Security

Security news

Here we go again

vnunet has posted another one of its Linux security articles with the same sort of theme:

Nobody would try to argue that Linux is free of security holes - anybody who thinks so need only read the rest of this page to learn otherwise. But the above comparison is absolutely meaningless for a number of reasons:

• Each distribution is counted independently. The same vulnerability in five distributions will count as five separate vulnerabilities. This practice, of course, inflates the number of reported Linux problems.

• Linux vulnerabilities include those in applications (i.e. PostgreSQL) which are not part of a standard Windows system.

• Most Linux vulnerabilities are found through code audits and similar efforts; they are patched and reported before any exploits happen. Any Windows bugs found through similar audits are fixed silently and do not appear in these counts.

Articles like this one try to make it appear that Linux has worse security problems than other operating systems. If you look, however, at the amount of actual security pain suffered by Linux administrators, the story is different. Linux security is nowhere near as good as it really should be, but it's not as bad as some people would like to make it out to be.

Comments (5 posted)

Red Hat and Dell host open source security summit

Red Hat and Dell have announced that an "open source security summit" will be held on October 29 in Washington, DC. "The Security Summit will provide an open forum to discuss and explore how open source technologies, methodologies, tools, and support processes meet the challenges of securing networks and computer systems."

Comments (none posted)

New vulnerabilities

Apache 2.0 cross-site scripting vulnerability

Package(s):	apache	CVE #(s):	CAN-2002-0840
Created:	October 2, 2002	Updated:	October 2, 2002
Description:	Versions of Apache 2.0 prior to 2.0.43 have a cross-site scripting vulnerability in the error page handling code. If you are running Apache 2.0, this one is worth fixing.
Alerts:	(No alerts in the database for this vulnerability)

Comments (none posted)

Multiple vulnerabilities in bugzilla

Package(s):	bugzilla	CVE #(s):
Created:	October 2, 2002	Updated:	October 9, 2002
Description:	The Bugzilla bug tracking system (versions prior to 2.14.4 or 2.16.1) suffers from a number of vulnerablities, including one which could result in remote command and SQL injection. An upgrade to 2.16.1 is recommended, since the 2.14 branch will be unmaintained after the end of the year. See the Bugzilla advisory for details.
Alerts:	Debian DSA-173-1 2002-10-09

Comments (1 posted)

Another set of fetchmail buffer overflows

Package(s):	fetchmail fetchmail-ssl	CVE #(s):
Created:	October 1, 2002	Updated:	December 17, 2002
Description:	e-matters GmbH has issued an advisory warning of a new set of buffer overflows in the fetchmail header parsing code. The vulnerabilities have been fixed in fetchmail 6.1.0.
Alerts:	Gentoo fetchmail-20021001 2002-10-01 Mandrake MDKSA-2002:063 2002-10-01 EnGarde ESA-20021003-023 2002-10-03 Red Hat RHSA-2002:215-09 2002-10-07 Debian DSA-171-1 2002-10-07 Conectiva CLA-2002:531 2002-10-16 SCO Group CSSA-2002-051.0 2002-11-21 Gentoo 200212-3 2002-12-15 OpenPKG OpenPKG-SA-2002.016 2002-12-17

Comments (none posted)

Buffer overflow in gv

Package(s):	gv	CVE #(s):	CAN-2002-0838
Created:	October 1, 2002	Updated:	November 25, 2002
Description:	gv, a graphical front end to ghostscript, has a buffer overflow vulnerability which can be exploited by a properly crafted PostScript or PDF file. If a user can be tricked into viewing such a file, arbitrary code can be executed with that user's privileges. See this iDEFENSE advisory for the details.
Alerts:	Red Hat RHSA-2002:212-06 2002-09-30 Debian DSA-176-1 2002-10-16 Gentoo ggv-20021017 2002-10-17 Debian DSA-179-1 2002-10-18 Mandrake MDKSA-2002:069 2002-10-21 Debian DSA-182-1 2002-10-28 Conectiva CLA-2002:542 2002-10-31 SCO Group CSSA-2002-053.0 2002-11-22

Comments (none posted)

