Linux Advisory Watch – October 15, 2004


Author: Preston St. Pierre

This week, advisories were released for cups, samba, mysql, mpg123, sox, Ed,
ncompress, LessTif, gettext, xfree86, tiff, wordpress, BNC, libpng, and rsync.
The distributors include Conectiva, Debian, Fedora, Gentoo, Slackware, and Trustix.Storing Log Data Securely

It is also a good idea to store log data at a secure location, such
as a dedicated log server within your well-protected network. Once
a machine has been compromised, log data becomes of little use as it
most likely has also been modified by the intruder. It most likely
of little value in a criminal investigation. It helps if the log
data, which has been stored remotely, indicates when root access was
gained so that logs before that point are okay.

The syslogd daemon can be configured to automatically send log data
to a central syslogd server, but this is typically sent in cleartext
data, allowing an intruder to view data as it is being transferred.
This may reveal information about your network that is not intended
to be public. There are syslog daemons available that encrypt the
data as it is being sent.

Also be aware that faking syslog messages has been reported, with an
exploit program having been published. Syslog even accepts net log
entries claiming to come from the local host without indicating
their true origin. A more secure implementation has been written by
CORE-SDI, and is available at:

If possible, configure syslogd to send a copy of the most important
data to a secure system. This will prevent an intruder from covering
his tracks by deleting his login, su, ftp, etc attempts. See the
syslog.conf(5) man page, and refer to the “@” option.

If you’ve already decided to use a central syslog server, the
additional security this provides is well worth it. However, you
should consider the additional overhead involved with sending this
data real-time across your network.

Excerpt from the
LinuxSecurity Administrator’s Guide:
Written by: Dave Wreski (

LinuxSecurity Feature Extras:

-Network security is continuing to be a big problem
for companies and home users. The problem can be resolved with an accurate security
analysis. In this article I show how to approach security using aide and chkrootkit.

Interview with Gary McGraw, Co-author of Exploiting Software: How to Break Code

– Gary McGraw is perhaps best known for his groundbreaking work on securing
software, having co-authored the classic Building Secure Software (Addison-Wesley,
2002). More recently, he has co-written with Greg Hoglund a companion volume,
Exploiting Software, which details software security from the vantage point
of the other side, the attacker. He has graciously agreed to share some of his
insights with all of us at

Expert Dave Wreski Discusses Open Source Security
– Dave Wreski,
CEO of Guardian Digital, Inc. and respected author of various hardened security
and Linux publications, talks about how Guardian Digital is changing the face
of IT security today. Guardian Digital is perhaps best known for their hardened
Linux solution EnGarde Secure Linux, touted as the premier secure, open-source
platform for its comprehensive array of general purpose services, such as web,
FTP, email, DNS, IDS, routing, VPN, firewalling, and much more.

[ Linux
Advisory Watch
] – [ Linux
Security Week
] – [ PacketStorm
] – [ Linux Security

Linux Advisory Watch is
a comprehensive newsletter that outlines the security vulnerabilities that have
been announced throughout the week. It includes pointers to updated packages
and descriptions of each vulnerability.[

Distribution: Conectiva
  10/14/2004 cups
    denial of service vulnerability fix

Alvaro Martinez Echevarria found a vulnerability[2] in the CUPS Internet Printing Protocol (IPP) implementation that allows remote attackers to make CUPS stop listening on the IPP port by sending an empty UDP datagram packet to the IPP port, causing a denial of service situation.

  10/14/2004 samba
    vulnerabilities fix

This announcement fixes two denial of service vulnerabilities via certain malformed requests[2] and via a SAM_UAS_CHANGE request with a big length value[3] when domain logons are enabled.

Distribution: Debian
  10/10/2004 python2.2 buffer overflow and restore functionality fix
    vulnerabilities fix

This security advisory corrects DSA 458-2 which caused a problem in the gethostbyaddr routine.

  10/11/2004 mysql
    several vulnerabilities fix

Severl problems have been discovered in MySQL, a commonly used SQL database on Unix servers.

  10/12/2004 cyrus-sasl arbitrary code execution fix
    several vulnerabilities fix

A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols.

  10/12/2004 cyrus-sasl arbitrary code execution real fix
    several vulnerabilities fix

This advisory corrects DSA 563-1 which contained a library that caused other programs to fail unindented.

  10/13/2004 mpg123
    arbitrary code exceution fix

Davide Del Vecchio discovered a vulnerability mpg123, a popular (but non-free) MPEG layer 1/2/3 audio player. A malicious MPEG layer 2/3 file could cause the header checks in mpg123 to fail, which could in turn allow arbitrary code to be executed with the privileges of the user running mpg123.

  10/13/2004 sox
    buffer overflow fix

Ulf Harnhammar has reported two vulnerabilities in SoX, a universal sound sample translator, which may be exploited by malicious people to compromise a user’s system with a specially crafted .wav file.

  10/14/2004 cyrus-sasl arbitrary code execution fix
    buffer overflow fix

This advisory is an addition to DSA 563-1 and 563-2 which weren’t able to supersede the library on sparc and arm due to a different version number for them in the stable archive.

