One of the biggest fringe benefits of writing book reviews is that
publishers are happy to send you samples of their wares. Sometimes they
are a little too enthusiastic; your editor has been buried under books on
.NET programming, XML for legacy business applications, DBA certification,
and more. The pile of such books threatens to fall over and make a big
mess in the otherwise immaculate LWN.net data center. When an envelope
showed up with a book called Introduction to Computer Security (by
Matt Bishop), it almost joined that pile. Your editor hardly needs another
book on password policies, anti-virus software, and attachment filtering.
Consigning this book to that pile would have been a mistake, however.
"Introduction" might be an accurate description of this book, but only with
a suitable understanding of the target audience: this book could serve for
an introductory, graduate-level course for security researchers. People
looking for ways to lock down their Windows boxes will not find it here;
if, instead, you want to argue about the theoretical limitations of the
type enforcement model with the SELinux folks, you're in the right place.
Chapter 1 (available online
(PDF)) starts with the real introduction, where a number of important
terms are defined: integrity, confidentiality, availability, assurance,
etc. Chapter 2 gets into protection models, access matrices, and
state transitions. Chapter 3 turns up the rigor by proving some
theorems on whether a given system can be proven to be safe or not.
The fourth chapter gets into security policies, and makes some interesting
distinctions: a "military" policy is one oriented primarily around
confidentiality, while a "commercial" policy is aimed at integrity.
Chapter 5 goes military with a more detailed look at confidentiality
policies, with more theorems and a look at mandatory access control.
Integrity policies are covered in the following chapter; a few integrity
models are introduced. Chapter 7 addresses the fact that most
organizations want both integrity and confidentiality by looking at
hybrid models: chinese walls, etc.
Then the focus shifts to cryptography. Chapter 8 is a whirlwind
introduction, starting with basic ciphers and progressing through DES,
public key encryption, and more. The crucial problem of key management is
chapter 9's topic; chapter 10 looks at ciphers in more detail.
There is some discussion there about how ciphers and network stacks can be
brought together, ending with an overview of IPSec. Chapter 11 is
about authentication; here your editor got his discussion of password
policies after all, though in a bit more depth than usual.
Chapter 12 gets into design principles for secure systems: least privilege,
fail-safe defaults, complete mediation, open design (with a discussion of
DeCSS), etc. Chapter 13 looks at identity representations,
certificates, and anonymity, and chapter 14 returns to access control
mechanisms in more detail.
The book then gets into a more serious look at information flow and how it
might be controlled in a secure system. Chapter 16 moves on to
confinement - keeping processes within their defined boundaries; it looks
at virtual machines, sandboxes, and the covert channel problem.
Chapter 17 is an introduction to assurance - how one can be reasonably
sure that a given system meets its security criteria. Then an introduction
to evaluation techniques is given: TCSEC, FIPS, Common Criteria, etc.
After those dry chapters, chapter 19 ("malicious logic") is a relatively
fun look at malware: trojan horses, viruses, worms, and how to defend
against them. Chapter 20 is on vulnerability analysis, penetration
testing, flaw models, etc. with a number of real-world examples. The next
two chapters look at auditing and intrusion detection. Then follows a
series of relatively high-level chapters on network, system, user, and
program security techniques - firewalls, user policies, programming
techniques, and more. The book finishes up with some background material
(lattices, virtual machines) and a 63-page, 968-entry bibliography.
Introduction to Computer Security is an intense reading experience.
Interestingly, this book can be seen as a watered-down version of another
book by the same author: Computer
Security: Art and Science. According to the introduction,
Introduction to Computer Security is a shorter book (a mere 750
pages) with much of the mathematical formalism left out. For most readers,
however, the shortened version is likely to be enough - and to be an
important resource for anybody who wishes to truly understand what secure
computing means.
"infamous41md" discovered a buffer overflow condition in hpsockd, the
socks server written at Hewlett-Packard. An exploit could cause the
program to crash or may have worse effect.
Pavel Kankovsky discovered that several overflows found in the libXpm
library also applied to imlib. He also fixed a number of other potential
flaws. A remote attacker could entice a user to view a carefully-crafted
image file, which would potentially lead to execution of arbitrary code
with the rights of the user viewing the image. This affects any program
that makes use of the imlib library.
Ervin Nemeth discovered that mirrorselect creates temporary files in
world-writable directories with predictable names. A local attacker could
create symbolic links in the temporary files directory, pointing to a valid
file somewhere on the filesystem. When mirrorselect is executed, this would
result in the file being overwritten with the rights of the user running
the utility, which could be the root user.
Jason Wies discovered that when receiving an authorized command from an
authorized user, rssh and scponly do not filter command-line options
that can be used to execute any command on the target host. Using a
malicious command, it is possible for a remote authenticated user to
execute any command (or upload and execute any file) on the target machine
with user rights, effectively bypassing any restriction of scponly or
rssh. See
this Bugtraq post for more details.