Buffer overflows in heimdal

Package(s):	heimdal	CVE #(s):
Created:	October 1, 2002	Updated:	October 17, 2002
Description:	A SuSE security team audit of the heimdal Kerberos implementation turned up sever buffer overflow vulnerabilities. No exploits are known as of this writing, but these vulnerabilities are almost certainly possible for a remote attacker to exploit; if you are running heimdal, you should upgrade at the first opportunity.
Alerts:	SuSE SuSE-SA:2002:034 2002-09-30 Debian DSA-178-1 2002-10-17

Comments (none posted)

sendmail smrsh bypass vulnerability

Package(s):	sendmail	CVE #(s):	CAN-2002-1165
Created:	October 2, 2002	Updated:	November 29, 2002
Description:	iDEFENSE has posted an advisory warning of a couple of ways of bypassing the restrictions imposed by the sendmail "smrsh" utility. smrsh puts limits on which programs a user may run out of a .forward file; this vulnerability could give a local user undesired access to the mail server system. A patch has been made available from sendmail.org which closes the vulnerability.
Alerts:	Gentoo sendmail-20021013 2002-10-13 Conectiva CLA-2002:532 2002-10-16 SCO Group CSSA-2002-052.0 2002-11-21 Mandrake MDKSA-2002:083 2002-11-28

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 9, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Red Hat RHSA-2002:096-24 2002-09-18 Gentoo tar-20021001 2002-10-01 Gentoo unzip-20021001 2002-10-01 EnGarde ESA-20021003-022 2002-10-03 Mandrake MDKSA-2002:065 2002-10-10 Mandrake MDKSA-2002:066 2002-10-10 Conectiva CLA-2002:538 2002-10-29 Red Hat RHSA-2006:0195-01 2006-02-21 Fedora-Legacy FLSA:183571-1 2006-04-04

Comments (1 posted)

Updated vulnerabilities

LPRng accepts jobs from any host.

Package(s):	LPRng	CVE #(s):	CAN-2002-0378
Created:	June 12, 2002	Updated:	October 31, 2002
Description:	Matthew Caron pointed out that LPRng's default configuration accepts job submissions from any host. This could be an especially annoying vulnerability for adminstrators with systems exposed to the general public.
Alerts:	Red Hat RHSA-2002:089-07 2002-06-09 Mandrake MDKSA-2002:042 2002-07-04 SuSE SuSE-SA:2002:040 2002-10-31

Comments (none posted)

Safemode vulnerability in PHP

Package(s):	PHP	CVE #(s):	CAN-2001-1246
Created:	August 20, 2002	Updated:	October 9, 2002
Description:	PHP versions 4.0.5 through 4.1.0 fail to properly cleanse a parameter to the mail() function, allowing arbitrary command execution by local and (possibly) remote attackers.
Alerts:	Red Hat RHSA-2002:102-26 2002-08-19 Mandrake MDKSA-2002:059 2002-09-10 Debian DSA-168-1 2002-09-18 SuSE SuSE-SA:2002:036 2002-10-04

Comments (none posted)

Buffer overflow vulnerabilities in PostgreSQL

Package(s):	PostgreSQL	CVE #(s):
Created:	August 21, 2002	Updated:	January 27, 2003
Description:	PostgreSQL 7.2.2 has been released in response to a number of buffer overrun vulnerabilities which have been identified recently. "...it should be noted that these vulnerabilities are only critical on 'open' or 'shared' systems, as they require the ability to be able to connect to the database before they can be exploited." Buffer overflow vulnerabilities fixed include those reported by "Sir Mordred The Traitor" in the cash_words, repeat, and lpad and rpad functions.
Alerts:	Gentoo postgresql-20020826 2002-08-26 Debian DSA-165-1 2002-09-12 Conectiva CLA-2002:524 2002-09-19 Mandrake MDKSA-2002:062 2002-10-01 Trustix 2002-0071 2002-10-17 SuSE SuSE-SA:2002:038 2002-10-21 Red Hat RHSA-2003:010-10 2003-01-14 Red Hat RHSA-2003:001-16 2003-01-14 Yellow Dog YDU-20030127-5 2003-01-27

Comments (none posted)

Heap corruption vulnerability in at

Package(s):	at at, sudo, xchat	CVE #(s):	CAN-2002-0004
Created:	May 21, 2002	Updated:	May 15, 2003
Description:	The at command has a potentially exploitable heap corruption bug. (First LWN report:  January 17th).
Alerts:	Debian DSA-102-1 2002-01-16 Debian DSA-102-2 2002-01-18 Mandrake MDKSA-2002:007 2002-01-18 Red Hat RHSA-2002:015-13 2002-01-22 Red Hat RHSA-2002:015-15 2002-02-07 Slackware sl-1011706104 2002-01-22 SuSE SuSE-SA:2002:003 2001-01-16 Yellow Dog YDU-20020127-9 2002-01-27 EnGarde ESA-20030515-015 2003-05-15

