Security
Brief items
Postfix 2.0.0
[This article was contributed by LWN reader Tom Owen]
Wietse Venema released Postfix 2.0.0 on December 23. Originally created as the IBM "Secure Mailer" and released under GPL at the beginning of 1998, Postfix is a drop-in sendmail replacement designed from the ground up to be secure. Venema has a long history in the secure software area; his. TCP Wrappers package has been going into Linux distributions unchanged for five years now. So a new major release of one of his packages is worth a look.The Postfix 2.0.0 release notes list dozens of new features, changes and fixes, mostly consolidations of patch releases accumulated over the last year. The reason for the major version change seems to be to flag some of the changes listed as incompatibilities with 1.1.0. Few of these will cause problems at most sites but virtual domain admins and those receiving mail for users listed in a table (i.e. not in the local /etc/passwd file) will need to read the upgrade notes with special care.
Postfix's strong spam control gets a substantial upgrade with extra control over DNS checks and a rewrite of the relay blacklist (RBL) handling code with new configuration directives. Content filtering based on regular expression matching in headers and body is improved with finer granularity, faster processing, better handling for MIME and other attachments, a more expressive regular expression language and more options to deal with the messages that match.
The many improvements to MIME handling allow better control over the processing of messages with attachments. Meanwhile, only mail mavens and frustrated crackers will care about the subtle semantic changes in fancier address formats and headers. Sysadmins will mostly be pleased with performance improvements and better logging for Postcript and RBL actions. Features like MacOS X support and the better LDAP client have a narrower appeal.
And of course there are occasional items on the way out:
Postfix administrators will be pleased by 2.0.0. They've seen most of it already in the patch releases, and for such a central piece of infrastructure, that's the way it should be. Postfix is still the same straightforward, rather easy to configure mail server, with excellent compatibility as a sendmail replacement and out of the box security.
And that may be the most important lesson from Postfix: not the secure, flexible, multi-process, untrusting design, not the reduction in the mailer monoculture, not even the lucid and closely documented code. Just that security and ease of use are, sometimes, compatible.
Secure Programming for Linux and Unix HOWTO updated
David A. Wheeler has announced the availability of an updated version of his "Secure Programming for Linux and Unix HOWTO." "...this version adds new text on handling tmp files where there are tmp cleaners running (true on most real systems - this causes particular problems with mktemp(1)), notes on avoiding buffer overflow in FD_SET/FD_CLR(), and a long discussion on a new attack against web-based systems: session fixation. I also added text about protecting secrets in memory."
New vulnerabilities
bugzilla - cross site scripting
| Package(s): | bugzilla | CVE #(s): | |||||
| Created: | December 30, 2002 | Updated: | January 1, 2003 | ||||
| Description: | A cross site scripting vulnerability has been reported for Bugzilla, a
web-based bug tracking system. Bugzilla does not properly sanitize
any input submitted by users. As a result, it is possible for a
remote attacker to create a malicious link containing script code
which will be executed in the browser of a legitimate user, in the
context of the website running Bugzilla. This issue may be exploited
to steal cookie-based authentication credentials from legitimate users
of the website running the vulnerable software.
This vulnerability only affects users who have the 'quips' feature enabled and who upgraded from version 2.10. | ||||||
| Alerts: |
| ||||||
cups - multiple vulnerabilities
| Package(s): | cups | CVE #(s): | CAN-2002-1366 CAN-2002-1367 CAN-2002-1368 CAN-2002-1369 CAN-2002-1371 CAN-2002-1372 CAN-2002-1383 | ||||||||||||||||||||||||||||||||
| Created: | December 30, 2002 | Updated: | February 18, 2003 | ||||||||||||||||||||||||||||||||
| Description: | Exploitation of multiple CUPS vulnerabilities allow local and remote attackers in the worst of the scenarios to gain root privileges. See the iDEFENSE advisory for more information. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
cyrus-imapd - Remote command execution vulnerability
| Package(s): | cyrus-imapd | CVE #(s): | |||||||||
| Created: | December 29, 2002 | Updated: | January 1, 2003 | ||||||||
| Description: | The Cyrus IMAP Server is an e-mail application that uses the Internet
Message Access Protocol (IMAP). It allows an user to perform certain mail
functions on a remote server rather than on a local computer.