Hajvan Sehic discovered several vulnerabilities in viewcvs, a utility
for viewing CVS and Subversion repositories via HTTP. When exporting
a repository as a tar archive the hide_cvsroot and forbidden settings
were not honored.
The GNU a2ps utility fails to properly sanitize filenames, which can be
abused by a malicious user to execute arbitrary commands with the
privileges of the user running the vulnerable application. More
information at Security
Focus.
According to an Apache
announcement, a vulnerability exists in the Apache HTTP server, version
1.3. The problem is a potential buffer overflow in the "get_tag" function
of Apache's SSI module "mod_include". It allows local users who can create
SSI documents to execute arbitrary code as the Apache run-time user via SSI
documents that trigger a content length calculation error.
Aspell's word-list-compress utility fails to properly check bounds
when dealing with words that are more than 256 bytes long.
This can lead to arbitrary code execution by an attacker.
Leon Juranic discovered that BNC fails to do proper bounds checking
when checking server response. An attacker could exploit this to cause a
Denial of Service and potentially execute arbitrary code with the
permissions of the user running BNC.
compress and uncompress do not properly check bounds on command line
options, including the filename. Large parameters would trigger a buffer
overflow. By supplying a carefully crafted filename or other option, an
attacker could execute arbitrary code on the system. A local attacker could
only execute code with his own rights, but since compress and uncompress
are called by various daemon programs, this might also allow a remote
attacker to execute code with the rights of the daemon making use of
ncompress.
cyrus-sasl has a vulnerability involving a buffer overflow
in the digestmda5.c file. A remote attacker may be able
to compromise the system. Also, a local user may be able to
exploit a vulnerability by using the SASL_PATH environment
variable.
"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler.
A buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows
remote attackers to cause a denial of service (application crash) and
possibly execute arbitrary code via an "unexpected sequence of MSNSLP
messages" that results in an unbounded copy operation that writes to the
wrong buffer.
Jim Paris has discovered a cross-site scripting vulnerability in
Gallery. By sending a carefully crafted URL, an attacker can inject and
execute script code in the victim's browser window, and potentially
compromise the users gallery.
The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks.
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user.
Silvio Cesare discovered a potential information leak in glibc. It allows
LD_DEBUG on SUID binaries where it should not be allowed. This has various
security implications, which may be used to gain confidential information.
An attacker can gain the list of symbols a SUID application uses and their
locations and can then use a trojaned library taking precedence over those
symbols to gain information or perform further exploitation.
The catchsegv script in the glibc package has a symlink vulnerability
that may allow a local user to overwrite arbitrary
files with the permissions of the user that is running the script.
Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat.
Recently, Trustix Secure Linux discovered a vulnerability in the groff
package. The utility "groffer" created a temporary directory in an
insecure way, which allowed exploitation of a race condition to create
or overwrite files with the privileges of the user invoking the
program.
GtkHTML is the HTML rendering widget used by the Evolution mail reader.
GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug
when handling HTML messages. Alan Cox discovered that certain malformed
messages could cause the Evolution mail component to crash.
Trustix developers discovered insecure temporary file creation in
supplemental scripts in the gzip package which may allow local users
to overwrite files via a symlink attack.
ImageMagick fails to do proper bounds checking when handling image
files with EXIF information. An attacker could use an image file with
specially-crafted EXIF information to cause arbitrary code execution with
the permissions of the user running ImageMagick. See this advisory for more
information.
Faheem Mitha noticed that the iptables command, an administration tool for
IPv4 packet filtering and NAT, did not always load the required modules on
its own as it was supposed to. This could lead to firewall rules not being
loaded on system startup. This caused a failure in connection with rules
provided by lokkit at least.
During an audit of the smb file system implementation within Linux, several
vulnerabilities were discovered ranging from out of bounds read accesses to
kernel level buffer overflows. See these advisories: Linux kernel
binfmt_elf loader vulnerabilities and
Memory leak in 2.4.27 kernel for more information.
The kernel-utils package contains several utilities that can be used to
control the kernel or machine hardware. In Red Hat Linux 8.0 this package
contains user mode linux (UML) utilities.
The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was
incorrectly shipped setuid root. This could allow local users to control
certain network interfaces, add and remove arp entries and routes, and put
interfaces in and out of promiscuous mode.
All users of the kernel-utils package should update to these packages that
contain a version of uml_net that is not setuid root.
Alternatively, as a work-around to this vulnerability issue the following
command as root:
Several buffer overflows have been discovered in libgd's PNG handling
functions.
