerability is remotely exploitable, as
the distributors of DNews recommend the placement of access control
entries in dnews.conf configuration file.

Successful exploitation may allow for remote attackers to gain access to
target servers.  It has been suggested that this vulnerability affects the
management interface on port 7119, and could result in DNews system
reconfiguration.  This is yet unconfirmed.


III. LINUX FOCUS LIST SUMMARY
---------------------------------

1. protecting DHCP servers (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

2. plain text vs. html (Thread)
Relevant URL:

http://online.securityfocus.com/archive/91/[email protected]

IV.NEW PRODUCTS FOR LINUX PLATFORMS
----------------------------------------
1. Covalent Fast Start Server
by Covalent Technologies
Platforms: AIX, BSDI, DG-UX, FreeBSD, HP-UX, Linux, NetBSD, OpenBSD,
Solaris, UNIX, Unixware
Relevant URL: http://www.covalent.net/products/faststart/

http://www.redhat.com/software/apache/stronghold/
Covalent Fast Start Server automatically produces an Apache configuration
suitable for many enterprise applications. Because of Apache's
standards-based interoperability, Fast Start Server is able to serve as
the presentation layer for all major application servers, databases and
Web-based applications, reducing the complexity of Web infrastructures. It
includes a streamlined installer for rapid deployment.

2. VFind Security Toolkit
Platforms: AIX, DG-UX, HP-UX, IRIX, Linux, SCO, Solaris, SunOS, True64
UNIX, UNIX, Unixware, Windows 95/98, Windows NT
by Cybersoft
Relevant URL: http://www.cyber.com/products/vfind/info/

The VFind Security ToolKit is a suite of four powerful network and
computer security utilities that provide flexible and uncompromising
protection. The VFind Security ToolKit boasts the worlds first UNIX virus
scanner and a unique heterogeneous design that allows for complete
protection, even in today's multi-platform networks. The object-oriented
design of the VFind Security ToolKit offers an unsurpassed level of
flexibility and power that is easily integrated with your operating system
and even with other applications.

3. Stronghold Enterprise
by C2Net Software
Platforms: BSDI, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD, SCO,
Solaris, SunOS, True64 UNIX, Unixware
by C2Net Software
Relevant URL: http://www.redhat.com/software/apache/stronghold/

Red Hat's Stronghold Enterprise is the most mature Apache-based web server
available today with over seven years of development and more than 14,000
servers running it to protect their data (E-Softs Security Space Web
Server Survey). Stronghold provides the tools to quickly install and
configure the popular Apache Web Server with the security features that
customers and business partners expect when they interact with your site.


V. NEW TOOLS FOR LINUX PLATFORMS
----------------------------------------
1. mail2sh v1.0
Platforms: Linux, POSIX, UNIX
by José MANS
Relevant URL: http://online.securityfocus.com/tools/2668

Mail2sh makes it possible to carry out shell commands by email. Email is
sent to a particular user on your host and the commands will be carried
out if the user and password given matches ones in /etc/passwd. Commands
are executed with the user's privileges, and combined with a PGP module
ensures a certain level of security for use. Note that the system is not
natively encrypted, so use of an encryption mechanism is highly
recommended for security reasons.

2. Poor Man's IDS v1.2
Platforms: POSIX
by red0x
Relevant URL: http://online.securityfocus.com/tools/2667

Poor Man's IDS is a couple of scripts which check certain files on your
host (any you like) for changes in content, ownership, and mode. Instead
of only mailing if something is wrong (like other IDSs), this lean IDS
will send you a daily (or weekly or hourly, depending on how you set-up
your cron job) security audit, containing details of what it found (if
anything).


3. Saint Jude v0.10 (Solaris)
Platforms: Linux, Solaris, SunOS
by Tim Lawless
Relevant URL: http://www.sourceforge.net/projects/stjude

Saint Jude is a wholly kernel-based intrusion detection and intrusion
response system that implements the Saint Jude Model for detection of
improper privilege transitions. Saint Jude can detect the presence of
ongoing and successful attacks, from sources both local and remote, that
would yield root-level access to the attacking individual. Detection is
performed using a rule-based anomaly detector that uses a model of normal
system behavior that is generated on the protected machine during a
training phase. By comparing actual actions against a fully developed
model, it is possible to detect attacks against vulnerabilities that are
both known and unknown with no false positives or negatives.

VI. SPONSORSHIP INFORMATION
---------------------------

This newsletter is sponsored by SecurityFocus (www.securityfocus.com)

Attention Non-profits and Universities: Sign-up now for preferred pricing
on the only global early-warning system for cyber attacks - SecurityFocus
ARIS Threat Management System.

Click here for more info
http://www.securityfocus.com/corporate/products/pdpsection.shtml