Security
Brief items
The Ptech Incident
[Editor's note: this article was contributed by LWN reader Tom Owen.]Federal and state agents who visited Quincy, Mass. software house Ptech last week were probably mostly looking for financial links to al-Qaeda. So perhaps it's just an unfortunate co-incidence that by Wednesday morning the Ptech customer list had been removed from their web site. It was still cached at Google, though, and the names on it are a testament to the lure of the product and efficiency of the Ptech sales team. How happy the US Air Force, NATO, Mitre and the FBI are to discover that their knowledge management software comes from a firm under such detailed investigation has yet to emerge, but officials for the White House and the US Attorney in Boston have certainly been quick to say that the software presents no obvious risk. Which raises the question: how do they know?
Sensitive government and defense agencies probably won't load their operational information on to a knowledge management system without some sort of scrutiny of the software. There's no need for an Open Source license -- any client with sufficient clout can cut a deal for source access. The trouble is that a $1000 per day security consultant, faced with half a million lines of Visual Basic and a non-disclosure agreement, is going to need extraordinary powers to find twenty lines buried in, say, user management, which phone home with a document index. Source access or not, it still comes down to trust, of the company and each individual developer.
A true open source project is a very different matter. It's not possible to fool the whole developer community -- a secret like that just won't keep. It might be possible to corrupt individuals, and it's certainly possible for terrorists to join and contribute code. But the bent code is there for all to see, and the folks reading it are developers intimately familiar with the purpose and structure of the system. A trapdoor or a leak is still possible, but it's much more likely to be spotted.
Wired quotes Michael Wendy of the Initiative for Software Choice:
It's not bad for a first try, but the ISC will have to do better than that.
Understanding the Windows EAL4 rating
Microsoft has made a fair amount of noise about the "Common Criteria EAL4" rating recently awarded to Windows 2000. For those of you who are curious about what that actually means, this article by Jonathan Shapiro is well worth reading.
In other words, this certification does not mean a whole lot. People who are interested in the security of their systems still need to look at the systems themselves and draw their own conclusions; there is no magic rating that will take the brain work out of the process.
New vulnerabilities
Canna server: exploitable buffer overrun
| Package(s): | canna | CVE #(s): | CAN-2002-1158 CAN-2002-1159 | ||||||||||||||||
| Created: | December 10, 2002 | Updated: | October 1, 2003 | ||||||||||||||||
| Description: | Canna is a kana-kanji conversion server which is necessary for Japanese
language character input.
A buffer overflow bug in the Canna server up to and including version 3.5b2 allows a local user to gain the privileges of the user 'bin' which could lead to further exploits. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1158 to this issue. A lack of validation of requests has been found that affects Canna version 3.6 and earlier. A malicious remote user could exploit this vulnerability to leak information, or cause a denial of service attack. (CAN-2002-1159) | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
OpenLDAP2: remote command execution
| Package(s): | OpenLDAP2 | CVE #(s): | CAN-2002-1378 CAN-2002-1379 | ||||||||||||||||||||||||||||
| Created: | December 6, 2002 | Updated: | February 21, 2003 | ||||||||||||||||||||||||||||
| Description: | OpenLDAP is the Open Source implementation of the Lightweight Directory
Access Protocol (LDAP) and is used in network environments for distributing
certain information such as X.509 certificates or login information.
The SuSE Security Team reviewed critical parts of that package and found several buffer overflows and other bugs remote attackers could exploit to gain access on systems running vulnerable LDAP servers. In addition to these bugs, various local exploitable bugs within the OpenLDAP2 libraries (openldap2-devel package) have been fixed. Since there is no workaround possible except shutting down the LDAP server, an update is strongly recommended. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
smb2www: arbitrary command execution
| Package(s): | smb2www | CVE #(s): | |||||
| Created: | December 5, 2002 | Updated: | December 11, 2002 | ||||
| Description: | Robert Luberda found a security problem in smb2www, a Windows Network client that is accessible through a web browser. This could lead a remote attacker to execute arbitrary programs under the user id www-data on the host where smb2www is running. | ||||||
| Alerts: |
| ||||||
wget:directory traversal bug
| Package(s): | wget | CVE #(s): | CAN-2002-1344 | ||||||||||||||||||||||||||||||||||||
| Created: | December 10, 2002 | Updated: | October 1, 2003 | ||||||||||||||||||||||||||||||||||||
| Description: | Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious
FTP server to create or overwrite files anywhere on the local file system.
FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3). If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shosts, etc.) that can then be used for later attacks against the client machine. See also this Bugtraq article from 1997. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
Resources
Sourcefire announces Intrusion Management System
SourceFire has sent out a press release describing its new "Intrusion Management System." "Sourcefire IMS provides users with advanced data management and event correlation capabilities, in addition to its industry leading intrusion detection and enhanced scalability."
/etc/inittab - The Most Overlooked Cracker Haven
The December 5 "Linux Security: Tips, Tricks, and Hackery" newsletter looks at /etc/inittab as a hiding place for cracker back doors.Linux Advisory Watch
The LinuxSecurity.com Linux Advisory Watch newsletter for December 6 is available.
Page editor: Jonathan Corbet
Next page:
Kernel development>>