Comments (none posted)

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	October 1, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	OpenPKG OpenPKG-SA-2002.006 2002-07-04 SuSE SuSE-SA:2002:026 2002-07-09 Conectiva CLA-2002:507 2002-07-11 Gentoo glibc-20020713 2002-07-13 Trustix 2002-0061 2002-07-15 Mandrake MDKSA-2002:043 2002-07-16 EnGarde ESA-20020724-018 2002-07-24 Red Hat RHSA-2002:139-10 2002-07-22 Eridani ERISA-2002:028 2002-07-25 Yellow Dog YDU-20020801-2 2002-08-01 SCO Group CSSA-2002-034.0 2002-08-05 Red Hat RHSA-2002:133-13 2002-08-08 Eridani ERISA-2002:035 2002-08-09 Yellow Dog YDU-20020810-3 2002-08-10 Mandrake MDKSA-2002:050 2002-08-13

Comments (1 posted)

Potential unauthorized root access vulnerability in dietlibc

Package(s):	dietlibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	December 5, 2002
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library with is used in dietlibc, a libc optimized for small size. The bug could be exploited to gain unauthorized root access to software linking to dietlibc. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Debian DSA-146-1 2002-08-08 Debian DSA-146-2 2002-08-08 SCO Group CSSA-2002-055.0 2002-12-04

Comments (none posted)

Ethereal buffer overflow, infinite loop and memory management vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2002-0012 CAN-2002-0013 CAN-2002-0353 CAN-2002-0401 CAN-2002-0402 CAN-2002-0403 CAN-2002-0404
Created:	June 12, 2002	Updated:	October 27, 2002
Description:	Ethereal 0.9.4 was released on May 19, 2002 fixing four potential security issues in Ethereal 0.9.3: The SMB dissector could potentially dereference a NULL pointer in two cases. The X11 dissector could potentially overflow a buffer while parsing keysyms. The DNS dissector could go into an infinite loop while reading a malformed packet. The GIOP dissector could potentially allocate large amounts of memory. No known exploits exist "in the wild" at the present time for any of these issues. Ethereal 0.9.2 has several packet handling vulnerabilities that are best avoided by upgrading to 0.9.4. The PROTOS test suite found some flaws in SNMP and LDAP protocols support. Malformed packets could also crash ethereal 0.9.2 due to a ASN.1 zero-length g_malloc problem. The zlib "double free" vulnerability was addressed by the updates for that bug from many distributors.
Alerts:	Eridani ERISA-2002:023 2002-06-06 Red Hat RHSA-2002:088-06 2002-06-04 Yellow Dog YDU-20020606-7 2002-06-06 Conectiva CLA-2002:505 2002-07-04 SCO Group CSSA-2002-037.0 2002-10-24

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Debian DSA-154-1 2002-08-15 Red Hat RHSA-2005:005-01 2005-01-05

Comments (none posted)

GNU fileutils race condition

Package(s):	fileutils ucdsnmp	CVE #(s):	CAN-2002-0435
Created:	May 21, 2002	Updated:	May 16, 2003
Description:	A race condition in rm may cause the root user to delete the whole filesystem. The problem exists in the version of rm in fileutils 4.1 stable and 4.1.6 development version. A patch is available. (First LWN report: May 2).
Alerts:	SCO Group CSSA-2002-018.1 2002-05-13 Mandrake MDKSA-2002:031 2002-05-16 SuSE SuSE-SA:2002:012 2002-04-08 Trustix 2002-0052 2002-06-06 Red Hat RHSA-2003:015-05 2003-02-12 Immunix IMNX-2003-7+-010-01 2003-05-16

Comments (none posted)

