October 8, 2004

Linux Advisory Watch - October 8, 2004

Author: Preston St. Pierre

This week, advisories were released
for syscons, shareutils, netpbm, kdelibs, PHP, samba, kernel, XFree86, samba,
getmail, zlib, mozilla, and squid. The distributors include Debian, Slackware,
SuSE, Trustix, and Turbolinux.Password Cracking

If for some reason your passwd program
is not enforcing non easily guessable passwords, you might want to run a password
cracking program and make sure your users passwords are secure.

Password cracking programs work
on a simple idea. They try every word in the dictionary, and then variations
on those words. They encrypt each one and check it against your encrypted password.
If they get a match they are in. Also, the "dictionary" may include usernames,
Star Trek ships, foreign words, keyboard patterns, etc.

There are a number of programs out
there...the two most notable of which are ``Crack'' and ``John the Ripper''


They will take up a lot
of your CPU time, but you should be able to tell if an attacker could get in
using them by running them first yourself and notifying users with weak passwords.
Note that an attacker would have to use some other hole first in order to get
your passwd (Unix /etc/passwd) file, but these are more common than you might

Excerpt from the LinuxSecurity Administrator's Guide:

Written by: Dave Wreski (dave@guardiandigital.com)

Feature Extras:

-Network security is continuing to be a big problem
for companies and home users. The problem can be resolved with an accurate security
analysis. In this article I show how to approach security using aide and chkrootkit.

Interview with Gary McGraw, Co-author of Exploiting Software: How to Break Code

- Gary McGraw is perhaps best known for his groundbreaking work on securing
software, having co-authored the classic Building Secure Software (Addison-Wesley,
2002). More recently, he has co-written with Greg Hoglund a companion volume,
Exploiting Software, which details software security from the vantage point
of the other side, the attacker. He has graciously agreed to share some of his
insights with all of us at LinuxSecurity.com.

Expert Dave Wreski Discusses Open Source Security
- Dave Wreski,
CEO of Guardian Digital, Inc. and respected author of various hardened security
and Linux publications, talks about how Guardian Digital is changing the face
of IT security today. Guardian Digital is perhaps best known for their hardened
Linux solution EnGarde Secure Linux, touted as the premier secure, open-source
platform for its comprehensive array of general purpose services, such as web,
FTP, email, DNS, IDS, routing, VPN, firewalling, and much more.

[ Linux
Advisory Watch
] - [ Linux
Security Week
] - [ PacketStorm
] - [ Linux Security

Linux Advisory Watch is
a comprehensive newsletter that outlines the security vulnerabilities that have
been announced throughout the week. It includes pointers to updated packages
and descriptions of each vulnerability.[

Distribution: Debian

invalid free(3)

Michal Zalewski discovered a bug in the netkit-telnet server (telnetd) whereby
a remote attacker could cause the telnetd process to free an invalid pointer.

pppoe missing privilegue dropping

Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet driver
from Roaring Penguin. When the program is running setuid root (which is
not the case in a default Debian installation), an attacker could overwrite
any file on the file system.

potential denial of service

Julian Reschke reported a problem in mod_dav of Apache 2 in connection with
a NULL pointer dereference. When running in a threaded model, especially
with Apache 2, a segmentation fault can take out a whole process and hence
create a denial of service for the whole server.

insecure temporary file creation

Stefan Nordhausen has identified a local security hole in net-acct, a user-mode
IP accounting daemon. Old and redundant code from some time way back in
the past created a temporary file in an insecure fashion.

  Distribution:Fedora 10/5/2004cups-1.1.20-11.4

This update fixes an information leakage problem when printing to SMB shares
requiring authentication. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0923 to this issue.

  Distribution:FreeBSD 10/4/2004syscons   Boundary
checking errors in syscons

The syscons CONS_SCRSHOT ioctl(2) does insufficient validation of its input
arguments. In particular, negative coordinates or large coordinates may
cause unexpected behavior.

  Distribution:Gentoo 10/1/2004sharutils   Buffer

sharutils contains two buffer overflow vulnerabilities that could lead to
arbitrary code execution.

  10/4/2004netpbm   Multiple
temporary file issues

Utilities included in old Netpbm versions are vulnerable to multiple temporary
files issues, potentially allowing a local attacker to overwrite files with
the rights of the user running the utility.

  Distribution:RedHat 10/4/2004kdelibs   and kdebase
security issues

Updated kdelib and kdebase packages that resolve multiple security issues
are now available.

  Distribution:Gentoo 10/5/2004NetKit-telnetd
buffer overflows in telnet and telnetd
   and kdebase
security issues

Buffer overflows exist in the telnet client and daemon provided by netkit-telnetd,
which could possibly allow a remote attacker to gain root privileges and
compromise the system.

  10/5/2004PHP   Memory
disclosure and arbitrary location file upload

Two bugs in PHP may allow the disclosure of portions of memory and allow
remote attackers to upload files to arbitrary locations.

  Distribution:Mandrake 10/1/2004samba   fix vulnerability

Karol Wiesek discovered a bug in the input validation routines used to convert
DOS path names to path names on the Samba host's file system. This bug can
be exploited to gain access to files outside of the share's path as defined
in the smb.conf configuration file.

  10/5/2004kernel   various

New kernels are available for Mandrakelinux 10.0 that fix a few bugs and/or
adds enhancements.

 10/4/2004XFree86   security
issues and bugs

Updated XFree86 packages that fix several security flaws in libXpm, as well
as other bugs, are now available for Red Hat Enterprise Linux 3.

  10/4/2004samba   security

Updated samba packages that fix an input validation vulnerability are now

  10/6/2004XFree86   security
issues and bugs

Updated XFree86 packages that fix several security issues in libXpm, as
well as other bug fixes, are now available for Red Hat Enterprise Linux

  Distribution:Slackware 10/4/2004getmail   security

New getmail packages are available for Slackware 9.1, 10.0 and -current
to fix a security issue. If getmail is used as root to deliver to user owned
files or directories, it can be made to overwrite system files.

  10/4/2004zlib   DoS

New zlib packages are available for Slackware 10.0 and -current to fix a
possible denial of service security issue.

  Distribution:Suse 10/5/2004samba   remote
file disclosure

The Samba server, which allows to share files and resources via the SMB/CIFS
protocol, contains a bug in the sanitation code of path names which allows
remote attackers to access files outside of the defined share.

  10/6/2004mozilla   various

During the last months a number of security problems have been fixed in
Mozilla and Mozilla based brwosers.

  Distribution:Trustix 10/1/2004samba   access
files outside of defined path

A security vulnerability has been located in Samba 2.2.x
hwdata bugfix update
files outside of defined path

This update contains bug fixes and additional features for mod_php4 and

  Distribution:Turbolinux 10/5/2004squid   DoS vulnerability

A vulnerability in the NTLM helpers in squid. The vulnerabilities allow
remote attackers to cause a denial of service of sauid server services.


Click Here!