LWN.net Weekly Edition for August 29, 2002

Red Hat as the "next Redmond"

By now, many readers are likely to have encountered this eWeek article comparing Red Hat to Microsoft. It includes nice quotes like:

Is this "backlash" real, and should it be?

Red Hat is certainly the Linux distributor with the highest profile and the most evident success. But success does not make a monopoly. To justify charges like this, it is necessary to point out where Red Hat has tried to use its strong market position to force out competitors and extract monopoly prices from its customers. So let's look at a few things from Red Hat's record:

• Red Hat continues to sell a 100% free distribution which anybody can download for free. The "advanced server" product is not available for download, but it remains free software; anybody with the interest and time could reproduce it (including things like Red Hat's kernel patches) and make it available. Red Hat's customers are probably not feeling the squeeze too badly at this point.

• The company employs a large number of high-profile free software developers. These developers collaborate with developers employed by other distributors on a regular basis, and make their work available to everybody, including competitors.

• Development versions of Red Hat's distribution are made available to users (and competitors) through beta releases and the "Rawhide" distribution (though you have to know where to look to find it). It is difficult to be surprised by the contents of a new Red Hat release.

This is not the sort of behavior that one normally expects to see coming out of Redmond.

Anybody wanting to criticize Red Hat need not look too far. It would be nice if the company had supported the Linux Professional Institute rather than creating its own certification program. The company's software patent policy is not to everybody's liking. Red Hat has pushed its users toward bleeding-edge versions of gcc while providing (and requiring) ancient versions of Python. They have blown a couple of attempts at coordinated, multi-distributor security updates with too-early releases. And so on.

Complaints like these, however, show only that Red Hat is not perfect. But every free software user has benefitted greatly from Red Hat's work, and will continue to do so, whether or not they have ever bought anything from Red Hat. Linux users are not suffering under the yoke of some Red Hat monopoly, and it is difficult to see how such a monopoly could develop anytime soon.

Charges that Red Hat is the next Microsoft look more like FUD designed to divide the Linux community against itself than like anything based in fact. Let's keep an eye on Red Hat - all free software companies can benefit from some vigilance to keep them honest. But let's not get taken in by people trying to create fears of a monopolist where none exists.

Comments (11 posted)

BT fails to patent the Web

Back in June, 2000, the company then known as British Telecom exhumed an old patent that, it claimed, covered the hyperlinking used in the World Wide Web - at least, in the United States. Seeing a potential gold mine, the company sent its lawyer squads off to the U.S. to shake down ISPs, all of which, it claimed, were violating this hyperlink patent. Prodigy got the dubious honor of being the first company to be targeted with an infringement suit.

Prodigy, happily, did not choose the "pay them off and hope they go away" response; instead, the company fought the claim in court. And, on August 22, the company was vindicated: U.S. federal Judge Colleen McMahon dismissed the suit outright, ruling that there is no way that a jury could find that infringement had taken place. The company now known as BT has the right to appeal the ruling, but, one way or another, BT looks unlikely to prevail. We can continue to make links without writing checks to BT.

This result is a victory for the Web, but it is a limited victory. The judge has simply determined that this patent, filed in 1980, does not cover the technologies used on the web. Had the patent been written differently, the result could easily have been different. Other patents with claims on fundamental technologies will certainly surface in the coming years, and they will not all be so easily disposed of.

(See also: the text of the judgement, in PDF format).

Comments (none posted)

LWN, credit cards, and subscriptions

First the good news: it appears that most of the issues with credit card donations have been worked out. With luck, we will actually get our hands on the bulk of the money that you all donated to us a month ago, with the rest due to arrive in September. Hopefully, this particular unneeded hassle is just about behind us.

We are, however, still without a credit card account we can use to sell subscriptions, which puts a bit of a damper on our plans. We're still working on that one. If any of you have experience with a merchant bank that is friendly toward online subscription services, we would sure appreciate any pointers you could send our way. We need to get this one solved, or it's all going to fall apart before too long.

We'll keep you posted as things happen; meanwhile, we're trying to keep the news coming as best we can. Thanks, yet again, for your support.

(Note that we didn't get any letters to the editor this week, so there is no letters page this time around).

Comments (6 posted)

Page editor: Jonathan Corbet

Security

Security news

IPv4 mapped address considered harmful

Jun-ichiro itojun Hagino has submitted this draft to IETF urging vendors who ship IPv4/v6 dual stack nodes/routers, to consider "if they have made a secure choice."

At a glance, it appears that at least some of the problems can be addressed with appropriate filtering rules. Given the current deployment of IPv4/v6 dual stacks changing the protocol definition may not be necessary or desirable.

Full Story (comments: none)

Security reports

PHP: vulnerabilities in the mail() function

Wojciech Purczynski reports arbitrary code execution and open-relay script vulnerabilities in PHP 4.x up to 4.2.2.

Full Story (comments: none)

Lynx CRLF injection vulnerability

Ulf Harnhammar reports a CRLF injection vulnerability in Lynx which may be used to break out of restricted realms and communicate with other types of servers than HTTP servers.

The problem is also present in links and elinks.

Comments (none posted)

Information disclosure vulnerabilities fixed in Mantis 0.17.5

Mantis 0.17.5 fixes information disclosure vulnerabilites described in Mantis Advisories 2002-06 and 2002-07.

Comments (none posted)

Abyss 1.0.3 directory traversal and administration vulnerabilities

Auriemma Luigi reports directory traversal and administration vulnerabilites in Abyss 1.0.3. A patch is available to close the administration vulnerability is available from Aprelium Technologies.

Full Story (comments: none)

Arbitrary code execution vulnerability fixed in Achievo 0.8.2

Achievo is a web-based project management tool for business-environments. Versions prior to 0.8.2 are vulnerable to an arbitrary code execution attack.

