What to do about DNS?
April 11, 2007
This article was contributed by Jake Edge.
The Domain Name System (DNS) has been in the news a bit recently, mostly
because of a ham-handed
attempt
by the US Department of Homeland Security (DHS) to control the master
signing key for the DNS Security Extensions (DNSSEC) root zone. While the
impact of that is still being
debated,
it certainly does not help alleviate
the fears that other countries have regarding US control of the Internet.
Meanwhile, the DHS is
pushing adoption of DNSSEC
which further fans the flames, even while there are serious
questions
about the protocol and what, if any, real problems it solves.
On another front, Bugtraq readers will have noticed a
call to action
regarding DNS issues from security researcher Gadi Evron. All of this
seems like a good reason to take a look at DNS and DNSSEC and to try to
shed some light on the state of Internet name lookups.
DNS is one of the most
commonly used services on the Internet, every time one puts 'lwn.net' into
a browser, it is used to turn that name into an IP address. In a naive
implementation, the browser causes the machine to talk to one of the 13
root servers (k.root-servers.net for example) requesting information
about a nameserver for 'net'; it will get a response listing the 13 servers
that handle requests for the 'net' top-level domain
(D.GTLD-SERVERS.NET for example).
As part of the answer, it also receives the IP address for D.GTLD-SERVERS.NET
(otherwise it would have to query for that IP address which could lead to
an infinite loop) and it uses that address to query for a nameserver for
'lwn.net'. The response is a set of hosts and their IP addresses that are
the nameservers for the 'lwn.net' domain and these in turn can be queried
to get the IP address of the host of interest. After all that, the browser
can connect to the IP address on port 80 and commence with the HTTP request.
In most cases, all of that traffic does not get generated each time a hostname
needs to be resolved because there are caches that store
information on intermediate hosts. Hosts are typically configured to talk
to a caching nameserver when they make DNS requests. The caching nameservers
store name-to-IP mappings for as long as the time-to-live (TTL) value will
allow. TTL values are an amount of time in seconds that the
information returned is valid; they are chosen by a domain owner as a
tradeoff between quick responses to changes and DNS traffic reduction;
typical values range from two hours to two days. When a caching nameserver
finds a mapping in its cache with time still left in the TTL, it can just
provide that information to a requester without making any queries upstream.
DNS has worked, by and large, for a long time, but it is not without its
problems. Anyone who can intercept DNS queries and/or reply in a way that
looks like it
came from the queried server can control the name resolution process,
providing a number of opportunities for phishing and other kinds of
malfeasance. Because the information is typically cached, one redirection
with an enormous TTL can have a large impact in what is known as a DNS cache
poisoning attack. A poisoned cache sufficiently high in a hierarchy of
caching DNS servers can affect large swaths of the Internet as the redirection
can trickle down to each of the nameservers below it.
It is against this backdrop of cache poisoning and exploitable flaws in
some DNS implementations (Wikipedia has some good examples
here) that
calls to implement
DNSSEC have increased. By using public
key encryption,
DNSSEC removes the possibility of spoofing the nameserver for a domain
through a DNS reply. DNSSEC replies will be signed using the private
key of the domain and can then be verified using the public key. If the
response does not verify, it does not contain valid information for that
domain and should be discarded. At first blush, this seems like a good
thing that will eliminate some existing problems; as with many things,
though, the devil is in the details.
In order to verify any signed queries, one must obtain the public key from a
trusted source; invalid public keys just lead to the same forgery issues
that are present in the current system. The public keys will have to
be signed in a hierarchy that corresponds to the domain name hierarchy and
the top-level master signing key will be the key at the top of the heap.
Its public portion will be distributed with DNSSEC enabled software and the
private part will
sign the keys for the root servers. The root servers will sign the keys for
the TLD servers which will in turn sign keys for each of the domains. By
verifying each step before caching the information, nameservers can ensure
they have correct DNS mappings.
There are some inherent problems in DNSSEC and perhaps the highest profile
issue is with the exposure of all the zone data. Because DNSSEC is tasked
with providing an authoritative 'not found' message for hosts without an
entry, it enables enumeration of all hosts in a zone. The 'not found'
messages need to be signed, but it is deemed important not to have the
private keys online (in case of a security breach); it also cannot just
be a single signed 'not found' message because it could be replayed, in
effect knocking a valid host out of the DNS. The solution involves
ranges of invalid hostnames each with their own signed 'not found' message.