Potential remote root exploit in glibc

Package(s):	glibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	June 29, 2003
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library which is used in glibc.This bug could be exploited to gain unauthorized root access to software linking to glibc. Updating as soon as practical is a good idea. Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Debian DSA-149-1 2002-08-13 Red Hat RHSA-2002:166-07 2002-08-12 Eridani ERISA-2002:036 2002-08-13 Trustix 2002-0067 2002-08-13 SuSE SuSE-SA:2002:031 2002-08-30 Gentoo glibc-20020905 2002-09-05 Mandrake MDKSA-2002:061 2002-09-23 Debian DSA-149-2 2002-09-26 Gentoo dietlibc-20020927 2002-09-27 Gentoo glibc-20020927 2002-09-27 EnGarde ESA-20021003-021 2002-10-03 Trustix 2002-0070 2002-10-17 Conectiva CLA-2002:535 2002-10-29 Debian DSA-333-1 2003-06-27

Comments (none posted)

Buffer overflow in groff

Package(s):	groff	CVE #(s):	CAN-2002-0003
Created:	May 21, 2002	Updated:	December 9, 2002
Description:	The groff package has a buffer overflow vulnerability; if it is used with the print system, it is conceivably exploitable remotely.
Alerts:	Mandrake MDKSA-2002:012 2002-02-07 Red Hat RHSA-2002:004-06 2002-01-14 Trustix 2002-0020 2002-01-18 Yellow Dog YDU-20020127-11 2002-01-27 Gentoo groff-20021019 2002-10-19 SCO Group CSSA-2002-057.0 2002-12-06

Comments (none posted)

HylaFAX 4.1.3 fixes multiple vulnerabilities

Package(s):	hylafax	CVE #(s):	CAN-2001-1034
Created:	July 30, 2002	Updated:	October 9, 2002
Description:	The HylaFAX team has released version 4.1.3 fixing denial of service, elevated system privilege and possible remote code execution vulnerabilities. HylaFAX is a mature (est. 1991) enterprise-class open-source software package for sending and receiving facsimiles as well as for sending alpha-numeric pages. It runs on a wide variety of UNIX-like platforms including Linux, BSD (including Mac OS X), SunOS and Solaris, SCO, IRIX, AIX, and HP-UX.
Alerts:	Debian DSA-148-1 2002-08-12 Mandrake MDKSA-2002:055 2002-08-28 SuSE SuSE-SA:2002:035 2002-10-04

Comments (none posted)

UW imapd remotely exploitable buffer overflow

Package(s):	imap	CVE #(s):	CAN-2002-0379
Created:	June 5, 2002	Updated:	December 20, 2002
Description:	UW imapd versions 2000c and prior allow remote authenticated users to execute code via a buffer overflow. A malicious user can craft a request to run commands on the server under their UID and GID. (First LWN report: May 23).
Alerts:	SCO Group CSSA-2002-021.0 2002-05-15 Conectiva CLA-2002:487 2002-05-24 Eridani ERISA-2002:018 2002-05-25 Mandrake MDKSA-2002:034 2002-05-27 Red Hat RHSA-2002:092-11 2002-05-22 Yellow Dog YDU-20020606-1 2002-06-06 EnGarde ESA-20020607-013 2002-06-07 Trustix 2002-0054 2002-06-06 SuSE SuSE-SA:2002:048 2002-12-20

Comments (2 posted)

Cross-site scripting vulnerability in Konqueror for KDE 3.0.3

Package(s):	kdelibs	CVE #(s):
Created:	September 17, 2002	Updated:	November 18, 2002
Description:	Konqueror for KDE 3.0.3, and earlier versions, is subject to this cross-site scripting vulnerability. Since the problem is in kdelibs, any other application which uses the KHTML renderer is also vulnerable. Javascript code running in one frame can access other frames which should be inaccessible. The problem is fixed in kdelibs 3.0.3a.
Alerts:	Debian DSA-167-1 2002-09-16 Conectiva CLA-2002:525 2002-09-20 Mandrake MDKSA-2002:064 2002-10-09 SCO Group CSSA-2002-047.0 2002-11-15

Comments (2 posted)

Kerberos 5 unauthorized root access to KDC host vulnerability

Package(s):	krb5	CVE #(s):
Created:	August 14, 2002	Updated:	October 29, 2002
Description:	A bug in the Kerberos 5 remote administration service, "kadmind", could be exploited to gain unauthorized root access to a KDC host. It is believed that the attacker needs to be able to authenticate to the kadmin daemon for this attack to be successful. Felix von Leitner, discovered this potential division by zero bug in code derived from the SunRPC library which is used in many places, including the Kerberos 5 administration system. Updating now is recommended. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Debian DSA-143-1 2002-08-05 Conectiva CLA-2002:515 2002-08-07 Gentoo 200210-011 2002-10-28