Full Story (comments: none)

New vulnerabilities

Locally exploitable buffer overflow in linuxconf

Package(s):	linuxconf	CVE #(s):
Created:	August 28, 2002	Updated:	August 28, 2002
Description:	The widely-shipped linuxconf system administration utility has a buffer overflow vulnerability which can be exploited by a local user to obtain a root shell. This exploit only matters, of course, if linuxconf is installed setuid root, but a number of distributions do exactly that. If you have linuxconf installed on systems with untrusted local users, you will probably want to remove the setuid bit until a fix comes out. For more information check out the full advisory from iDEFENSE.
Alerts:	(No alerts in the database for this vulnerability)

Comments (none posted)

Remote arbitrary code execution vulnerability in gaim

Package(s):	gaim	CVE #(s):
Created:	August 28, 2002	Updated:	September 4, 2002
Description:	gaim versions prior to 0.59.1 contained a arbitrary code execution vulnerabilty in the the hyperlink handling code. The 'Manual' browser command passes an untrusted string to the shell without escaping or reliable quoting, permitting an attacker to execute arbitrary commands on the users machine. Unfortunately, Gaim doesn't display the hyperlink before the user clicks on it. Users who use other inbuilt browser commands aren't vulnerable. The problem is fixed in gaim 0.59.1 which is available here. Versions prior to 0.58 also contained a buffer overflow in the Jabber plug-in module which, of course, is still fixed in 0.59.1. "Gaim is an instant messaging client written in GTK and is based on the published TOC messaging protocol from AOL."
Alerts:	Conectiva CLA-2002:521 2002-08-30 Mandrake MDKSA-2002:054 2002-08-01 Gentoo gaim-20020827 2002-08-27 Debian DSA-158-1 2002-08-27

Comments (1 posted)

Mailman 2.0.12 closes cross-site scripting vulnerability

Package(s):	mailman	CVE #(s):	CAN-2002-0855
Created:	August 28, 2002	Updated:	September 4, 2002
Description:	Mailman 2.0.12, released on July 2nd, closed a minor cross-site scripting vulnerabilty and implemented "a guard against some reply loops and 'bot subscription attacks." Upgrading to Mailman 2.0.13, which also fixes some Python 1.5.2 incompatabilities, is recommended.
Alerts:	Conectiva CLA-2002:522 2002-09-03 Red Hat RHSA-2002:176-06 2002-08-22

Comments (none posted)

Buffer overflow vulnerabilities in PostgreSQL

Package(s):	PostgreSQL	CVE #(s):
Created:	August 21, 2002	Updated:	January 27, 2003
Description:	PostgreSQL 7.2.2 has been released in response to a number of buffer overrun vulnerabilities which have been identified recently. "...it should be noted that these vulnerabilities are only critical on 'open' or 'shared' systems, as they require the ability to be able to connect to the database before they can be exploited." Buffer overflow vulnerabilities fixed include those reported by "Sir Mordred The Traitor" in the cash_words, repeat, and lpad and rpad functions.
Alerts:	Yellow Dog YDU-20030127-5 2003-01-27 Red Hat RHSA-2003:001-16 2003-01-14 Red Hat RHSA-2003:010-10 2003-01-14 SuSE SuSE-SA:2002:038 2002-10-21 Trustix 2002-0071 2002-10-17 Mandrake MDKSA-2002:062 2002-10-01 Conectiva CLA-2002:524 2002-09-19 Debian DSA-165-1 2002-09-12 Gentoo postgresql-20020826 2002-08-26

Comments (none posted)

Light remotely-exploitable code vulnerability

Package(s):	epic4-script-light	CVE #(s):
Created:	August 28, 2002	Updated:	August 28, 2002
Description:	J. S. Connell recently discovered that "the IRC script for EPIC4 that I maintain is vulnerable to a fairly easy remote attack." All versions of Light prior to 2.7.30p5 (on the 2.7 branch) or 2.8pre10 (on the 2.8 branch) running under any version of EPIC4 on any platform are vulnerable to a remotely-exploitable bug that can execute nearly-arbitrary code. All Light users are very strongly urged to upgrade to stable release 2.7.30p5 or beta 2.8pre10 immediately.
Alerts:	Debian DSA-156-1 2002-08-22

Comments (none posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	September 30, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Red Hat RHSA-2002:202-33 2003-02-12 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-25 2003-01-21 Mandrake MDKSA-2002:082-1 2002-12-09 Mandrake MDKSA-2002:082 2002-11-25 SCO Group CSSA-2002-045.0 2002-11-14 Trustix 2002-0073 2002-10-17 Gentoo python-20021003 2002-10-03 Conectiva CLA-2002:527 2002-10-01 Debian DSA-159-2 2002-09-09 Debian DSA-159-1 2002-08-28

Comments (none posted)

Kernel update for RedHat 7.3 i810 video

Package(s):	kernel	CVE #(s):
Created:	August 28, 2002	Updated:	September 4, 2002
Description:	Red Hat has issued a kernel update that fixes an "i810 video oops". "Updated kernel packages are now available which fix an oops in the i810 3D kernel code. This kernel update also fixes a difficult to trigger race in the dcache (filesystem cache) code, as well as some potential security holes, although we are not currently aware of any exploits."
Alerts:	Red Hat RHSA-2002:158-09 2002-08-20

Comments (none posted)

Denial of service vulnerability in irssi IRC client

Package(s):	irssi-text	CVE #(s):
Created:	August 28, 2002	Updated:	August 28, 2002
Description:	When a user attempts to join a channel that has an overly long topic description,and a specific string is appended to the topic, the irssi IRC client will crash.
Alerts:	Debian DSA-157-1 2002-08-23

Comments (none posted)

Updated vulnerabilities

Heap corruption vulnerability in at

Package(s):	at at, sudo, xchat	CVE #(s):	CAN-2002-0004
Created:	May 20, 2002	Updated:	May 15, 2003
Description:	The at command has a potentially exploitable heap corruption bug. (First LWN report:  January 17th).
Alerts:	EnGarde ESA-20030515-015 2003-05-15 Yellow Dog YDU-20020127-9 2002-01-27 SuSE SuSE-SA:2002:003 2001-01-16 Slackware sl-1011706104 2002-01-22 Red Hat RHSA-2002:015-15 2002-02-07 Red Hat RHSA-2002:015-13 2002-01-22 Mandrake MDKSA-2002:007 2002-01-18 Debian DSA-102-2 2002-01-18 Debian DSA-102-1 2002-01-16