Through a series of queries, an attacker can gain all of the 'not found'
ranges which leaves the available hostnames obvious in the gaps.
This is very different from the current DNS where one could only ask for
hosts by name and essentially get a yes or no answer.
This information leakage was at first considered to be a non-issue by the
IETF group working on DNSSEC. They have since been convinced that this
problem would prohibit adoption in some jurisdictions and would severely
limit some of the more interesting uses for DNS after it becomes
secured. The latest proposals provide for a 'not found' message that
contains a canned signed portion along with a cryptographic hash of the
hostname requested and recipients would need to verify both the signature
and that the hash corresponds to the request that they made before
accepting the response.
There are also legitimate questions about why DNS needs to be secured. Even
if you are certain you know the right address to use for a particular domain,
you are not guaranteed that a connection made to that IP actually gets to
your intended destination. In order to ensure that, you must have another
layer of encryption such as HTTPS or ssh using verified
keys. It also does not really help against the vast majority of phishing
scams as it does not assist users in recognizing that
'thisistotallynotpaypal.com' is not in any way the same as 'paypal.com' even
though they end the same way.
There are some interesting applications for secured services like DNSSEC, but
critics argue that those applications should be implemented separately from
DNS. There is no need to risk
breaking the currently working DNS system by adding additional complexity for
little or no gain. If putting DKIM keys
into a nameserver-like structure is desirable, and many would argue that it
is, create a new system, perhaps based on DNS/DNSSEC, that implements it.
In the meantime, they contend, we should leave DNS alone.
Given these questions and a bit of concern whenever any government - but
particularly the US government - tries to muscle in on Internet governance, it
should come as no surprise that there is a bit of an uproar regarding the
DHS key control attempt.
It is not completely clear why the DHS believes it must control the master
signing key; the theories range from the bland, through clueless and into
nefarious. It is possible that DHS believes it is the only entity that
can be trusted with the keys, a position which tends to cause muttering about US
arrogance. Another possibility is that DHS does not really understand what
the keys are and what can be done with them. The paranoid are concerned that
the keys might be used to set up a parallel set of root servers that
remake the Internet into something more in line with the Bush administration's
vision of what the Internet should look like. By co-opting or otherwise
manipulating Internet routing, the DHS, some fear, could stage a complete takeover via this
alternate sanitized hierarchy. No matter what the reason, it certainly stirs
up people who feel that Internet governance should be handled by
international organizations and not by the US government.
The problems that Gadi Evron brought to the attention of Bugtraq readers
are independent of the DNS vs. DNSSEC debate as neither address the issues
that he is trying to solve. A great deal of Internet malware, botnets,
spyware, viruses, phishing, etc. relies on name resolution in order to do
its work. They typically use nameservers and IP mappings with
very short TTL values which allows them to be highly mobile, rapidly
changing nameservers and IP addresses as they get detected and shut down in
the whack-a-mole game that gets played continuously on the Internet.
The white hats simply cannot move fast enough even if they do not run
up against slow moving or hostile ISP administrators.
The easiest place to handle this kind of domain is with its registrar, who
can completely shut it down by routing its nameservers to nonexistent hosts.
This ability to essentially remove a domain's existence can be abused
(as GoDaddy proved with
seclists.org earlier this year) and there need to be some strict policies and
procedures in place to govern how that power is to be used. In addition,
there are so-called black hat registrars that do not care and perhaps
encourage malicious behavior from some of their registrants. Evron
was reporting on a message he sent to the registrar operations mailing
list highlighting the problem and looking for solutions. His message to
Bugtraq reported on the progress and asked for further ideas.
DNS is a critical piece of Internet infrastructure and anything that impacts
it will be felt by a lot of people; anything that breaks it will break the
net. All of the services that we use rely, at least to a limited
extent, on DNS and any serious outage would make the Internet completely
unusable. Because of that, a conservative approach is required. Threats can
come from both criminals and governments (though some would claim that is
redundant) and we need to protect the net from both. Perhaps DNSSEC tips
things too far one way and another approach is needed. It will be interesting
to see how it plays out.