If an attacker tricked a user into loading a malicious PNG image, they
could leverage this into executing arbitrary code in the context of
the user opening image. Most importantly, this library is commonly
used in PHP. One possible target would be a PHP driven photo website
that lets users upload images. Therefore this vulnerability might lead
to privilege escalation to a web server's privileges.
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and
earlier may allow remote attackers to execute arbitrary code via malformed
image files that trigger the overflows due to improper calls to the
gdMalloc function.
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that
parses remote resources and allows them to influence the URL, then this
flaw could be used to execute arbitrary code.
libxml2 prior to version 2.6.14 has multiple buffer overflow
vulnerabilities, if a local user passes a specially crafted
FTP URL, arbitrary code may be executed.
Trustix Secure Linux discovered a vulnerability in a supplemental script of
the lvm10 package. The program "lvmcreate_initrd" created a temporary
directory in an insecure way, which could allow a symlink attack to create
or overwrite arbitrary files with the privileges of the user invoking the
program.
Several vulnerabilities exist in the Mozilla web browser and derived
products, the most serious of which could allow a remote attacker to
execute arbitrary code on an affected system. See the CERT advisory for details.
A vulnerability was discovered in mpg321, a command-line mp3 player,
whereby user-supplied strings were passed to printf(3) unsafely. This
vulnerability could be exploited by a remote attacker to overwrite
memory, and possibly execute arbitrary code. In order for this
vulnerability to be exploited, mpg321 would need to play a malicious
mp3 file (including via HTTP streaming).
Several problems have been discovered in MySQL. Oleksandr Byelkin noticed
that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table
instead of the new one. (CAN-2004-0835) Lukasz Wojtow noticed a buffer
overrun in the mysql_real_connect function. (CAN-2004-0836) Dean Ellis
noticed that multiple threads ALTERing the same (or different) MERGE tables
to change the UNION can cause the server to crash or stall. (CAN-2004-0837)
Michal Zalewski discovered a bug in the netkit-telnet server (telnetd)
whereby a remote attacker could cause the telnetd process to free an
invalid pointer. This causes the telnet server process to crash, leading
to a straightforward denial of service (inetd will disable the service if
telnetd is crashed repeatedly), or possibly the execution of arbitrary code
with the privileges of the telnetd process (by default, the 'telnetd'
user).
netpbm is graphics conversion toolkit made up of a large number of
single-purpose programs. Many of these programs were found to create
temporary files in an insecure manner, which could allow a local
attacker to overwrite files with the privileges of the user invoking a
vulnerable netpbm tool.
Donato Ferrante discovered a buffer overflow vulnerability in the
RedirectAll command of the Open DC Hub. Upon exploitation, a remote user
with administrative privileges can execute arbitrary code on the system
running the Open DC Hub. See this
advisory.
The der_chop script in openssl has a temp file vulnerability that may allow
an attacker to overwrite arbitrary files with the permissions that
the script is running under.
Trustix Secure Linux has discovered some vulnerabilities in the perl
package. The utility "instmodsh", the Perl package "PPPort.pm", and several
test scripts (which are not shipped and only used during build) created
temporary files in an insecure way, which could allow a symlink attack to
create or overwrite arbitrary files with the privileges of the user
invoking the program, or building the perl package, respectively.
Stefan Esser has issued an advisory regarding a
remotely exploitable hole in PHP (through version 4.3.7). If the
memory_limit feature is in use (as it should be, to prevent denial
of service attacks), allocation failures can be forced at highly
inopportune times, and those failures can be exploited to execute arbitrary
code. The exploit is described as "quite easy," and it can be done
regardless of whether Apache1 or Apache2 is in use. Upgrading to PHP 4.3.8 fixes the
problem; yesterday's PHP 5.0 release also contains the fix (but the
final release candidate did not).
phpBB fails to sanitize input properly; this vulnerability may be exploited by a remote attacker to execute arbitrary code. Version 2.0.11 contains the fix.
Cedric Cochin has discovered
multiple cross-site scripting vulnerabilities in phpMyAdmin. These
vulnerabilities can be exploited through the PmaAbsoluteUri parameter, the
zero_rows parameter in read_dump.php, the confirm form, or an error message
generated by the internal phpMyAdmin parser. By sending a
specially-crafted request, an attacker can inject and execute malicious
script code, potentially compromising the victim's browser.
phpWebSite
is vulnerable to HTTP response splitting attacks. A malicious user
could inject arbitrary response data, leading to content spoofing, web
cache poisoning and other cross-site scripting or HTTP response splitting
attacks.
The make_oidjoins_check script insecurely creates temporary files in
world-writeable directories with predictable names. A local attacker could
create symbolic links in the temporary files directory, pointing to a valid
file somewhere on the filesystem. When make_oidjoins_check is called, this
would result in file overwrite with the rights of the user running the
utility, which could be the root user.