Comments (none posted)

Cross-site scripting vulnerability in mhonarc

Package(s):	mhonarc	CVE #(s):	CAN-2002-0738 CAN-2002-1307 CAN-2002-1388
Created:	September 11, 2002	Updated:	January 3, 2003
Description:	Mhonarc is an HTML formatter for electronic mail; it can be vulnerable to cross-site scripting problems when presented with maliciously crafted messages. This problem is fixed in mhonarc version 2.5.3, but it is not clear that all possible vulnerabilities have been fixed. See the Debian advisory below for information on how to disable text/html attachment support in mhonarc, which may be a more secure solution.
Alerts:	Debian DSA-163-1 2002-09-09 Debian DSA-199-1 2002-11-19 Debian DSA-221-1 2003-01-03

Comments (none posted)

PHP Remote Compromise/DOS Vulnerability

Package(s):	mod_php4	CVE #(s):
Created:	July 22, 2002	Updated:	February 18, 2003
Description:	PHP 4.2.0 and 4.2.1 have an error in the handling of POST requests which can lead to the corruption of memory, and the usual bad consequences. According to this alert, the vulnerability can only be used for denial of service on x86 systems - there is no way to get it to run exploit code. SPARC/Solaris systems are apparently vulnerable to full remote compromise. According to the CERT Advisory, almost every Linux distributor, it seems, ships older (and thus not vulnerable) versions of PHP. Note that, sometimes, systems thought to be safe from remote compromise turn out to be vulnerable to a modified attack, so x86 users should not relax too much. The solution, for those systems with PHP 4.2.0 or 4.2.1 installed, is to upgrade to PHP 4.2.2. For more information see the alert from the discover of the vulnerability, Stefan Esser of e-matters GmbH, or the security advisory from the php team. CERT Advisory: CA-2002-21 Vulnerability in PHP
Alerts:	SuSE SuSE-SA:2003:0009 2003-02-18

Comments (1 posted)

Mozilla XMLHttpRequest file disclosure vulnerability

Package(s):	mozilla	CVE #(s):	CAN-2002-0354
Created:	May 21, 2002	Updated:	October 18, 2002
Description:	This XMLHttpRequest security bug impacts all Mozilla-based browsers. "The bug is found in versions of Mozilla from 0.9.7 to 0.9.9 on various operating system platforms, and in Netscape versions 6.1 and higher." (First LWN report: May 2).
Alerts:	Conectiva CLA-2002:490 2002-05-29 Red Hat RHSA-2002:079-13 2002-05-13 Red Hat RHSA-2002:192-13 2002-10-09

Comments (none posted)

String format bug in pam_ldap logging

Package(s):	nss_ldap	CVE #(s):	CAN-2002-0374
Created:	June 5, 2002	Updated:	October 29, 2002
Description:	The nss_ldap package includes the pam_ldap module for authenticating a user with an LDAP database. Pam_ldap versions prior to 144 have a string format bug in the logging mechanism.
Alerts:	Eridani ERISA-2002:019 2002-05-28 Red Hat RHSA-2002:084-17 2002-05-26 Yellow Dog YDU-20020606-2 2002-06-06 SCO Group CSSA-2002-041.0 2002-10-28

Comments (none posted)

Remotely exploitable vulnerability in pine

Package(s):	pine	CVE #(s):	CAN-2002-0014
Created:	May 21, 2002	Updated:	November 27, 2002
Description:	Pine has an unpleasant vulnerability in URL handling vulnerability which can lead to command execution by remote attackers. (First LWN report:  January 17th). This vulnerability is remotely exploitable; updating is a good idea. Note: If an update isn't yet available for your distribution, setting enable-msg-view-urls to "off" in pine's setup will avoid the vulnerability. (Thanks to Greg Herlein).
Alerts:	Conectiva CLA-2002:460 2002-01-31 EnGarde ESA-20020114-002 2002-01-14 Red Hat RHSA-2002:009-06 2002-01-14 Slackware sl-1010936849 2002-01-13 Yellow Dog YDU-20020127-8 2002-01-27 SuSE SuSE-SA:2002:046 2002-11-25

Comments (none posted)