Comments (18 posted)
New vulnerabilities
ipsec-tools: denial of service
| Package(s): | ipsec-tools |
CVE #(s): | CVE-2007-1841
|
| Created: | April 10, 2007 |
Updated: | August 28, 2007 |
| Description: |
A flaw was discovered in the IPSec key exchange server "racoon". Remote
attackers could send a specially crafted packet and disrupt established
IPSec tunnels, leading to a denial of service. |
| Alerts: |
|
Comments (none posted)
man-db: buffer overflow
| Package(s): | man-db |
CVE #(s): | CVE-2006-4250
|
| Created: | April 6, 2007 |
Updated: | April 11, 2007 |
| Description: |
A buffer overflow has been discovered in the man command that could allow an
attacker to execute code as the man user by providing specially crafted
arguments to the -H flag. This is likely to be an issue only on machines
with the man and mandb programs installed setuid. |
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
apache: cross-site scripting
| Package(s): | apache |
CVE #(s): | CVE-2006-3918
|
| Created: | August 9, 2006 |
Updated: | April 4, 2008 |
| Description: |
From the Red Hat advisory: "A bug was found in Apache where an invalid Expect header sent to the server
was returned to the user in an unescaped error message. This could
allow an attacker to perform a cross-site scripting attack if a victim was
tricked into connecting to a site and sending a carefully crafted Expect
header." |
| Alerts: |
|
Comments (none posted)
Asterisk: two SIP denial of service vulnerabilities
| Package(s): | Asterisk |
CVE #(s): | CVE-2007-1561
CVE-2007-1594
|
| Created: | April 3, 2007 |
Updated: | August 27, 2007 |
| Description: |
The Madynes research team at INRIA has discovered that Asterisk contains a
null pointer dereferencing error in the SIP channel when handling INVITE
messages. Furthermore qwerty1979 discovered that Asterisk 1.2.x fails to
properly handle SIP responses with return code 0. A remote attacker could
cause an Asterisk server listening for SIP messages to crash by sending a
specially crafted SIP message or answering with a 0 return code. |
| Alerts: |
|
Comments (none posted)
bluez-utils: hidd vulnerability
| Package(s): | bluez-utils |
CVE #(s): | CVE-2006-6899
|
| Created: | January 16, 2007 |
Updated: | May 14, 2007 |
| Description: |
hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain
control of the Mouse and Keyboard Human Interface Device (HID) via a
certain configuration of two HID (PSM) endpoints, operating as a server,
aka HidAttack. |
| Alerts: |
|
Comments (none posted)
bugzilla: multiple vulnerabilities
| Package(s): | bugzilla |
CVE #(s): | CVE-2006-5453
CVE-2006-5454
CVE-2006-5455
|
| Created: | November 10, 2006 |
Updated: | August 28, 2007 |
| Description: |
Bugzilla has the following vulnerabilities:
Input data passed to various fields is not properly sanitized before
being passed back to users.
Users can gain unauthorized access to read attachment
descriptions while using diff mode.
HTTP GET and HTTP POST requests can be used to perform unauthorized
actions due to improper verification.
