Security

The Honeynet report on Linux life expectancy

Numerous electrons have been expended on the recently-released Honeynet report (PDF) on the life expectancy of systems exposed to the Internet. That report concluded that an unpatched Linux system would last, on the average, for about three months before being compromised, while a Windows system had a life expectancy measured in hours. That is an outcome which is certainly welcome to those who are concerned about the security of Linux systems.

If you actually read the report, however, you'll find some interesting things. The test, it would seem, was set up in a way designed to make the Linux systems as easy as possible to compromise. Among other things:

• The Linux distributions installed were old: Red Hat Linux 7.2, SUSE Linux 6.3, etc. The most current distribution installed was Fedora Core 1, put on two boxes (neither of which was compromised)..

• These systems had a number of services installed; some of those (i.e. SMB) are not necessarily something one would enable on systems directly connected to the net.

• The systems were set up with easily guessed passwords as well.

Of the four Linux systems which were compromised, two of them fell to brute-force password guessing. This episode may be a good lesson in why choosing good passwords is still important, but it has nothing to do with Linux security.

The report authors note that the expected lifetime of Linux systems has increased - an interesting development, given that the net has not exactly become a friendlier place. The authors guess, as usual, that the relative popularity of Windows makes it a more attractive target. They also note, however, that default Linux installations have become more secure over time. Certainly much effort has gone toward that end; it is nice to see that it is having an effect.

Comments (6 posted)

debmake: insecure temp directories

Package(s):	debmake	CVE #(s):	CAN-2004-1179
Created:	December 23, 2004	Updated:	January 5, 2005
Description:	debmake contains a script that can make insecure temporary directories. This can be used by a symlink attack to create and overwrite arbitrary files.
Alerts:	Ubuntu USN-49-1 debmake 2004-12-23

Comments (none posted)

htmlheadline: insecure temporary files

Package(s):	htmlheadline	CVE #(s):	CAN-2004-1181
Created:	January 3, 2005	Updated:	January 5, 2005
Description:	Javier Fernández-Sanguino Peña has discovered multiple insecure uses of temporary files that could lead to overwriting arbitrary files via a symlink attack.
Alerts:	Debian DSA-622-1 htmlheadline 2005-01-03

Comments (none posted)

kdelibs: unwanted email origination

Package(s):	kdelibs	CVE #(s):
Created:	January 5, 2005	Updated:	January 5, 2005
Description:	The Konqueror browser (via kdelibs) contains a vulnerability which can cause it to send email without the user's interaction or consent. See this bug report for details.
Alerts:	Mandrake MDKSA-2004:160 kdelibs 2004-12-29

Comments (none posted)

kernel: 32bit emulation privilege escalation

Package(s):	kernel	CVE #(s):	CAN-2004-1144
Created:	December 23, 2004	Updated:	January 5, 2005
Description:	The 2.4 Linux Kernel on the AMD64 platform has a missing argument checking vulnerability that can allow a local attacker to gain root privileges.
Alerts:	Red Hat RHSA-2004:689-01 kernel 2004-12-23 SuSE SUSE-SA:2004:046 kernel 2004-12-22

Comments (none posted)

LinPopUp: buffer overflow in message reply

Package(s):	linpopup	CVE #(s):	CAN-2004-1282
Created:	January 4, 2005	Updated:	January 10, 2005
Description:	Stephen Dranger discovered that LinPopUp contains a buffer overflow in string.c, triggered when replying to a remote user message. A remote attacker could craft a malicious message that, when replied to using LinPopUp, would exploit the buffer overflow. This would result in the execution of arbitrary code with the privileges of the user running LinPopUp.
Alerts:	Debian DSA-632-1 linpopup 2005-01-10 Gentoo 200501-01 linpopup 2005-01-04

Comments (none posted)

netkit-telnet-ssl: format string vulnerability

Package(s):	netkit-telnet-ssl	CVE #(s):	CAN-2004-0998
Created:	December 23, 2004	Updated:	January 5, 2005
Description:	telnetd-ssl has a format string vulnerability that may be exploitable for executing arbitrary code.
Alerts:	Debian DSA-616-1 netkit-telnet-ssl 2004-12-23

