for thhtpd, cups, ethereal, mpg123, xinetd, hylafax, postgresql, conquest, epic4,
glibc, and and zebra. The distributors include Conectiva, Debian, Mandrake,
Red Hat, and SuSE. The recent news has been
flooded with reports about a looming security FUD campaign against Linux. Although
I have strong opinions on this matter, I've decided to keep quiet about it this
week simply because additional hype will not help the situation. Readers of
this newsletter are already aware of the merits of Linux and its potential for
achieving an acceptable state of security. Rather than re-hash the same old
rhetoric, I've decided to write about something a little bit more practical
this week, tunneling through SSH.
As you probably saw last week, the fifth vulnerability listed
on the SANS Top 10 for Unix list is 'clear text services.' Sadly, these will
remain a problem for years to come simply because many older applications are
dependent on these. For example, a Web development team may use an HTML editor
that has a built in FTP client. The moment that you suggest they stop using
this editor, and start using SFTP or SCP, they'll laugh in your face. Unfortunately,
there is always a balance between security and convenience, and convenience
usually wins. In most cases, a compromise can be established by tunneling insecure
plaintext services through SSH.
Probably the biggest misconception is that tunneling is difficult.
In fact, it is quite the opposite. A tunnel can be setup in less than a minute
and put a stop to years of paranoia. A tunnel can be established as a simple
command at the commandline.
For example, to establish a tunnel:
prompt$ ssh -L 2121:remotehost:21 bdthomas@remotehost -i keyfile.key
To establish FTP connection: (at new terminal)
prompt$ ftp -p localhost 2121
At both terminals, you will authenticate as normal. Looking
at the example above, you'll see that the user is trying to make a secure FTP
connection to 'remotehost.' To establish the tunnel, the SSH option '-L 2121:remotehost:21'
was given. This simply means, listen on local port 2121 and forward to remote
port 21. The options can be changed to fit any port requirement of any plaintext
If you've never giving SSH tunneling a try, hopefully I've
given you enough information to be interested. Sometimes it can be a lifesaver
because of its simplicity. There is a large amount of information available
on Google. Also, Brian Hatch has written several good pieces that are available
Until next time, cheers!
Benjamin D. Thomas
An Introduction and Interview with Founder, James Yonan
- In this article, Duane Dunston gives a brief introduction to OpenVPN and interviews
its founder James Yonan.
- Dan Verton, the author of The Hacker Diaries: Confessions of
Teenage Hackers is a former intelligence officer in the U.S. Marine Corps
who currently writes for Computerworld and CNN.com, covering national cyber-security
issues and critical infrastructure
Linux Advisory Watch
is a comprehensive newsletter that outlines the security vulnerabilities that
have been announced throughout the week. It includes pointers to updated packages
and descriptions of each vulnerability.
Multiple vulnerabilities including sensitive file disclosure, cross-site
"net-snmp" version 5.0.9 was released to address a security vulnerability
| DoS Vulnerability
It has been reported that the IPP daemon from the Cups package can under
This update announcement addresses several vulnerabilities in ethereal
When used to play mp3 audio streams over the network, audio servers can
A memory leak and several other problems have been fixed in the latest version
This vulnerability can be exploited by a remote attacker to execute arbitrary
buffer overflow vulnerabilities
Multiple buffer overflow vulnerabilities in the to_ascii() function have
buffer overflow vulnerability
Tom Lane discovered a buffer overflow in the to_ascii function in PostgreSQL.
Steve Kemp discovered a buffer overflow in the environment variable handling
A malicious server could craft a reply which triggers the client to allocate
buffer overflow vulnerability
Steve Kemp discovered a buffer overflow in the commandline and environment
The SuSE Security Team discovered a format bug condition that allows remote
Denial of service vulnerability
A memory starvation denial of service vulnerability in the ls program was
Updated Ethereal packages that fix a number of exploitable security issues
Updated glibc packages that resolve vulnerabilities and address several
Updated PostgreSQL packages that correct a buffer overflow in the to_ascii
Updated zebra packages that close a locally-exploitable and a remotely-exploitable
code execution vulnerability
The SuSE Security Team found a format bug condition during a code review