Input that is passed to showdependencygraph.cgi is not properly
sanitized before being returned to users. |
| Alerts: |
|
Comments (none posted)
busybox: insecure password generation
| Package(s): | busybox |
CVE #(s): | CVE-2006-1058
|
| Created: | May 5, 2006 |
Updated: | May 2, 2007 |
| Description: |
The BusyBox 1.1.1 passwd command does not use a proper salt when generating
passwords. This would create an instance where a brute force attack could
take very little time. |
| Alerts: |
|
Comments (2 posted)
cpio: arbitrary code execution
| Package(s): | cpio |
CVE #(s): | CVE-2005-4268
|
| Created: | January 2, 2006 |
Updated: | May 8, 2007 |
| Description: |
Richard Harms discovered that cpio did not sufficiently validate file
properties when creating archives. Files with e. g. a very large size
caused a buffer overflow. By tricking a user or an automatic backup
system into putting a specially crafted file into a cpio archive, a
local attacker could probably exploit this to execute arbitrary code
with the privileges of the target user (which is likely root in an
automatic backup system). |
| Alerts: |
|
Comments (none posted)
cups: denial of service
| Package(s): | cups |
CVE #(s): | CVE-2007-0720
|
| Created: | March 26, 2007 |
Updated: | February 7, 2008 |
| Description: |
Previous versions of the cups package could be forced to hang via a client
"partially negotiating" an ssl connection. In this state, cups would not
allow other connections to be made, a denial of service. |
| Alerts: |
|
Comments (none posted)
Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service
| Package(s): | cyrus-sasl |
CVE #(s): | CVE-2006-1721
|
| Created: | April 21, 2006 |
Updated: | September 4, 2007 |
| Description: |
Cyrus-SASL contains an unspecified vulnerability in the DIGEST-MD5
process that could lead to a Denial of Service. An attacker could possibly
exploit this vulnerability by sending specially crafted data stream to the
Cyrus-SASL server, resulting in a Denial of Service even if the attacker is
not able to authenticate. |
| Alerts: |
|
Comments (none posted)
dovecot: index cache file handling error
| Package(s): | dovecot |
CVE #(s): | CVE-2006-5973
|
| Created: | November 29, 2006 |
Updated: | May 8, 2007 |
| Description: |
The dovecot IMAP server has an error in its index cache file handling code which could be exploited by an authenticated user to execute arbitrary code. Only servers with the (non-default) mmap_disable=yes option setting are vulnerable. |
| Alerts: |
|
Comments (none posted)
evolution: format string error
| Package(s): | evolution |
CVE #(s): | CVE-2007-1002
|
| Created: | March 27, 2007 |
Updated: | February 27, 2008 |
| Description: |
A format string error in the "write_html()" function in calendar/gui/
e-cal-component-memo-preview.c when displaying a memo's categories can
potentially be exploited to execute arbitrary code via a specially crafted
shared memo containing format specifiers. |
| Alerts: |
|
Comments (1 posted)
fail2ban: denial of service
| Package(s): | fail2ban |
CVE #(s): | CVE-2006-6302
|
| Created: | February 16, 2007 |
Updated: | July 30, 2007 |
| Description: |
fail2ban 0.7.4 and earlier does not properly parse sshd logs file, which
allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file
and cause a denial of service by adding arbitrary IP addresses to the sshd
log file, as demonstrated by logging in to ssh using a login name
containing certain strings with an IP address. |
| Alerts: |
|
Comments (3 posted)
ffmpeg: buffer overflows
| Package(s): | ffmpeg |
CVE #(s): | CVE-2006-4799
CVE-2006-4800
|
| Created: | September 14, 2006 |
Updated: | May 28, 2007 |
| Description: |
the AVI processing code in FFmpeg has a number of buffer overflow
vulnerabilities.
If an attacker can trick a user into loading a specially crafted
crafted AVI, arbitrary code can be executed with the user's privileges. |
| Alerts: |
|
Comments (2 posted)
file: arbitrary code execution
| Package(s): | file |
CVE #(s): | CVE-2007-1536
|
| Created: | March 22, 2007 |
Updated: | May 30, 2007 |
| Description: |
The "file" utility incorrectly checks the allocated heap memory size.
If a remote attacker can trick a user into looking at specially crafted
files with file, arbitrary code can be executed with the user's privileges. |
| Alerts: |
|
Comments (1 posted)
firefox: FTP PASV port-scanning
| Package(s): | firefox seamonkey |
CVE #(s): | CVE-2007-1562
|
| Created: | March 23, 2007 |
Updated: | June 4, 2007 |
| Description: |
According to this
advisory, the FTP protocol includes the PASV (passive) command which is
used by Firefox to request an alternate data port. The specification of the
FTP protocol allows the server response to include an alternate server
address as well, although this is rarely used in practice. |
| Alerts: |
|
Comments (1 posted)
freeradius: several vulnerabilities
| Package(s): | freeradius |
CVE #(s): | CVE-2005-4745
CVE-2005-4746
|
| Created: | August 8, 2006 |
Updated: | April 24, 2007 |
| Description: |
Several remote vulnerabilities have been discovered in freeradius, a
high-performance RADIUS server, which may lead to SQL injection or denial
of service. |
| Alerts: |
|
Comments (none posted)
freetype: integer overflows
| Package(s): | freetype |
CVE #(s): | CVE-2006-0747
CVE-2006-1861
CVE-2006-2493
CVE-2006-2661
CVE-2006-3467
|
| Created: | June 8, 2006 |
Updated: | October 10, 2007 |
| Description: |
The FreeType library has several integer overflow vulnerabilities.