Comments (none posted)

pcal: buffer overflows

Package(s):	pcal	CVE #(s):	CAN-2004-1289
Created:	January 5, 2005	Updated:	January 5, 2005
Description:	Two buffer overflows have been found in the pcal utility; they could be exploited by a hostile calendar file to execute arbitrary code.
Alerts:	Debian DSA-625-1 pcal 2004-01-05

Comments (none posted)

PHProjekt: PHP code execution

Package(s):	phprojekt	CVE #(s):
Created:	January 5, 2005	Updated:	January 5, 2005
Description:	PHProject, prior to version 4.2-r2, has a vulnerability wherein a remote attacker can define a global variable and execute arbitrary PHP code.
Alerts:	Gentoo 200412-27 phprojekt 2004-12-30

Comments (none posted)

shoutcast server: buffer overflow

Package(s):	shoutcast-server	CVE #(s):
Created:	January 5, 2005	Updated:	January 5, 2005
Description:	The shoutcast server contains a remotely exploitable buffer overflow vulnerability; upgrading to version 1.9.5 fixes the problem.
Alerts:	Gentoo 200501-04 shoutcast-server 2005-01-05

Comments (none posted)

tetex: insecure temp files

Package(s):	tetex	CVE #(s):
Created:	December 23, 2004	Updated:	January 5, 2005
Description:	The xdvizilla script can create insecure temporary files and directories, allowing a symbolic link attack that can overwrite arbitrary files.
Alerts:	Ubuntu USN-51-1 tetex-bin 2004-12-23

Comments (none posted)

xpdf: buffer overflow

Package(s):	xpdf	CVE #(s):	CAN-2004-1125
Created:	December 23, 2004	Updated:	April 1, 2005
Description:	xpdf has a potential buffer overflow problem caused by insufficient input validation. A specially crafted PDF file can allow an attacker to execute code with privileges of the xpdf user.
Alerts:	Red Hat RHSA-2005:354-01 tetex 2005-04-01 Red Hat RHSA-2005:018-01 Xpdf 2005-01-12 Gentoo 200501-17 kpdf koffice 2005-01-11 Gentoo 200501-13 pdftohtml 2005-01-10 Fedora FEDORA-2004-585 tetex 2005-01-03 Fedora FEDORA-2004-584 tetex 2005-01-03 Debian DSA-621-1 cupsys 2004-12-31 Mandrake MDKSA-2004:166 tetex 2004-12-29 Mandrake MDKSA-2004:165 koffice 2004-12-29 Mandrake MDKSA-2004:162 gpdf 2004-12-29 Mandrake MDKSA-2004:164 cups 2004-12-29 Mandrake MDKSA-2004:163 kdegraphics 2004-12-29 Mandrake MDKSA-2004:161 xpdf 2004-12-29 Debian DSA-619-1 xpdf 2004-12-30 Gentoo 200412-25 cups 2004-12-28 Gentoo 200412-24 xpdf 2004-12-28 Fedora FEDORA-2004-575 cups 2004-12-22 Fedora FEDORA-2004-574 cups 2004-12-22 Fedora FEDORA-2004-573 xpdf 2004-12-22 Fedora FEDORA-2004-572 xpdf 2004-12-22 Ubuntu USN-50-1 cupsys 2004-12-23 Ubuntu USN-48-1 xpdf, tetex-bin 2004-12-23

Comments (none posted)

Secure programmer: Call components safely (IBM developerWorks)

David A. Wheeler's latest article in the "Secure Programmer" series looks at how to call components from an application in a secure way, on IBM developerWorks. "Application programs typically make calls to other components, such as the underlying operating system, database systems, reusable libraries, Internet services (like DNS), Web services, and so on. This article explains how to prevent attackers from exploiting those calls to other components by discussing the use of only secure components, passing only valid data, making sure the data will be correctly interpreted, checking return values and exceptions, and protecting data as it flows between applications and components."

Comments (4 posted)