Comments (none posted)

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	September 30, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	Mandrake MDKSA-2002:050 2002-08-13 Yellow Dog YDU-20020810-3 2002-08-10 Eridani ERISA-2002:035 2002-08-09 Red Hat RHSA-2002:133-13 2002-08-08 SCO Group CSSA-2002-034.0 2002-08-05 Yellow Dog YDU-20020801-2 2002-08-01 Eridani ERISA-2002:028 2002-07-25 Red Hat RHSA-2002:139-10 2002-07-22 EnGarde ESA-20020724-018 2002-07-24 Mandrake MDKSA-2002:043 2002-07-16 Trustix 2002-0061 2002-07-15 Gentoo glibc-20020713 2002-07-13 Conectiva CLA-2002:507 2002-07-11 SuSE SuSE-SA:2002:026 2002-07-09 OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

Numerous vulnerabilities in bugzilla

Package(s):	bugzilla	CVE #(s):	CAN-2002-0804 CAN-2002-0805 CAN-2002-0806 CAN-2002-0807 CAN-2002-0808 CAN-2002-0809 CAN-2002-0810 CAN-2002-0811 CAN-2002-0803
Created:	August 21, 2002	Updated:	August 21, 2002
Description:	The bugzilla bug tracking system has a long list of security problems which can lead to data disclosure, administrative access, and denial of service attacks. The Red Hat advisory (below) gives the full list.
Alerts:	Red Hat RHSA-2002:109-07 2002-08-20

Comments (1 posted)

Potential unauthorized root access vulnerability in dietlibc

Package(s):	dietlibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	December 5, 2002
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library with is used in dietlibc, a libc optimized for small size. The bug could be exploited to gain unauthorized root access to software linking to dietlibc. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	SCO Group CSSA-2002-055.0 2002-12-04 Debian DSA-146-2 2002-08-08 Debian DSA-146-1 2002-08-08

Comments (none posted)

Ethereal buffer overflow, infinite loop and memory management vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2002-0012 CAN-2002-0013 CAN-2002-0353 CAN-2002-0401 CAN-2002-0402 CAN-2002-0403 CAN-2002-0404
Created:	June 12, 2002	Updated:	October 27, 2002
Description:	Ethereal 0.9.4 was released on May 19, 2002 fixing four potential security issues in Ethereal 0.9.3: The SMB dissector could potentially dereference a NULL pointer in two cases. The X11 dissector could potentially overflow a buffer while parsing keysyms. The DNS dissector could go into an infinite loop while reading a malformed packet. The GIOP dissector could potentially allocate large amounts of memory. No known exploits exist "in the wild" at the present time for any of these issues. Ethereal 0.9.2 has several packet handling vulnerabilities that are best avoided by upgrading to 0.9.4. The PROTOS test suite found some flaws in SNMP and LDAP protocols support. Malformed packets could also crash ethereal 0.9.2 due to a ASN.1 zero-length g_malloc problem. The zlib "double free" vulnerability was addressed by the updates for that bug from many distributors.
Alerts:	SCO Group CSSA-2002-037.0 2002-10-24 Conectiva CLA-2002:505 2002-07-04 Yellow Dog YDU-20020606-7 2002-06-06 Red Hat RHSA-2002:088-06 2002-06-04 Eridani ERISA-2002:023 2002-06-06

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

GNU fileutils race condition

Package(s):	fileutils ucdsnmp	CVE #(s):	CAN-2002-0435
Created:	May 20, 2002	Updated:	May 16, 2003
Description:	A race condition in rm may cause the root user to delete the whole filesystem. The problem exists in the version of rm in fileutils 4.1 stable and 4.1.6 development version. A patch is available. (First LWN report: May 2).
Alerts:	Immunix IMNX-2003-7+-010-01 2003-05-16 Red Hat RHSA-2003:015-05 2003-02-12 Trustix 2002-0052 2002-06-06 SuSE SuSE-SA:2002:012 2002-04-08 Mandrake MDKSA-2002:031 2002-05-16 SCO Group CSSA-2002-018.1 2002-05-13

Comments (none posted)

Buffer overflow vulnerability in the Jabber plug-in module for gaim

Package(s):	gaim	CVE #(s):	CAN-2002-0384 CAN-2002-0377
Created:	August 14, 2002	Updated:	September 11, 2002
Description:	gaim versions prior to 0.58 contained a buffer overflow in the Jabber plug-in module. The problem is fixed in gaim 0.59 which is available here. "Gaim is an instant messaging client written in GTK and is based on the published TOC messaging protocol from AOL."
Alerts:	Mandrake MDKSA-2002:054-1 2002-09-05 Yellow Dog YDU-20020810-4 2002-08-10 Red Hat RHSA-2002:107-11 2002-08-05

Comments (none posted)

Potential remote root exploit in glibc

Package(s):	glibc	CVE #(s):	CAN-2002-0391
Created:	August 14, 2002	Updated:	June 29, 2003
Description:	Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library which is used in glibc.This bug could be exploited to gain unauthorized root access to software linking to glibc. Updating as soon as practical is a good idea. Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Debian DSA-333-1 2003-06-27 Conectiva CLA-2002:535 2002-10-29 Trustix 2002-0070 2002-10-17 EnGarde ESA-20021003-021 2002-10-03 Gentoo glibc-20020927 2002-09-27 Gentoo dietlibc-20020927 2002-09-27 Debian DSA-149-2 2002-09-26 Mandrake MDKSA-2002:061 2002-09-23 Gentoo glibc-20020905 2002-09-05 SuSE SuSE-SA:2002:031 2002-08-30 Trustix 2002-0067 2002-08-13 Eridani ERISA-2002:036 2002-08-13 Red Hat RHSA-2002:166-07 2002-08-12 Debian DSA-149-1 2002-08-13