Timo Sirainen discovered[1] a remotely exploitable pre-login buffer overflow in cyrus imapd. The problem resides in the way memory is managed (an integer overflow can cause less memory than needed to be allocated). This vulnerability[2] may be exploited prior to authentication to the IMAP server and could allow a remote attacker to read other users' mail and to execute arbitrary code with the privileges of the user running the IMAP server (Conectiva Linux has a special unprivileged user called 'cyrus' responsible for that).
REFERENCES:
1.http://online.securityfocus.com/archive/1/301864 | ||||||||||
| Alerts: |
| ||||||||||
cyrus-sasl - buffer overflows
| Package(s): | cyrus-sasl | CVE #(s): | CAN-2002-1347 | ||||||||
| Created: | December 28, 2002 | Updated: | January 7, 2003 | ||||||||
| Description: | "Insufficient buffer length checking in user name canonicalization
may allow attacker to execute arbitrary code on servers using Cyrus
SASL library. Client side library also has the bug but since the user
name is asked from the local user, there's probably not many
applications that care about it, except maybe webmails and the like.
This overflow only happens if default realm is set."
"LDAP authentication with saslauthd doesn't allocate enough memory when it needs to escape characters '*', '(', ')', '\' and '\0' in username and realm. This should be easily exploited with glibc's malloc implementation." "Log writer might not have allocated memory for the trailing \0 in message. Probably hard to exploit, although you can affect the logging data with at least anonymous authentication." Read the full advisory at http://marc.theaimsgroup.com/?l=bugtraq&m=103946297703402&w=2 | ||||||||||
| Alerts: |
| ||||||||||
Helix Server - buffer overflows
| Package(s): | Helix Universal Server | CVE #(s): | |
| Created: | January 1, 2003 | Updated: | January 1, 2003 |
| Description: | According to this NGSSoftware advisory, the Helix Universal Server (version 9.0 and earlier) has several buffer overflow vulnerabilities. A patch has been made available by RealNetworks. | ||
| Alerts: | (No alerts in the database for this vulnerability) | ||
libpng, libpng3: buffer overflow
| Package(s): | libpng, libpng3 | CVE #(s): | CAN-2002-1363 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 19, 2002 | Updated: | July 14, 2004 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
KDE - command parameter quoting problems
| Package(s): | kde | CVE #(s): | CAN-2002-1393 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 24, 2002 | Updated: | February 21, 2003 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | In some instances, KDE (versions 2 and 3) fails to properly quote parameters of instructions
passed to a command shell for execution.
These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be provided remotely to a victim in an e-mail, a webpage or files on a network filesystem or other untrusted source. By carefully crafting such data an attacker might be able to execute arbitary commands on a vulnerable sytem using the victim's account and privileges. See this announcement for more details. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
typespeed: buffer overflow
| Package(s): | typespeed | CVE #(s): | |||||||||
| Created: | January 1, 2003 | Updated: | June 17, 2003 | ||||||||
| Description: | A problem has been discovered in the typespeed, a game that lets you measure your typematic speed. By overflowing a buffer a local attacker could execute arbitrary commands under the group id games. | ||||||||||
| Alerts: |
| ||||||||||
Resources
PHRACK #60 released
Issue number 60 of the PHRACK magazine is now available. It looks at kernel stack smashing, IOS exploits, patching static kernels, integer overflows, and several other topics.Linux Security Week
The LinuxSecurity.com Linux Security Week Newsletter for December 30 is available.
Page editor: Jonathan Corbet
Next page:
Kernel development>>