Buffer overflow vulnerabilities in purity

Package(s):	purity	CVE #(s):
Created:	September 17, 2002	Updated:	September 25, 2002
Description:	It seems that the "purity" game isn't entirely pure itself - a couple of buffer overflows have been found which could be exploited to gain access to the "games" group on Debian systems. Rather than face the prospect of people tampering with their nethack scores, the Debian Project released the first upgrade closing the vulnerability.
Alerts:	Debian DSA-166-1 2002-09-13

Comments (none posted)

PXE server denial of service vulnerability

Package(s):	pxe	CVE #(s):	CAN-2002-0835
Created:	September 4, 2002	Updated:	November 11, 2002
Description:	The PXE server can be crashed using DHCP packets from some Voice Over IP (VOIP) phones. Maliciously formed DHCP packets could be used by a remote attacker to effect a denial of service attack. The PXE package contains the PXE (Preboot eXecution Environment) server and code needed for Linux to boot from a boot disk image on a Linux PXE server.
Alerts:	Red Hat RHSA-2002:162-12 2002-08-30 Eridani ERISA-2002:041 2002-09-03 SCO Group CSSA-2002-044.0 2002-11-11

Comments (none posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	October 1, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Debian DSA-159-1 2002-08-28 Debian DSA-159-2 2002-09-09 Conectiva CLA-2002:527 2002-10-01 Gentoo python-20021003 2002-10-03 Trustix 2002-0073 2002-10-17 SCO Group CSSA-2002-045.0 2002-11-14 Mandrake MDKSA-2002:082 2002-11-25 Mandrake MDKSA-2002:082-1 2002-12-09 Red Hat RHSA-2002:202-25 2003-01-21 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-33 2003-02-12

Comments (none posted)

Sharutils potential privilege escalation using uudecode

Package(s):	sharutils	CVE #(s):	CAN-2002-0178
Created:	May 21, 2002	Updated:	October 30, 2002
Description:	According to the CVE entry, "uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to overwrite files or execute commands." (First LWN report: May 16).
Alerts:	Eridani ERISA-2002:014 2002-05-16 Red Hat RHSA-2002:065-13 2002-05-14 Yellow Dog YDU-20020522-4 2002-05-22 Mandrake MDKSA-2002:052 2002-08-14 SCO Group CSSA-2002-040.0 2002-10-28 Gentoo 200210-012 2002-10-30

Comments (none posted)

Multiple vulnerabilities fixed in Squid-2.4.STABLE7

Package(s):	squid	CVE #(s):
Created:	July 8, 2002	Updated:	November 15, 2002
Description:	Here is the security advisory for the Squid proxy server reporting several vulnerabilities in versions up to and including 2.4.STABLE7. Several of the bugs are believed to allow remote code execution. The security advisory lists the following changes: Several bugfixes and cleanup of the Gopher client, both to correct some security issues and to make Squid properly render certain Gopher menus. Security fixes in how Squid parses FTP directory listings into HTML FTP data channels are now sanity checked to match the address of the requested FTP server. This to prevent theft or injection of data. See the new ftp_sanitycheck directive if this sanity check is not desired. The MSNT auth helper has been updated to v2.0.3+fixes for buffer overflow security issues found in this helper. A security issue in how Squid forwards proxy authentication credentials has been fixed
Alerts:	Conectiva CLA-2002:506 2002-07-05 SuSE SuSE-SA:2002:025 2002-07-09 Trustix 2002-0062 2002-07-15 Mandrake MDKSA-2002:044 2002-07-17 Eridani ERISA-2002:031 2002-07-26 SCO Group CSSA-2002-046.0 2002-11-14

Comments (none posted)

Malformed NFS packet buffer overflow vulnerability in tcpdump

Package(s):	tcpdump	CVE #(s):	CAN-2002-0380
Created:	June 5, 2002	Updated:	October 9, 2002
Description:	A buffer overflow in tcpdump can be triggered by a bad NFS packet when tracing the network. Unmodified tcpdump versions 3.6.2 and earlier are vulnerable.
Alerts:	Eridani ERISA-2002:020 2002-05-30 Red Hat RHSA-2002:094-08 2002-05-29 Conectiva CLA-2002:491 2002-06-05 SCO Group CSSA-2002-025.0 2002-06-04 Trustix 2002-0055 2002-06-05 Yellow Dog YDU-20020606-3 2002-06-06 Red Hat RHSA-2002:094-16 2002-10-04