Comments (none posted)

Buffer overflow in groff

Package(s):	groff	CVE #(s):	CAN-2002-0003
Created:	May 20, 2002	Updated:	December 9, 2002
Description:	The groff package has a buffer overflow vulnerability; if it is used with the print system, it is conceivably exploitable remotely.
Alerts:	SCO Group CSSA-2002-057.0 2002-12-06 Gentoo groff-20021019 2002-10-19 Yellow Dog YDU-20020127-11 2002-01-27 Trustix 2002-0020 2002-01-18 Red Hat RHSA-2002:004-06 2002-01-14 Mandrake MDKSA-2002:012 2002-02-07

Comments (none posted)

HylaFAX 4.1.3 fixes multiple vulnerabilities

Package(s):	hylafax	CVE #(s):	CAN-2001-1034
Created:	July 30, 2002	Updated:	October 9, 2002
Description:	The HylaFAX team has released version 4.1.3 fixing denial of service, elevated system privilege and possible remote code execution vulnerabilities. HylaFAX is a mature (est. 1991) enterprise-class open-source software package for sending and receiving facsimiles as well as for sending alpha-numeric pages. It runs on a wide variety of UNIX-like platforms including Linux, BSD (including Mac OS X), SunOS and Solaris, SCO, IRIX, AIX, and HP-UX.
Alerts:	SuSE SuSE-SA:2002:035 2002-10-04 Mandrake MDKSA-2002:055 2002-08-28 Debian DSA-148-1 2002-08-12

Comments (none posted)

UW imapd remotely exploitable buffer overflow

Package(s):	imap	CVE #(s):	CAN-2002-0379
Created:	June 5, 2002	Updated:	December 20, 2002
Description:	UW imapd versions 2000c and prior allow remote authenticated users to execute code via a buffer overflow. A malicious user can craft a request to run commands on the server under their UID and GID. (First LWN report: May 23).
Alerts:	SuSE SuSE-SA:2002:048 2002-12-20 Trustix 2002-0054 2002-06-06 EnGarde ESA-20020607-013 2002-06-07 Yellow Dog YDU-20020606-1 2002-06-06 Red Hat RHSA-2002:092-11 2002-05-22 Mandrake MDKSA-2002:034 2002-05-27 Eridani ERISA-2002:018 2002-05-25 Conectiva CLA-2002:487 2002-05-24 SCO Group CSSA-2002-021.0 2002-05-15

Comments (2 posted)

Inadequate digital certificate verification in Konqueror

Package(s):	Konqueror	CVE #(s):
Created:	August 19, 2002	Updated:	August 21, 2002
Description:	The Konqueror web browser, versions 3.0.2 and prior, does not properly check how digital certificates were signed; the result is that anybody can create fake certificates and use them for "man in the middle" attacks. The problem was fixed in Konqueror 3.0.3. See also: The KDE project's advisory on the problem. LWN's article on the vulnerability and the fundamental insecurity of the digital certificate infrastructure.
Alerts:	Debian DSA-155-1 2002-08-17

Comments (none posted)

XDR vulnerability in krb5

Package(s):	krb5	CVE #(s):	CAN-2002-0391
Created:	August 19, 2002	Updated:	August 20, 2002
Description:	The Kerberos 5 implementation suffers from the same SunRPC XDR buffer overflow problem as many other packages (see the CERT advisory).
Alerts:	Yellow Dog YDU-20020819-1 2002-08-19 Eridani ERISA-2002:038 2002-08-16 Red Hat RHSA-2002:172-07 2002-08-14

Comments (none posted)

Kerberos 5 unauthorized root access to KDC host vulnerability

Package(s):	krb5	CVE #(s):
Created:	August 14, 2002	Updated:	October 29, 2002
Description:	A bug in the Kerberos 5 remote administration service, "kadmind", could be exploited to gain unauthorized root access to a KDC host. It is believed that the attacker needs to be able to authenticate to the kadmin daemon for this attack to be successful. Felix von Leitner, discovered this potential division by zero bug in code derived from the SunRPC library which is used in many places, including the Kerberos 5 administration system. Updating now is recommended. CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream
Alerts:	Gentoo 200210-011 2002-10-28 Conectiva CLA-2002:515 2002-08-07 Debian DSA-143-1 2002-08-05

Comments (none posted)

Buffer overflow in libpng

Package(s):	libpng	CVE #(s):	CAN-2002-0728 CAN-2002-0660
Created:	August 20, 2002	Updated:	August 20, 2002
Description:	Versions of libpng prior to 1.0.14 contain a buffer overflow in the progressive reader when the PNG datastream contains more IDAT data than indicated by the IHDR chunk. Such deliberately malformed datastreams would crash applications that are linked to libpng and that use the progressive reading feature. (From the Red Hat alert).
Alerts:	Yellow Dog YDU-20020819-2 2002-08-19 Eridani ERISA-2002:039 2002-08-19 Red Hat RHSA-2002:151-21 2002-08-14 Mandrake MDKSA-2002:049 2002-08-13 Debian DSA-140-2 2002-08-05 Debian DSA-140-1 2002-08-01

Comments (none posted)

LPRng accepts jobs from any host.