If a user can be tricked into installing a specially
crafted font file, arbitrary code can be executed with the privilege
of the user. |
| Alerts: |
|
Comments (none posted)
gcc: file overwrite vulnerability
| Package(s): | gcc |
CVE #(s): | CVE-2006-3619
|
| Created: | September 6, 2006 |
Updated: | March 14, 2008 |
| Description: |
The fastjar utility found in the GNU compiler collection does not perform adequate file path checking, allowing the creation or overwriting of files outside of the current directory tree. |
| Alerts: |
|
Comments (none posted)
gd: buffer overflow
| Package(s): | gd |
CVE #(s): | CVE-2007-0455
|
| Created: | February 7, 2007 |
Updated: | February 28, 2008 |
| Description: |
The gd graphics library contains a buffer overflow which could enable a remote attacker to execute arbitrary code. Note that various other packages include code from gd and could also be vulnerable. |
| Alerts: |
|
Comments (2 posted)
gdb: buffer overflow
| Package(s): | gdb |
CVE #(s): | CVE-2006-4146
|
| Created: | September 15, 2006 |
Updated: | June 12, 2007 |
| Description: |
A buffer overflow in dwarfread.c and dwarf2read.c debugging code in GNU
Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to
execute arbitrary code via a crafted file with a location block
(DW_FORM_block) that contains a large number of operations. |
| Alerts: |
|
Comments (none posted)
gdm: improper file permissions
| Package(s): | gdm |
CVE #(s): | CVE-2006-1057
|
| Created: | April 19, 2006 |
Updated: | May 2, 2007 |
| Description: |
The .ICEauthority file may be created with the wrong ownership and permissions; gdm 2.14.2 fixes the problem. |
| Alerts: |
|
Comments (none posted)
gv: stack-based buffer overflow
| Package(s): | gv |
CVE #(s): | CVE-2006-5864
|
| Created: | November 20, 2006 |
Updated: | April 9, 2007 |
| Description: |
Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv
3.6.2, and possibly earlier versions, allows user-assisted attackers to
execute arbitrary code via a PostScript (PS) file with certain headers that
contain long comments, as demonstrated using the DocumentMedia header. |
| Alerts: |
|
Comments (none posted)
gzip: multiple vulnerabilities
| Package(s): | gzip |
CVE #(s): | CVE-2006-4334
CVE-2006-4335
CVE-2006-4336
CVE-2006-4337
CVE-2006-4338
|
| Created: | September 19, 2006 |
Updated: | June 1, 2007 |
| Description: |
Tavis Ormandy of the Google Security Team discovered two denial of service
flaws in the way gzip expanded archive files. If a victim expanded a
specially crafted archive, it could cause the gzip executable to hang or
crash.