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 21, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	SCO Group CSSA-2001-030.0 2001-08-10 Conectiva CLA-2001:413 2001-08-24 Debian DSA-075-1 2001-08-14 Debian DSA-075-2 2001-08-14 HP HPSBTL0202-023 2002-02-12 Mandrake MDKSA-2001:068 2001-08-13 Mandrake MDKSA-2001:093 2001-12-17 Progeny PROGENY-SA-2001-27 2001-08-14 Red Hat RHSA-2001:099-06 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:100-02 2001-08-09 Slackware sl-997726350 2001-08-09 SuSE SuSE-SA:2001:029 2001-09-03 Yellow Dog YDU-20010810-1 2001-08-10 Yellow Dog YDU-20010810-2 2001-08-10 Gentoo 200410-03 2004-10-05

Comments (none posted)

Tomcat 4.x JSP source code exposure vulnerability

Package(s):	tomcat	CVE #(s):
Created:	September 25, 2002	Updated:	January 29, 2003
Description:	Rossen Raykov reports that Tomcat 4.0.5 and 4.1.12 fix a JSP source code exposure vulnerability in "Tomcat 4.0.4 and 4.1.10 (probably all other earlier versions also).". The current version of Tomcat is available here. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.
Alerts:	Gentoo tomcat-20020925 2002-09-25 Debian DSA-169-1 2002-10-04 Gentoo tomcat-20021015 2002-10-15 Debian DSA-225-1 2002-01-09 Debian DSA-246-1 2003-01-29

Comments (none posted)

Local root vulnerability in chfn

Package(s):	util-linux	CVE #(s):	CAN-2002-0638
Created:	July 29, 2002	Updated:	October 30, 2002
Description:	chfn (change finger information) is one of the utilities in the util-linux package. The BindView RAZOR Team has discovered a local root vulnerability in chfn which is described in the Bindview Advisory. Under certain conditions, "a carefully crafted attack sequence can be performed to exploit a complex file locking and modification race present in this utility, and, as a result, alter /etc/passwd to escalate privileges in the system." The conditions include a password file, /etc/passwd, over 4 kilobytes and locating the attacker's account record in any but the last 4 kB chunk of the file. CERT/CC Vulnerability Note VU#405955 util-linux package vulnerable to privilege escalation when "ptmptmp" file is not removed properly when using "chfn" utility
Alerts:	Eridani ERISA-2002:032 2002-07-29 Red Hat RHSA-2002:132-14 2002-07-29 Trustix 2002-0064 2002-07-30 Yellow Dog YDU-20020801-4 2002-08-01 Mandrake MDKSA-2002:047 2002-08-08 Conectiva CLA-2002:523 2002-09-12 SCO Group CSSA-2002-043.0 2002-10-29

Comments (none posted)

webalizer: reverse DNS buffer overflow vulnerability

Package(s):	webalizer	CVE #(s):
Created:	May 21, 2002	Updated:	January 27, 2003
Description:	The cause is a buffer overflow bug. This one sounds nasty. If reverse DNS lookups are enabled in webalizer, "an attacker with control over the victims DNS may spoof responses thus triggering a buffer overflow, potentially leading to a root compromise." Webalizer 2.01-10 "fixes this and a few other buglets that have been discovered in the last month or so". (First LWN report:  April 18th, 2002).
Alerts:	Conectiva CLA-2002:476 2002-04-26 EnGarde ESA-20020423-009 2002-04-23 SCO Group CSSA-2002-036.0 2002-10-22 Red Hat RHSA-2002:254-05 2002-12-04 Yellow Dog YDU-20030127-4 2003-01-27

Comments (none posted)

Webmin/Usermin vulnerabilities

Package(s):	webmin	CVE #(s):
Created:	May 21, 2002	Updated:	January 10, 2003
Description:	Webmin is a web-based interface for system administration for Unix. Webmin has cross-site scripting and session ID spoofing vulnerabilities which are fixed in the May 6, 2002 release of version 0.970. (First LWN report: May 9). This one is scary. The session ID spoofing vulnerability allows the "possibility that arbitrary commands may be executed with root privileges." Upgrading is strongly recommended. At a minimum avoid the "preconditions for a successful exploit" by disabling password timeouts under Webmin->Configuration->Authentication.
Alerts:	Mandrake MDKSA-2002:033 2002-05-21 Yellow Dog YDU-20020522-7 2002-05-22 SCO Group CSSA-2003-002.0 2003-01-09