Package(s):	LPRng	CVE #(s):	CAN-2002-0378
Created:	June 12, 2002	Updated:	October 31, 2002
Description:	Matthew Caron pointed out that LPRng's default configuration accepts job submissions from any host. This could be an especially annoying vulnerability for adminstrators with systems exposed to the general public.
Alerts:	SuSE SuSE-SA:2002:040 2002-10-31 Mandrake MDKSA-2002:042 2002-07-04 Red Hat RHSA-2002:089-07 2002-06-09

Comments (none posted)

Mailman 2.0.11 fixes two cross-site scripting vulnerabilities

Package(s):	mailman	CVE #(s):	CAN-2002-0388
Created:	June 5, 2002	Updated:	August 28, 2002
Description:	Barry A. Warsaw announced the release of Mailman 2.0.11 "which fixes two cross-site scripting exploits, one reported by "office" in the admin login page, and another reported by Tristan Roddis in the Pipermail index summaries. It is recommended that all sites upgrade their 2.0.x systems to this version."
Alerts:	Debian DSA-147-2 2002-08-26 Debian DSA-147-1 2002-08-08 Red Hat RHSA-2002:101-06 2002-06-27 Red Hat RHSA-2002:099-04 2002-06-06 Red Hat RHSA-2002:100-03 2002-06-06 Conectiva CLA-2002:489 2002-05-24

Comments (none posted)

Multiple vulnerabilities in mantis

Package(s):	mantis	CVE #(s):
Created:	August 20, 2002	Updated:	September 4, 2002
Description:	The Mantis project has reported a number of bugs in the Mantis bug tracking system, including: Arbitrary code execution as a result of some unitialized variables - beyond the problem reported in the previous Mantis vulnerability. Exposure of private bug information through the modification of cookies. SQL poisoning which could lead to privilege elevation. Bypassing of limitations on who can view specific bugs. Another code execution vulnerability resulting from a different uninitialized variable. Needless to say, upgrading to a version later than 0.17.3 is recommended.
Alerts:	Debian DSA-161-1 2002-09-04 Debian DSA-153-2 2002-08-20

Comments (none posted)

Remote arbitrary code execution vulnerability in mantis

Package(s):	mantis	CVE #(s):
Created:	August 14, 2002	Updated:	August 20, 2002
Description:	Mantis is a php based bug tracking system. Joao Gouveia and the Debian Security Team found multiple insecure uses of uninitialized variables in mantis. When these occasions are exploited, a remote user is able to execute arbitrary code under the webserver user id on the web server hosting the mantis system.
Alerts:	Debian DSA-153-1 2002-08-14

Comments (none posted)

PHP Remote Compromise/DOS Vulnerability

Package(s):	mod_php4	CVE #(s):
Created:	July 22, 2002	Updated:	February 18, 2003
Description:	PHP 4.2.0 and 4.2.1 have an error in the handling of POST requests which can lead to the corruption of memory, and the usual bad consequences. According to this alert, the vulnerability can only be used for denial of service on x86 systems - there is no way to get it to run exploit code. SPARC/Solaris systems are apparently vulnerable to full remote compromise. According to the CERT Advisory, almost every Linux distributor, it seems, ships older (and thus not vulnerable) versions of PHP. Note that, sometimes, systems thought to be safe from remote compromise turn out to be vulnerable to a modified attack, so x86 users should not relax too much. The solution, for those systems with PHP 4.2.0 or 4.2.1 installed, is to upgrade to PHP 4.2.2. For more information see the alert from the discover of the vulnerability, Stefan Esser of e-matters GmbH, or the security advisory from the php team. CERT Advisory: CA-2002-21 Vulnerability in PHP
Alerts:	SuSE SuSE-SA:2003:0009 2003-02-18

Comments (1 posted)

Mozilla XMLHttpRequest file disclosure vulnerability

Package(s):	mozilla	CVE #(s):	CAN-2002-0354
Created:	May 20, 2002	Updated:	October 18, 2002
Description:	This XMLHttpRequest security bug impacts all Mozilla-based browsers. "The bug is found in versions of Mozilla from 0.9.7 to 0.9.9 on various operating system platforms, and in Netscape versions 6.1 and higher." (First LWN report: May 2).
Alerts:	Red Hat RHSA-2002:192-13 2002-10-09 Red Hat RHSA-2002:079-13 2002-05-13 Conectiva CLA-2002:490 2002-05-29

Comments (none posted)

String format bug in pam_ldap logging

Package(s):	nss_ldap	CVE #(s):	CAN-2002-0374
Created:	June 5, 2002	Updated:	October 29, 2002
Description:	The nss_ldap package includes the pam_ldap module for authenticating a user with an LDAP database. Pam_ldap versions prior to 144 have a string format bug in the logging mechanism.
Alerts:	SCO Group CSSA-2002-041.0 2002-10-28 Yellow Dog YDU-20020606-2 2002-06-06 Red Hat RHSA-2002:084-17 2002-05-26 Eridani ERISA-2002:019 2002-05-28

Comments (none posted)

OpenSSL remotely-exploitable buffer overflow vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2002-0655 CAN-2002-0656 CAN-2002-0657 CAN-2002-0659
Created:	July 30, 2002	Updated:	September 24, 2002
Description:	Four remotely-exploitable buffer overflows were found in OpenSSL versions 0.9.7 and 0.9.6d and earlier by a DARPA sponsored security audit. Both client and server applications are affected. The vulnerabilities are described in this security alert from the OpenSSL team. A nasty exploit for one of the vulnerabilities is described in CERT Advisory CA-2002-27 Apache/mod_ssl Worm. Compromise by the Apache/mod_ssl worm indicates that a remote attacker can execute arbitrary code as the apache user on the victim system. It may be possible for an attacker to subsequently leverage a local privilege escalation exploit in order to gain root access to the victim system. Furthermore, the DDoS capabilities included in the Apache/mod_ssl worm allow victim systems to be used as platforms to attack other systems. If you haven't already, applying an update is a very good thing to do today. Mitel Networks has an update available which closes this vulnerabilty for their SME Server software. CERT Advisory CA-2002-23 Multiple Vulnerabilities In OpenSSL
Alerts:	SuSE SuSE-SA:2002:033 2002-09-19 Debian DSA-136-2 2002-09-15 Yellow Dog YDU-20020810-1 2002-08-10 Conectiva CLA-2002:516 2002-08-08 EnGarde ESA-20020807-020 2002-08-07 Mandrake MDKSA-2002:046-1 2002-08-06 Red Hat RHSA-2002:160-21 2002-08-05 Eridani ERISA-2002:034 2002-08-06 Yellow Dog YDU-20020801-3 2002-08-01 SCO Group CSSA-2002-033.0 2002-07-31 Gentoo openssl-20020730 2002-07-30 Eridani ERISA-2002:033 2002-07-30 SuSE SuSE-SA:2002:027 2002-07-30 Mandrake MDKSA-2002:046 2002-07-30 Conectiva CLA-2002:513 2002-07-31 Red Hat RHSA-2002:155-11 2002-07-29 Trustix 2002-0063 2002-07-29 OpenPKG OpenPKG-SA-2002.008 2002-07-30 EnGarde ESA-20020730-019 2002-07-30 Debian DSA-136-1 2002-07-30