  10/14/2004 CUPS
    information leak fix

An information leak has been detected in CUPS, the Common UNIX Printing System, which may lead to the disclosure of sensitive information, such as user names and passwords which are written into log files.

Distribution: Fedora
  10/11/2004 squid-2.5.STABLE5-4.fc2.1 update
    information leak fix

This update fixes a potential DoS against squid that was reported by Secunia.

  10/8/2004 cyrus-sasl-2.1.18-2.2 update
    information leak fix

In situations where an untrusted local user can affect the environment of a privileged process, this behavior could be exploited to run arbitrary code with the privileges of a setuid or setgid application.

  10/11/2004 pcmcia-cs-3.2.7- update
    information leak fix

This update fixes a few problems in the PCMCIA init script.

  10/11/2004 gimp-2.0.5-0.fc2.1 update
    information leak fix

The GIMP (GNU Image Manipulation Program) is a powerful image composition and editing program, which can be extremely useful for creating logos and other graphics for webpages.

  10/12/2004 tzdata-2004e-1.fc2 update
    information leak fix

This package contains data files with rules for various timezones around the world.

  10/13/2004 libuser-0.52.5-0.FC2.1 update
    information leak fix

This update fixes many bugs, mostly in the LDAP backend and the Python bindings.

  10/13/2004 squid-2.5.STABLE5-4.fc2.2 update
    information leak fix

Backport fix for CAN-2004-0918 (Remote Denial of Service attack)

  10/13/2004 system-config-users-1.2.25-0.fc2.1 update
    information leak fix

when renaming users, ensure that groups forget about the old user name (#135280)

  10/14/2004 k3b-0.11.14-0.FC2.2 version string parsing fix
    information leak fix

K3b provides a comfortable user interface to perform most CD/DVD burning tasks. While the experienced user can take influence in all steps of the burning process the beginner may find comfort in the automatic settings and the reasonable k3b defaults which allow a quick start.

  10/14/2004 gimp-2.0.5-0.fc2.2 update
    information leak fix

This update fixes the bug that catches the wrong values of bpp in the BMP plugin.

  10/14/2004 libtiff-3.5.7-20.2 update
    information leak fix

Chris Evans discovered a number of integer overflow bugs that affect libtiff. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause the application linked to libtiff to crash or possibly execute arbitrary code.

  10/14/2004 w3m-0.5.1-3.1 update
    information leak fix

The w3m program is a pager (or text file viewer) that can also be used as a text-mode Web browser.

  10/14/2004 ruby-1.8.1-6 update
    information leak fix

A security fix [CAN-2004-0755]. ruby-1.8.1-cgi_session_perms.patch: sets the permission of the session data file to 0600. (#130063)

Distribution: Gentoo
  10/9/2004 CUPS
    Leakage of sensitive information

CUPS leaks information about user names and passwords when using remote printing to SMB-shared printers which require authentication.

  10/9/2004 Ed
    Insecure temporary file handling

The ed utility is vulnerable to symlink attacks, potentially allowing a local user to overwrite or change rights on arbitrary files with the rights of the user running ed, which could be the root user.

  10/9/2004 ncompress
    Buffer overflow

compress and uncompress, which could be used by daemon programs, contain a buffer overflow that could lead to remote execution of arbitrary code with the rights of the daemon process.

  10/9/2004 LessTif
    Integer and stack overflows in libXpm

Multiple vulnerabilities have been discovered in libXpm, which is included in LessTif, that can potentially lead to remote code execution.

  10/10/2004 gettext
    Insecure temporary file handling

The gettext utility is vulnerable to symlink attacks, potentially allowing a local user to overwrite or change permissions on arbitrary files with the rights of the user running gettext, which could be the root user.

  10/11/2004 xfree86
    integer and stack overflows

Chris Evans discovered several stack and integer overflows in the libXpm library which is provided by X.Org, XFree86 and LessTif.

  10/13/2004 tiff
    Buffer overflows in image decoding

Multiple heap-based overflows have been found in the tiff library image decoding routines, potentially allowing to execute arbitrary code with the rights of the user viewing a malicious image.

  10/14/2004 wordpress
    HTTP response splitting and XSS vulnerabilities

WordPress contains HTTP response splitting and cross-site scripting vulnerabilities.

  10/15/2004 BNC
    Input validation flaw

BNC contains an input validation flaw which might allow a remote attacker to issue arbitrary IRC related commands.

Distribution: Other
  10/12/2004 CUPS
    before 1.1.21 allows remote attackers to cause a denial of service

The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service via a certain UDP packet to the IPP port.

  10/12/2004 libpng
    Multiple Vulnerabilities

Several vulnerabilities exist in the libpng library, the most serious of which could allow a remote attacker to execute arbitrary code on an affected system.

Distribution: Slackware
  10/12/2004 rsync
    security update

New rsync 2.6.3 packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to a fix security issue when rsync is run as a non-chrooted server.

Distribution: Trustix
  10/8/2004 cyrus-sasl Insecure handling of environment variable
    security update

Kurt Lieber reported that libsasl honors the environment variable SASL_PATH blindly, allowing a local user to compile a “library” locally that is executed with the EID of SASL.