November 14, 2003

Linux Advisory Watch - November 14th 2003

Author: Benjamin D. Thomas

This week, advisories were released
for thhtpd, cups, ethereal, mpg123, xinetd, hylafax, postgresql, conquest, epic4,
glibc, and and zebra. The distributors include Conectiva, Debian, Mandrake,
Red Hat, and SuSE. The recent news has been
flooded with reports about a looming security FUD campaign against Linux. Although
I have strong opinions on this matter, I've decided to keep quiet about it this
week simply because additional hype will not help the situation. Readers of
this newsletter are already aware of the merits of Linux and its potential for
achieving an acceptable state of security. Rather than re-hash the same old
rhetoric, I've decided to write about something a little bit more practical
this week, tunneling through SSH.

As you probably saw last week, the fifth vulnerability listed
on the SANS Top 10 for Unix list is 'clear text services.' Sadly, these will
remain a problem for years to come simply because many older applications are
dependent on these. For example, a Web development team may use an HTML editor
that has a built in FTP client. The moment that you suggest they stop using
this editor, and start using SFTP or SCP, they'll laugh in your face. Unfortunately,
there is always a balance between security and convenience, and convenience
usually wins. In most cases, a compromise can be established by tunneling insecure
plaintext services through SSH.

Probably the biggest misconception is that tunneling is difficult.
In fact, it is quite the opposite. A tunnel can be setup in less than a minute
and put a stop to years of paranoia. A tunnel can be established as a simple
command at the commandline.

For example, to establish a tunnel:
prompt$ ssh -L 2121:remotehost:21 bdthomas@remotehost -i keyfile.key

To establish FTP connection: (at new terminal)
prompt$ ftp -p localhost 2121

At both terminals, you will authenticate as normal. Looking
at the example above, you'll see that the user is trying to make a secure FTP
connection to 'remotehost.' To establish the tunnel, the SSH option '-L 2121:remotehost:21'
was given. This simply means, listen on local port 2121 and forward to remote
port 21. The options can be changed to fit any port requirement of any plaintext

If you've never giving SSH tunneling a try, hopefully I've
given you enough information to be interested. Sometimes it can be a lifesaver
because of its simplicity. There is a large amount of information available
on Google. Also, Brian Hatch has written several good pieces that are available


Until next time, cheers!
Benjamin D. Thomas

LinuxSecurity Feature

An Introduction and Interview with Founder, James Yonan

- In this article, Duane Dunston gives a brief introduction to OpenVPN and interviews
its founder James Yonan.

The Hacker

- Dan Verton, the author of The Hacker Diaries: Confessions of
Teenage Hackers is a former intelligence officer in the U.S. Marine Corps
who currently writes for Computerworld and, covering national cyber-security
issues and critical infrastructure

[ Linux
Advisory Watch
] - [ Linux
Security Week
] - [ PacketStorm
] - [ Linux Security


Linux Advisory Watch
is a comprehensive newsletter that outlines the security vulnerabilities that
have been announced throughout the week. It includes pointers to updated packages
and descriptions of each vulnerability.

[ Subscribe


Distribution: Conectiva
  11/7/2003 thhtpd

Multiple vulnerabilities including sensitive file disclosure, cross-site
scription, and directory traversal vulnerabilities have been fixed.

  11/7/2003 net-snmp

"net-snmp" version 5.0.9 was released to address a security vulnerability
in previous 5.0.x versions where an existing user/community could get access
to data in MIB objects that were explicitly excluded from their view.

  11/7/2003 cups
    DoS Vulnerability

It has been reported that the IPP daemon from the Cups package can under
some circumstances enter a loop and consume excessive CPU resources, causing
the service to become slow and unresponsive.

  11/7/2003 ethereal

This update announcement addresses several vulnerabilities[2] in ethereal
versions prior to 0.9.16. These vulnerabilities can be exploited by an attacker
who can insert crafted packets in the wire being monitored by ethereal or
make an user open a trace file with such packets inside.

  11/12/2003 mpg123
overflow vulnerability

When used to play mp3 audio streams over the network, audio servers can
exploit this vulnerability by sending a carefully crafted response to the
client which will overflow a buffer on the heap and execute arbitrary code.

  11/12/2003 xinetd

A memory leak and several other problems have been fixed in the latest version
of xinetd.

  11/12/2003 hylafax
string vulnerability

This vulnerability can be exploited by a remote attacker to execute arbitrary
code with the privileges of the root user in the host where hfaxd is running.

  11/13/2003 postgresql
buffer overflow vulnerabilities

Multiple buffer overflow vulnerabilities in the to_ascii() function have
been fixed.

Distribution: Debian
  11/7/2003 postgresql
buffer overflow vulnerability

Tom Lane discovered a buffer overflow in the to_ascii function in PostgreSQL.
This allows remote attackers to execute arbitrary code on the host running
the database.

  11/10/2003 conquest
overflow vulnerability

Steve Kemp discovered a buffer overflow in the environment variable handling
of conquest, a curses based, real-time, multi-player space warfare game,
which could lead a local attacker to gain unauthorised access to the group

  11/10/2003 epic4
overflow vulnerability

A malicious server could craft a reply which triggers the client to allocate
a negative amount of memory. This could lead to a denial of service if the
client only crashes, but may also lead to executing of arbitrary code under
the user id of the chatting user.

  11/11/2003 omega-rpg
buffer overflow vulnerability
overflow vulnerability

Steve Kemp discovered a buffer overflow in the commandline and environment
variable handling of omega-rpg.

Distribution: Mandrake
  11/11/2003 hylafax
overflow vulnerability

The SuSE Security Team discovered a format bug condition that allows remote
attackers to execute arbitrary code as the root user.

  11/12/2003 fileutils/coreutils
Denial of service vulnerability
overflow vulnerability

A memory starvation denial of service vulnerability in the ls program was

Distribution: Red
  11/10/2003 ethereal
overflow vulnerability

Updated Ethereal packages that fix a number of exploitable security issues
are now available.

  11/12/2003 glibc

Updated glibc packages that resolve vulnerabilities and address several
bugs are now available.

  11/12/2003 PostgreSQL
overflow vulnerability

Updated PostgreSQL packages that correct a buffer overflow in the to_ascii
routines are now available.

  11/12/2003 zebra

Updated zebra packages that close a locally-exploitable and a remotely-exploitable
denial of service vulnerability are now available.

Distribution: SuSE
  11/10/2003 hylafax
code execution vulnerability

The SuSE Security Team found a format bug condition during a code review
of the hfaxd server. It allows remote attackers to execute arbitrary code
as root. However, the bug can not be triggered in hylafax' default configuration.



  • Linux
Click Here!