Comments (none posted)

Safemode vulnerability in PHP

Package(s):	PHP	CVE #(s):	CAN-2001-1246
Created:	August 20, 2002	Updated:	October 9, 2002
Description:	PHP versions 4.0.5 through 4.1.0 fail to properly cleanse a parameter to the mail() function, allowing arbitrary command execution by local and (possibly) remote attackers.
Alerts:	SuSE SuSE-SA:2002:036 2002-10-04 Debian DSA-168-1 2002-09-18 Mandrake MDKSA-2002:059 2002-09-10 Red Hat RHSA-2002:102-26 2002-08-19

Comments (none posted)

Remotely exploitable vulnerability in pine

Package(s):	pine	CVE #(s):	CAN-2002-0014
Created:	May 20, 2002	Updated:	November 27, 2002
Description:	Pine has an unpleasant vulnerability in URL handling vulnerability which can lead to command execution by remote attackers. (First LWN report:  January 17th). This vulnerability is remotely exploitable; updating is a good idea. Note: If an update isn't yet available for your distribution, setting enable-msg-view-urls to "off" in pine's setup will avoid the vulnerability. (Thanks to Greg Herlein).
Alerts:	SuSE SuSE-SA:2002:046 2002-11-25 Yellow Dog YDU-20020127-8 2002-01-27 Slackware sl-1010936849 2002-01-13 Red Hat RHSA-2002:009-06 2002-01-14 EnGarde ESA-20020114-002 2002-01-14 Conectiva CLA-2002:460 2002-01-31

Comments (none posted)

Sharutils potential privilege escalation using uudecode

Package(s):	sharutils	CVE #(s):	CAN-2002-0178
Created:	May 20, 2002	Updated:	October 30, 2002
Description:	According to the CVE entry, "uudecode, as available in the sharutils package before 4.2.1, does not check whether the filename of the uudecoded file is a pipe or symbolic link, which could allow attackers to overwrite files or execute commands." (First LWN report: May 16).
Alerts:	Gentoo 200210-012 2002-10-30 SCO Group CSSA-2002-040.0 2002-10-28 Mandrake MDKSA-2002:052 2002-08-14 Yellow Dog YDU-20020522-4 2002-05-22 Red Hat RHSA-2002:065-13 2002-05-14 Eridani ERISA-2002:014 2002-05-16

Comments (none posted)

Multiple vulnerabilities fixed in Squid-2.4.STABLE7

Package(s):	squid	CVE #(s):
Created:	July 8, 2002	Updated:	November 15, 2002
Description:	Here is the security advisory for the Squid proxy server reporting several vulnerabilities in versions up to and including 2.4.STABLE7. Several of the bugs are believed to allow remote code execution. The security advisory lists the following changes: Several bugfixes and cleanup of the Gopher client, both to correct some security issues and to make Squid properly render certain Gopher menus. Security fixes in how Squid parses FTP directory listings into HTML FTP data channels are now sanity checked to match the address of the requested FTP server. This to prevent theft or injection of data. See the new ftp_sanitycheck directive if this sanity check is not desired. The MSNT auth helper has been updated to v2.0.3+fixes for buffer overflow security issues found in this helper. A security issue in how Squid forwards proxy authentication credentials has been fixed
Alerts:	SCO Group CSSA-2002-046.0 2002-11-14 Eridani ERISA-2002:031 2002-07-26 Mandrake MDKSA-2002:044 2002-07-17 Trustix 2002-0062 2002-07-15 SuSE SuSE-SA:2002:025 2002-07-09 Conectiva CLA-2002:506 2002-07-05

Comments (none posted)

Tcl/Tk local root vulnerability

Package(s):	tcltk expect	CVE #(s):	CAN-2001-1374 CAN-2001-1375
Created:	August 14, 2002	Updated:	September 24, 2002
Description:	Tcl/Tk searches for its libraries in the current working directory before other directories. A local user could execute arbitrary code by inserting a Trojan horse library in the current working directory. Versions of the expect application prior to 5.32, search for its libraries in /var/tmp before searching in other directories. A local user could gain root privleges by inserting a Trojan horse library in /var/tmp and then getting the root user to run mkpasswd.
Alerts:	Mandrake MDKSA-2002:060 2002-09-23 Eridani ERISA-2002:037 2002-08-14 Red Hat RHSA-2002:148-06 2002-08-12

Comments (none posted)

Malformed NFS packet buffer overflow vulnerability in tcpdump

Package(s):	tcpdump	CVE #(s):	CAN-2002-0380
Created:	June 5, 2002	Updated:	October 9, 2002
Description:	A buffer overflow in tcpdump can be triggered by a bad NFS packet when tracing the network. Unmodified tcpdump versions 3.6.2 and earlier are vulnerable.
Alerts:	Red Hat RHSA-2002:094-16 2002-10-04 Yellow Dog YDU-20020606-3 2002-06-06 Trustix 2002-0055 2002-06-05 SCO Group CSSA-2002-025.0 2002-06-04 Conectiva CLA-2002:491 2002-06-05 Red Hat RHSA-2002:094-08 2002-05-29 Eridani ERISA-2002:020 2002-05-30