Comments (1 posted)

Multiple vulnerabilities in wordtrans

Package(s):	wordtrans	CVE #(s):	CAN-2002-0837
Created:	September 11, 2002	Updated:	February 4, 2003
Description:	The "wordtrans" interface to multilingual dictionaries suffers from input validation and cross-site scripting vulnerabilities; versions through 1.1pre8 are vulnerable. See this Guardent advisory for details.
Alerts:	Red Hat RHSA-2002:188-08 2002-09-05

Comments (none posted)

Problems with libgtop_daemon

Package(s):	wuftpd libgtop	CVE #(s):
Created:	May 21, 2002	Updated:	May 7, 2003
Description:	The libgtop_daemon package is a GNOME program which makes system information available remotely. LWN reported the remotely exploitable format string and buffer overflow vulnerabilities in that package on December 6th. On November 28th disabling the libgtop_daemon on systems where it is running until an update is available. Many Linux systems do not run libgtop by default, but applying the update is a good idea anyway.
Alerts:	Conectiva CLA-2002:448 2002-01-03 Debian DSA-098-1 2002-01-09 Mandrake MDKSA-2001:094 2001-12-19 Debian DSA-301-1 2003-05-07

Comments (1 posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):	wwwoffle	CVE #(s):	CAN-2002-0818
Created:	August 14, 2002	Updated:	October 1, 2003
Description:	The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on." CAN-2002-0818
Alerts:	SuSE SuSE-SA:2002:029 2002-08-01 Debian DSA-144-1 2002-08-06 SCO Group CSSA-2002-048.0 2002-11-18

Comments (none posted)

Local privilege escalation vulnerability in XFree86

Package(s):	xf86 xfree86	CVE #(s):
Created:	September 18, 2002	Updated:	October 27, 2002
Description:	XFree86 version 4.2.1 fixes a problem in Xlib that made it possible to execute arbitrary code in privileged clients. Other libraries are dynamically loaded by libX11.so as needed. When linking against a setuid program, arbitrary code could be loaded and executed from a pathname controlled by the user.
Alerts:	SuSE SuSE-SA:2002:032 2002-09-18 Conectiva CLA-2002:529 2002-10-03 Conectiva CLA-2002:533 2002-10-16 Gentoo xfree-20021024 2002-10-24

Comments (none posted)

Denial of service vulnerability in xinetd

Package(s):	xinetd	CVE #(s):
Created:	August 14, 2002	Updated:	December 3, 2002
Description:	A file descriptor leak into services started from xinetd may be used, by programs it stats, to crash xinetd. Xinetd is a replacement for the BSD derived inetd.
Alerts:	Debian DSA-151-1 2002-08-13 Gentoo xinetd-20020814 2002-08-14 Mandrake MDKSA-2002:053 2002-08-26 Red Hat RHSA-2002:196-09 2002-10-14 Red Hat RHSA-2002:196-19 2002-12-02

Comments (none posted)

Multiple vulnerabilities in Zope 2.5.1

Package(s):	zope	CVE #(s):	CAN-2002-0170 CAN-2002-0687 CAN-2002-0688
Created:	September 25, 2002	Updated:	September 25, 2002
Description:	Three security hotfixes are available to fix vulnerabilities in Zope 2.5.1: (Hotfix 2002-03-01) Users defined in subfolders of a site may have unintended access to objects at higher levels. (Hotfix 2002-04-15) Untrusted users can use the "through the web code" capability to shut down the Zope server. (Hotfix 2002-06-14) Anonymous users and untrusted code can call arbitrary methods of catalog indexes.
Alerts:	Red Hat RHSA-2002:060-17 2002-09-24

Comments (2 posted)

Resources

Linux Security Week - September 30th 2002

Linux Security Week for September 30 from LinuxSecurity.com is available.

Full Story (comments: none)

Slapper Worm brought to heel (Register)

The Register covers two recent varients of the Slapper worm, Slapper.B (Cinik) and Slapper.C (Unlock). "Two fresh variants of the Slapper worm, which spreads through Linux machines by exploiting a well-known flaw in OpenSSL libraries, have been sighted this week."

Comments (none posted)

Page editor: Jonathan Corbet
Next page: Kernel development>>