Tavis Ormandy of the Google Security Team discovered several code execution
flaws in the way gzip expanded archive files. If a victim expanded a
specially crafted archive, it could cause the gzip executable to crash or
execute arbitrary code. |
| Alerts: |
|
Comments (1 posted)
horde-kronolith: local file inclusion
| Package(s): | horde-kronolith |
CVE #(s): | CVE-2006-6175
|
| Created: | January 17, 2007 |
Updated: | March 7, 2008 |
| Description: |
Kronolith contains a mistake in lib/FBView.php where a raw, unfiltered
string is used instead of a sanitized string to view local files. An
authenticated attacker could craft an HTTP GET request that uses directory
traversal techniques to execute any file on the web server as PHP code,
which could allow information disclosure or arbitrary code execution with
the rights of the user running the PHP application (usually the webserver
user). |
| Alerts: |
|
Comments (none posted)
ImageMagick: DCM and XWD buffer overflows
| Package(s): | imagemagick |
CVE #(s): | CVE-2007-1719
|
| Created: | April 3, 2007 |
Updated: | April 4, 2007 |
| Description: |
iDefense Labs reports
several buffer overflow vulnerabilities in ImageMagick version 6.3.x.. |
| Alerts: |
|
Comments (1 posted)
ImageMagick: integer overflows
| Package(s): | imagemagick |
CVE #(s): | CVE-2007-1797
|
| Created: | April 4, 2007 |
Updated: | April 17, 2008 |
| Description: |
Multiple integer overflows in ImageMagick before 6.3.3-5 allow remote
attackers to execute arbitrary code via (1) a crafted DCM image, which
results in a heap-based overflow in the ReadDCMImage function, or (2) the
(a) colors or (b) comments field in a crafted XWD image, which results in a
heap-based overflow in the ReadXWDImage function, different issues than
CVE-2007-1667. |
| Alerts: |
|
Comments (none posted)
imlib2: arbitrary code execution
| Package(s): | imlib2 |
CVE #(s): | CVE-2006-4806
CVE-2006-4807
CVE-2006-4808
CVE-2006-4809
|
| Created: | November 6, 2006 |
Updated: | August 13, 2007 |
| Description: |
M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the
validity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images. If a user
were tricked into viewing or processing a specially crafted image with
an application that uses imlib2, the flaws could be exploited to execute
arbitrary code with the user's privileges. |
| Alerts: |
|
Comments (none posted)
inkscape: format string vulnerabilities
| Package(s): | inkscape |
CVE #(s): | CVE-2007-1463
CVE-2007-1464
|
| Created: | March 21, 2007 |
Updated: | April 16, 2007 |
| Description: |
Inkscape has a format string vulnerability in its URI handling, possibly
allowing an attacker to execute code with user privileges via a specially
crafted file.
Format string vulnerability in the whiteboard Jabber protocol in Inkscape
before 0.45.1 allows user-assisted remote attackers to execute arbitrary
code via unspecified vectors. |
| Alerts: |
|
Comments (none posted)
java: multiple vulnerabilities
| Package(s): | java |
CVE #(s): | CVE-2006-4339
CVE-2006-4790
CVE-2006-6731
CVE-2006-6736
CVE-2006-6737
CVE-2006-6745
|
| Created: | January 18, 2007 |
Updated: | June 8, 2007 |
| Description: |
java has multiple vulnerabilities, these include:
an RSA exponent padding attack vulnerability, two vulnerabilities
which allow untrusted applets to access data in other applets,
vulnerabilities that involve applets gaining privileges due to
serialization bugs in the JRE and buffer overflows in the java image
handling routines that can give attackers read/write/execute capabilities
for local files. |
| Alerts: |
|
Comments (1 posted)
kdelibs: bug in FTP protocol
| Package(s): | kdelibs |
CVE #(s): | CVE-2007-1564
|
| Created: | March 30, 2007 |
Updated: | April 4, 2007 |
| Description: |
The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to
force the client to connect to other servers, perform a proxied port scan,
or obtain sensitive information by specifying an alternate server address
in a FTP PASV command. |
| Alerts: |
|
Comments (none posted)
kdelibs: cross-site scripting
| Package(s): | kdelibs konqeror |
CVE #(s): | CVE-2007-0537
|
| Created: | February 5, 2007 |
Updated: | August 13, 2007 |
| Description: |
Konqueror 3.5.5 does not properly parse HTML comments, which allows remote
attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS
protection schemes by embedding certain HTML tags within a comment, a
related issue to CVE-2007-0478. |
| Alerts: |
|
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2006-5749
CVE-2006-4814
CVE-2006-6106
|
| Created: | January 5, 2007 |
Updated: | May 7, 2008 |
| Description: |
A security issue has been reported in Linux kernel due to an error in
drivers/isdn/i4l/isdn_ppp.c as the "isdn_ppp_ccp_reset_alloc_state()"
function never initializes an event timer before scheduling it with the
"add_timer()" function.
The mincore function in the kernel does not properly lock access to user
space, which has unspecified impact and attack vectors, possibly related to
a deadlock.