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(s):	telnet Telnet netkit-telnet-ssl kerberos telnetd netkit-telnet nkitb/nkitserv/telnetd krb5	CVE #(s):
Created:	May 20, 2002	Updated:	October 5, 2004
Description:	This vulnerability, originally thought to be confined to BSD-derived systems, was first covered in the July 26th Security Summary. It is now known that Linux telnet daemons are vulnerable as well.
Alerts:	Gentoo 200410-03 2004-10-05 Yellow Dog YDU-20010810-2 2001-08-10 Yellow Dog YDU-20010810-1 2001-08-10 SuSE SuSE-SA:2001:029 2001-09-03 Slackware sl-997726350 2001-08-09 Red Hat RHSA-2001:100-02 2001-08-09 Red Hat RHSA-2001:099-09 2002-02-07 Red Hat RHSA-2001:099-06 2001-08-09 Progeny PROGENY-SA-2001-27 2001-08-14 Mandrake MDKSA-2001:093 2001-12-17 Mandrake MDKSA-2001:068 2001-08-13 HP HPSBTL0202-023 2002-02-12 Debian DSA-075-2 2001-08-14 Debian DSA-075-1 2001-08-14 Conectiva CLA-2001:413 2001-08-24 SCO Group CSSA-2001-030.0 2001-08-10

Comments (none posted)

Multiple vulnerabilities in SNMP implementations

Package(s):	ucdsnmp ucd-snmp	CVE #(s):	CAN-2002-0012 CAN-2002-0013
Created:	May 20, 2002	Updated:	September 17, 2002
Description:	Most SNMP implementations out there have a variety of buffer overflow vulnerabilities and should be upgraded at first opportunity. See this CERT advisory for more. (First LWN report: February 14).
Alerts:	Red Hat RHSA-2002:036-26 2002-09-12 Yellow Dog YDU-20020211-1 2002-02-11 Red Hat RHSA-2001:163-20 2002-02-12 Mandrake MDKSA-2002:014 2002-02-15 Debian DSA-111-2 2002-02-28 Debian DSA-111-1 2002-02-14 Conectiva CLA-2002:462 2002-02-14 SCO Group CSSA-2002-004.0 2002-01-22

Comments (none posted)

Local root vulnerability in chfn

Package(s):	util-linux	CVE #(s):	CAN-2002-0638
Created:	July 29, 2002	Updated:	October 30, 2002
Description:	chfn (change finger information) is one of the utilities in the util-linux package. The BindView RAZOR Team has discovered a local root vulnerability in chfn which is described in the Bindview Advisory. Under certain conditions, "a carefully crafted attack sequence can be performed to exploit a complex file locking and modification race present in this utility, and, as a result, alter /etc/passwd to escalate privileges in the system." The conditions include a password file, /etc/passwd, over 4 kilobytes and locating the attacker's account record in any but the last 4 kB chunk of the file. CERT/CC Vulnerability Note VU#405955 util-linux package vulnerable to privilege escalation when "ptmptmp" file is not removed properly when using "chfn" utility
Alerts:	SCO Group CSSA-2002-043.0 2002-10-29 Conectiva CLA-2002:523 2002-09-12 Mandrake MDKSA-2002:047 2002-08-08 Yellow Dog YDU-20020801-4 2002-08-01 Trustix 2002-0064 2002-07-30 Red Hat RHSA-2002:132-14 2002-07-29 Eridani ERISA-2002:032 2002-07-29

Comments (none posted)

webalizer: reverse DNS buffer overflow vulnerability

Package(s):	webalizer	CVE #(s):
Created:	May 20, 2002	Updated:	January 27, 2003
Description:	The cause is a buffer overflow bug. This one sounds nasty. If reverse DNS lookups are enabled in webalizer, "an attacker with control over the victims DNS may spoof responses thus triggering a buffer overflow, potentially leading to a root compromise." Webalizer 2.01-10 "fixes this and a few other buglets that have been discovered in the last month or so". (First LWN report:  April 18th, 2002).
Alerts:	Yellow Dog YDU-20030127-4 2003-01-27 Red Hat RHSA-2002:254-05 2002-12-04 SCO Group CSSA-2002-036.0 2002-10-22 EnGarde ESA-20020423-009 2002-04-23 Conectiva CLA-2002:476 2002-04-26

Comments (none posted)

Webmin/Usermin vulnerabilities

Package(s):	webmin	CVE #(s):
Created:	May 20, 2002	Updated:	January 10, 2003
Description:	Webmin is a web-based interface for system administration for Unix. Webmin has cross-site scripting and session ID spoofing vulnerabilities which are fixed in the May 6, 2002 release of version 0.970. (First LWN report: May 9). This one is scary. The session ID spoofing vulnerability allows the "possibility that arbitrary commands may be executed with root privileges." Upgrading is strongly recommended. At a minimum avoid the "preconditions for a successful exploit" by disabling password timeouts under Webmin->Configuration->Authentication.
Alerts:	SCO Group CSSA-2003-002.0 2003-01-09 Yellow Dog YDU-20020522-7 2002-05-22 Mandrake MDKSA-2002:033 2002-05-21

Comments (1 posted)

Problems with libgtop_daemon

Package(s):	wuftpd libgtop	CVE #(s):
Created:	May 20, 2002	Updated:	May 7, 2003
Description:	The libgtop_daemon package is a GNOME program which makes system information available remotely. LWN reported the remotely exploitable format string and buffer overflow vulnerabilities in that package on December 6th. On November 28th disabling the libgtop_daemon on systems where it is running until an update is available. Many Linux systems do not run libgtop by default, but applying the update is a good idea anyway.
Alerts:	Debian DSA-301-1 2003-05-07 Mandrake MDKSA-2001:094 2001-12-19 Debian DSA-098-1 2002-01-09 Conectiva CLA-2002:448 2002-01-03

Comments (1 posted)

Wwwoffle remote privilege escalation vulnerability

Package(s):	wwwoffle	CVE #(s):	CAN-2002-0818
Created:	August 14, 2002	Updated:	September 30, 2003
Description:	The wwwoffle web proxy incorrectly processes HTTP PUT and POST requests with negative Content Length values. "It is believed that an attacker could exploit this bug to gain remote wwwrun access to the system wwwoffled is running on." CAN-2002-0818
Alerts:	SCO Group CSSA-2002-048.0 2002-11-18 Debian DSA-144-1 2002-08-06 SuSE SuSE-SA:2002:029 2002-08-01