ProZilla contains several exploitable buffer overflows in the code handling
the network protocols. A remote attacker could setup a malicious server
and entice a user to retrieve files from that server using ProZilla. This
could lead to the execution of arbitrary code with the rights of the user
running ProZilla.
Max Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet
driver from Roaring Penguin. When the program is running setuid root
(which is not the case in a default Debian installation), an attacker
could overwrite any file on the file system.
The upstream developers of Ruby have corrected a problem in the CGI
module for this language. Specially crafted requests could cause an
infinite loop and thus cause the program to eat up cpu cycles.
According to this Samba advisory a remote
attacker could cause an smbd process to consume abnormal amounts of system
resources due to an input validation error when matching filenames
containing wildcard characters. Versions of Samba 3.0.x up to and
including 3.0.7 are vulnerable.
There is also an advisory about possible
buffer overruns in smbd.
sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer
overflow in shar.c, where the length of data returned by the wc command is
not checked. Florian Schilhabel discovered another buffer overflow in
unshar.c. An attacker could exploit these vulnerabilities to execute
arbitrary code as the user running one of the sharutils programs.
SpamAssassin contains an unspecified Denial of Service vulnerability. By
sending a specially crafted message an attacker could cause a Denial of
Service attack against the SpamAssassin service.
Subversion has a remote Denial of Service vulnerability
that may allow a server that runs svnserve to execute
arbitrary code. See this advisory for more information.
Versions of sudo prior to 1.6.8p2 fail to properly sanitize the environment prior to running shell scripts; this failure can be exploited by a sudo user to subvert scripts and obtain shell access. See the 1.6.8p2 announcement for more information.
Jouko Pynnonen reported
a vulnerability in the plugin mechanism which allows remote attackers to
bypass the Java sandbox through the use of javascript.
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability.
The tiff library contains several buffer overflows which may be exploited
by way of maliciously-crafted image files. See this advisory for more information.
The unarj uncompression utility has a buffer overflow vulnerability
from handling long file names in an archive. An attacker can
cause unarj to crash or execute arbitrary code.
WordPress: HTTP response splitting and XSS vulnerabilities
Package(s):
wordpress
CVE #(s):
Created:
October 14, 2004
Updated:
December 20, 2004
Description:
WordPress is vulnerable to HTTP response splitting and cross-site scripting
attacks, due to the lack of input validation in the administration panel
scripts. A malicious user could inject arbitrary response data, leading to
content spoofing, web cache poisoning and other cross-site scripting or
HTTP response splitting attacks. This could result in compromising the
victim's data or browser.
XChat is vulnerable to a stack overflow that may allow a remote attacker to
run arbitrary code. The SOCKS 5 proxy code in XChat is vulnerable to a
remote exploit. Users would have to be using XChat through a SOCKS 5
server, enable SOCKS 5 traversal which is disabled by default and also
connect to an attacker's custom proxy server. This vulnerability may allow
an attacker to run arbitrary code within the context of the user ID of the
XChat client.
Shaun Colley discovered a problem in xine-ui, the xine video player
user interface. A script contained in the package to possibly remedy
a problem or report a bug does not create temporary files in a secure
fashion. This could allow a local attacker to overwrite files with
the privileges of the user invoking xine.
Several xpdf integer overflow vulnerabilities can be exploited via a
mal-formed PDF document. Similar vulnerabilities can be found in kpdf and
in cupsys which share code. Additional information can be found in this KDE security advisory.
Max Vozeler noticed that yardradius, the YARD radius authentication
and accounting server, contained a stack overflow similar to the one
from radiusd which is referenced as
CAN-2001-0534. This could lead to the execution of arbitrary code as
root.
Multiple arithmetic overflows have been detected in the image
processing code of zgv. An attacker could entice a user to open a
specially-crafted image file, potentially resulting in execution of
arbitrary code with the rights of the user running zgv. See this BugTraq advisory
for more information.
HexView discovered a buffer overflow in the zip package. The overflow is
triggered by creating a ZIP archive of files with very long path
names. This vulnerability might result in execution of arbitrary code with
the privileges of the user who calls zip. This flaw may lead to privilege
escalation on systems which automatically create ZIP archives of user
supplied files, like backup systems or web applications.
![[cover]](/images/ns/intro-comp-sec.jpg)
are a little too enthusiastic; your editor has been buried under books on
.NET programming, XML for legacy business applications, DBA certification,
and more. The pile of such books threatens to fall over and make a big
mess in the otherwise immaculate LWN.net data center. When an envelope
showed up with a book called Introduction to Computer Security (by
Matt Bishop), it almost joined that pile. Your editor hardly needs another
book on password policies, anti-virus software, and attachment filtering.