Another vulnerability has been reported in Linux kernel caused by a
boundary error within the handling of incoming CAPI messages in
net/bluetooth/cmtp/capi.c. This can be exploited to overwrite certain
Kernel data structures. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4623
|
| Created: | October 18, 2006 |
Updated: | November 14, 2007 |
| Description: |
The kernel DVB layer can be caused to crash with maliciously-formatted unidirectional lightweight encapsulation (ULE) data. |
| Alerts: |
|
Comments (none posted)
kernel: multiple vulnerabilities
| Package(s): | kernel |
CVE #(s): | CVE-2007-0005
CVE-2007-1000
|
| Created: | March 15, 2007 |
Updated: | November 14, 2007 |
| Description: |
The Linux kernel has a boundary error problem with the
Omnikey CardMan 4040 driver read and write functions. This can be used
to cause a buffer overflow and possible execution or arbitrary code with
kernel privileges.
The ipv6_getsockopt_sticky function in
net/ipv6/ipv6_sockglue.c is vulnerable to a NULL pointer dereference.
Local users can use this to crash the kernel or to disclose kernel
memory. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-0007
CVE-2007-0006
|
| Created: | February 15, 2007 |
Updated: | November 14, 2007 |
| Description: |
Linux kernel versions from 2.6.9 to 2.6.20 have a denial of service
vulnerability. A remote attacker can cause the key_alloc_serial
function's key serial number collision avoidance code to have a
null dereference, resulting in a crash. |
| Alerts: |
|
Comments (1 posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-4535
CVE-2006-4538
|
| Created: | September 18, 2006 |
Updated: | December 3, 2007 |
| Description: |
Sridhar Samudrala discovered a local denial of service vulnerability
in the handling of SCTP sockets. By opening such a socket with a
special SO_LINGER value, a local attacker could exploit this to crash
the kernel. (CVE-2006-4535)
Kirill Korotaev discovered that the ELF loader on the ia64 and sparc
platforms did not sufficiently verify the memory layout. By attempting
to execute a specially crafted executable, a local user could exploit
this to crash the kernel. (CVE-2006-4538) |
| Alerts: |
|
Comments (none posted)
kernel: denial of service by memory consumption
| Package(s): | kernel |
CVE #(s): | CVE-2006-2936
|
| Created: | July 17, 2006 |
Updated: | November 14, 2007 |
| Description: |
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to
2.6.17, and possibly later versions, allows local users to cause a denial
of service (memory consumption) by writing more data to the serial port
than the driver can handle, which causes the data to be queued. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2007-0772
|
| Created: | February 23, 2007 |
Updated: | November 14, 2007 |
| Description: |
The Linux kernel before 2.6.20.1 allows remote attackers to cause a denial
of service (oops) via a crafted NFSACL 2 ACCESS request that triggers a free
of an incorrect pointer. |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-5757
|
| Created: | November 13, 2006 |
Updated: | November 14, 2007 |
| Description: |
From the MOKB-05-11-2006
advisory: "The ISO9660 filesystem handling code of the Linux
2.6.x kernel fails to properly handle corrupted data structures, leading to
an exploitable denial of service condition. This particular vulnerability
seems to be caused by a race condition and a signedness issue. When
performing a read operation on a corrupted ISO9660 fs stream, the
isofs_get_blocks() function will enter an infinite loop when
__find_get_block_slow() callback from sb_getblk() fails ("due to various
races between file io on the block device and getblk")." |
| Alerts: |
|
Comments (none posted)
kernel: denial of service
| Package(s): | kernel |
CVE #(s): | CVE-2006-2935
CVE-2006-4145
CVE-2006-3745
|
| Created: | September 1, 2006 |
Updated: | July 30, 2008 |
| Description: |
Previous versions of the kernel package are subject to several
vulnerabilities. Certain malformed UDF filesystems can cause the system to
crash (denial of service). Malformed CDROM firmware or USB storage devices
(such as USB keys) could cause system crash (denial of service), and if
they were intentionally malformed, can cause arbitrary code to run with
elevated privileges. In addition, the SCTP protocol is subject to a remote
system crash (denial of service) attack. |
| Alerts: |