Comments (none posted)

xchat IC server based dns query vulnerability

Package(s):	xchat	CVE #(s):	CAN-2002-0382
Created:	June 5, 2002	Updated:	September 24, 2002
Description:	A malicious IRC server may return a response to a /dns query that executes arbitrary commands with the privileges of the user running XChat. Versions of XChat prior to 1.8.9 are vulnerable.
Alerts:	Conectiva CLA-2002:526 2002-09-23 Mandrake MDKSA-2002:051 2002-08-14 Yellow Dog YDU-20020606-5 2002-06-06 Eridani ERISA-2002:021 2002-06-05 Red Hat RHSA-2002:097-08 2002-06-04

Comments (none posted)

Denial of service vulnerability in xinetd

Package(s):	xinetd	CVE #(s):
Created:	August 14, 2002	Updated:	December 3, 2002
Description:	A file descriptor leak into services started from xinetd may be used, by programs it stats, to crash xinetd. Xinetd is a replacement for the BSD derived inetd.
Alerts:	Red Hat RHSA-2002:196-19 2002-12-02 Red Hat RHSA-2002:196-09 2002-10-14 Mandrake MDKSA-2002:053 2002-08-26 Gentoo xinetd-20020814 2002-08-14 Debian DSA-151-1 2002-08-13

Comments (none posted)

Resources

Linux Security Week and Advisory Watch

The August 26th Linux Security Week and August 24th Linux Advisory Watch newsletters from LinuxSecurity.com are available.

Comments (none posted)

Metis 1.4 released

Sacha Faust announces the release of Metis 1.4. "This is a tool I wrote to collect information from web servers." Metis was written for the Open Source Security Testing Methodology (OSSTM). .

Full Story (comments: none)

Internet anonymity for Linux newbies (Register)

The register has published a tutorial for newbies on how to secure your home system. " For most home PC users, fairly secure is perfectly adequate, and that's what we'll be concentrating on below. In a week or two I'll get into details for power users, but for now I'm going to concentrate on a particular presumed reader: a home user who's fairly new to the Linux desktop, who's using a packaged distro, and who's not intimately familiar with PC security -- a 'recovering Windows user', let's say."

Comments (none posted)

Events

ToorCon Computer Security Conference 2002 Pre-registration Closing

ToorCon 2002 has "recently released our finalized speaker lineup and it looks like it'll be one of ToorCon's best years yet. Pre-registration and RSVP will be closing shortly, so register today!"

ToorCon 2002 will be held September 27-29th in San Diego, CA, USA.

Full Story (comments: none)

Upcoming Security Events

Date	Event	Location
August 29 - 30, 2002	Workshop on Information Security Applications(WISA 2002)	Jeju Island, Korea
September 19 - 20, 2002	SEcurity of Communications on the Internet 2002(SECI'02)	Tunis, Tunisia
September 23 - 26, 2002	New Security Paradigms Workshop 2002	(The Chamberlain Hotel)Hampton, Virginia, USA
September 23 - 25, 2002	University of Idaho Workshop on Computer Forensics	(University of Idaho)Moscow, Idaho, USA
September 26 - 27, 2002	HiverCon 2002	(Hilton Hotel)Dublin, Ireland
September 27 - 29, 2002	ToorCon 2002	(San Diego Concourse)San Diego, CA, USA
October 16 - 18, 2002	Recent Advances in Intrusion Detection 2002(RAID 2002)	Zurich, Switzerland

For additional security-related events, included training courses (which we don't list above) and events further in the future, check out Security Focus' calendar, one of the primary resources we use for building the above list. To submit an event directly to us, please send a plain-text message to lwn@lwn.net.

Comments (none posted)

Page editor: Dennis Tenney

Kernel development

Release status

Kernel release status

The current development kernel is 2.5.32, released by Linus on August 27. It includes, of course, the IDE code replacement (see last week's LWN Front and Kernel pages). In this (large) patch you'll also find the asynchronous I/O core (covered in the August 1 LWN Kernel page), a bunch more device model work, IA-64 and PPC64 updates, the beginning of the NFSv4 merge, a bunch of input layer changes, Ingo Molnar's thread performance work, and an incredible number of other fixes and updates. The long-format changelog is also available.

Linus's current BitKeeper tree, which will become 2.5.33, contains a number of memory management performance fixes from Andrew Morton, some partition and IDE work by Alexander Viro, a set of network driver improvements, and a big pile of typo and designated initializer fixes.

The current 2.5 status summary from Guillaume Boissiere is dated August 28.

The current stable kernel is 2.4.19; Marcelo has released no 2.4.20 prepatches over the last week.

The current prepatch from Alan Cox is 2.4.20-pre4-ac2. The -ac series is now the staging area for ongoing IDE work which, by most accounts, is going well.

Comments (2 posted)

Kernel development news

The 2.5 device model

A constant feature of development kernel summaries is "device model work." Perhaps it's time to take a look at what the device model actually is, and where it's going.

The device model effort has its roots in the 2001 Kernel Summit. It had become clear, at that point, that support of advanced power management would require a more structured approach to the management of devices in the Linux kernel. There has traditionally been no centralized registry of devices in the kernel - no way to just ask the system what devices were connected to it. Power management needs not only the answer to that question, but also some idea of how all the devices are plugged together. It doesn't do to shut down a SCSI controller before stopping all of the peripherals connected to that controller, for example.

So the device model work, done mainly by Patrick Mochel, started by adapting the existing PCI device scheme to represent a full system. At the center of the scheme is struct device, which, of course, represents a single device in the system. This structure contains quite a few fields, including no less than six different list heads; some of these fields will be examined shortly.

One type of device, of course, is a bus. There is a device structure for each bus, along with a bus_type structure for each type of