|
Comments (none posted)
krb5: multiple vulnerabilities
| Package(s): | krb5 |
CVE #(s): | CVE-2007-0956
CVE-2007-0957
CVE-2007-1216
|
| Created: | April 3, 2007 |
Updated: | March 24, 2008 |
| Description: |
A flaw was found in the username handling of the MIT krb5 telnet daemon
(telnetd). A remote attacker who can access the telnet port of a target
machine could log in as root without requiring a password. MIT krb5 Security Advisory 2007-001
Buffer overflows were found which affect the Kerberos KDC and the kadmin
server daemon. A remote attacker who can access the KDC could exploit this
bug to run arbitrary code with the privileges of the KDC or kadmin server
processes. MIT krb5 Security Advisory
2007-002
A double-free flaw was found in the GSSAPI library used by the kadmin
server daemon. MIT krb5 Security Advisory
2007-003 |
| Alerts: |
|
Comments (none posted)
ktorrent: incorrect validation
| Package(s): | ktorrent |
CVE #(s): | CVE-2007-1384
CVE-2007-1385
CVE-2007-1799
|
| Created: | March 13, 2007 |
Updated: | October 24, 2007 |
| Description: |
Bryan Burns of Juniper Networks discovered that KTorrent did not
correctly validate the destination file paths nor the HAVE statements
sent by torrent peers. A malicious remote peer could send specially
crafted messages to overwrite files or execute arbitrary code with user
privileges. |
| Alerts: |
|
Comments (1 posted)
libgadu: memory alignment bug
| Package(s): | libgadu |
CVE #(s): | CAN-2005-2370
|
| Created: | July 29, 2005 |
Updated: | June 25, 2007 |
| Description: |
Szymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment
error in libgadu (from ekg, console Gadu Gadu client, an instant
messaging program) which is included in gaim, a multi-protocol instant
messaging client, as well. This can not be exploited on the x86
architecture but on others, e.g. on Sparc and lead to a bus error,
in other words a denial of service.
|
| Alerts: |
|
Comments (none posted)
libgtop2: buffer overflow
| Package(s): | libgtop2 |
CVE #(s): | CVE-2007-0235
|
| Created: | January 15, 2007 |
Updated: | August 9, 2007 |
| Description: |
The /proc parsing routines in libgtop are vulnerable to a buffer overflow.
If an attacker can run a process in a specially crafted long
path then trick a user into running gnome-system-monitor,
arbitrary code can be executed with the user's privileges. |
| Alerts: |
|
Comments (none posted)
libmodplug: boundary errors
| Package(s): | libmodplug |
CVE #(s): | CVE-2006-4192
|
| Created: | December 11, 2006 |
Updated: | September 28, 2007 |
| Description: |
Luigi Auriemma has reported various boundary errors in load_it.cpp and
a boundary error in the "CSoundFile::ReadSample()" function in
sndfile.cpp. A remote attacker can entice a user to read crafted modules
or ITP files, which may trigger a buffer overflow resulting in the
execution of arbitrary code with the privileges of the user running the
application. |
| Alerts: |
|
Comments (none posted)
libtiff: buffer overflow
| Package(s): | libtiff |
CVE #(s): | CVE-2006-2193
|
| Created: | June 15, 2006 |
Updated: | September 1, 2008 |
| Description: |
The t2p_write_pdf_string function in libtiff 3.8.2 and earlier is vulnerable
to a buffer overflow. Attackers can use a TIFF file with UTF-8 characters
in the DocumentName tag to overflow a buffer, causing a denial of service,
and possibly the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
libwpd: buffer overflows
| Package(s): | libwpd |
CVE #(s): | CVE-2007-0002
|
| Created: | March 16, 2007 |
Updated: | April 9, 2007 |
| Description: |
iDefense reported several overflow bugs in libwpd. An attacker could
create a carefully crafted Word Perfect file that could cause an
application linked with libwpd, such as OpenOffice, to crash or possibly
execute arbitrary code if the file was opened by a victim. |
| Alerts: |
|
Comments (none posted)
lookup-el: insecure temporary file
| Package(s): | lookup-el |
CVE #(s): | CVE-2007-0237
|
| Created: | March 19, 2007 |
Updated: | December 10, 2007 |
| Description: |
Tatsuya Kinoshita discovered that Lookup, a search interface to electronic
dictionaries on emacsen, creates a temporary file in an insecure fashion
when the ndeb-binary feature is used, which allows a local attacker to
craft a symlink attack to overwrite arbitrary files. |
| Alerts: |
|
Comments (none posted)
mod_jk: stack overflow
