Security
Brief items
MadWifi: Much ado about nothing?
A recent article reporting a remotely exploitable bug 'in Linux' has raised the ire of some in the Linux community for a few reasons, but inaccuracy probably tops the list. The timeliness of the report is also in question as the bug, in an out-of-tree Linux driver, was fixed four months ago in December 2006. When the usual suspects, Slashdot and digg, linked to the article, it became a rather visible 'failing' of Linux. The truth is much less damning; there are some interesting wrinkles, though, which are worth a look.The bug was found by French security researchers when fuzzing the MadWifi driver for Atheros Wireless LAN chipsets and was presented at Black Hat Europe at the end of March. The techniques used are similar to those used by David Maynor and johnny cache to find the MacOS wireless flaws that they 'demonstrated' at Black Hat USA last year. The only new information in the article (and others like it) was the presentation given by Laurent Butti; the bug had already been reported as CVE-2006-6332 and fixed in version 0.9.2.1 of MadWifi.
MadWifi (which is an abbreviation for Multiband Atheros Driver for Wireless Fidelity according to the project's website) is a widely used driver for wireless cards, but it is not part of the Linux kernel and is unlikely to ever be. The driver relies on a 'Hardware Abstraction Layer' (HAL) that is only provided in binary form. The belief is that because the Atheros chips can be instructed to do various things that regulatory agencies (the FCC in the US for example) oppose, the code for doing that must be closed source. Rather than make the whole driver closed source, separating it into two pieces was done specifically to avoid the closed source portion being considered a derivative work of the kernel.
Because of the non-firmware binary blob, the driver will not be included in some 'free' distributions and users will need to find it from other non-official or less supported repositories. This could lead some users to not update their driver because the package management system did not alert them to the change. At some level, any publicity that makes more people aware of the problem is probably a good thing.
The bug itself is a fairly run-of-the-mill buffer overflow that is fixed in this changeset. While the bug was rather straightforward, its result is catastrophically bad. An attacker could run arbitrary code as root on a vulnerable machine that has the driver loaded; being connected to a wireless network is not required. This is the kind of 'drive by' laptop takeover that got so much attention when Maynor and cache announced their proof of concept exploit. It is a truly horrifying scenario for anyone worried about laptop or other wireless device security.
At the time of the original release of information about the bug, the MadWifi project and various distributions made announcements about it. But, perhaps because of the impending Christmas holiday or because the seriousness of the bug was not recognized, there was very little press about it at that time. Though LWN did publish the announcements, one could certainly argue that a more detailed look was in order. Coupled with the severity of any exploit, the lack of coverage magnified the importance of the current articles. Had there already been a round of articles describing the flaw back in December (or even January), it is likely that the 'new' reports would have been ignored.
That does not, of course, excuse the inaccuracies in the article. MadWifi is clearly not 'in' Linux though it will affect some Linux users. The lack of earlier press coverage and linking from aggregation sites served to elevate the visibility of the bug, which may have helped some users who missed it earlier, but overall just fed the 'Linux is buggy' hype machine. The headline and the way it was presented take an interesting event, the presentation of some security research, and try to turn it into an indictment of overall Linux security. This is the kind of article that tends to make Linux advocates rather cynical about the 'mainstream' technical press.
New vulnerabilities
dokuwiki: cross-site scripting vulnerability
| Package(s): | dokuwiki | CVE #(s): | CVE-2006-6965 | ||||
| Created: | April 12, 2007 | Updated: | April 18, 2007 | ||||
| Description: | DokuWiki has a cross-site scripting vulnerability that is caused by insufficient user input sanitization of the GET variable 'media' in the fetch.php file. If a user can be tricked into clicking on a specially crafted link, CRLF characters can be injected into the variable allowing arbitrary scripts to be executed with the user's permissions. | ||||||
| Alerts: |
| ||||||
dovecot: information exposure
| Package(s): | dovecot | CVE #(s): | |||||
| Created: | April 18, 2007 | Updated: | April 18, 2007 | ||||
| Description: | Dovecot is vulnerable to a trivial information exposure in which files outside the user's mail directory could be opened if the zlib plugin is used. | ||||||
| Alerts: |
| ||||||
file: denial of service
| Package(s): | file | CVE #(s): | CVE-2007-2026 | ||||||||||||||||
| Created: | April 18, 2007 | Updated: | May 25, 2007 | ||||||||||||||||
| Description: | The gnu regular expression code in file 4.20 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted document with a large number of line feed characters, which is not well handled by OS/2 REXX regular expressions that use wildcards, as originally reported for AMaViS. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
freeradius: memory leak
| Package(s): | freeradius | CVE #(s): | CVE-2007-2028 | ||||||||||||||||
| Created: | April 17, 2007 | Updated: | May 15, 2007 | ||||||||||||||||
| Description: | A memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2007-1357 | ||||||||||||||||||||||||||||
| Created: | April 16, 2007 | Updated: | November 14, 2007 | ||||||||||||||||||||||||||||
| Description: | The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and possibly 2.4.x, allows remote attackers to cause a denial of service (crash) via an AppleTalk frame that is shorter than the specified length, which triggers a BUG_ON call when an attempt is made to perform a checksum. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
lighttpd: denial of service
| Package(s): | lighttpd | CVE #(s): | CVE-2007-1869 CVE-2007-1870 | ||||||||||||||||||||
| Created: | April 18, 2007 | Updated: | June 11, 2007 | ||||||||||||||||||||
| Description: | lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of
service (cpu and resource consumption) by disconnecting while lighttpd is
parsing CRLF sequences, which triggers an infinite loop and file descriptor
consumption. (CVE-2007-1869)
lighttpd before 1.4.14 allows attackers to cause a denial of service (crash) via a request to a file whose mtime is 0, which results in a NULL pointer dereference. (CVE-2007-1870) | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
madwifi: multiple vulnerabilities
| Package(s): | madwifi | CVE #(s): | CVE-2005-4835 CVE-2006-7177 CVE-2006-7178 CVE-2006-7179 CVE-2006-7180 | ||||||||||||
| Created: | April 12, 2007 | Updated: | April 23, 2007 | ||||||||||||
| Description: | Madwifi versions below 0.9.3 have a number of vulnerabilities including: a denial of service vulnerability in the ath_rate_sample function, a denial of service vulnerability related to Ad-Hoc mode, a denial of service caused by improper handling of an AUTH frame by an IBSS node, a denial of service cause by improper handling of Channel Switch Announcement Information Elements, and an information disclosure vulnerability caused by the sending of unencrypted packets before WPA authentication. | ||||||||||||||
| Alerts: |
| ||||||||||||||
mod_perl: denial of service
| Package(s): | mod_perl | CVE #(s): | CVE-2007-1349 | ||||||||||||||||||||||||||||||||||||||||
| Created: | April 12, 2007 | Updated: | July 18, 2007 | ||||||||||||||||||||||||||||||||||||||||
| Description: | Apache mod_perl versions 1.30 and below have a vulnerability in PerlRun.pm and RegistryCooker.pm. PATH_INFO is not properly escaped before use in a regular expression, allowing remote attackers to cause a denial of service via a specially crafted URI. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
php: multiple vulnerabilities
| Package(s): | php | CVE #(s): | CVE-2007-1001 CVE-2007-1285 CVE-2007-1718 CVE-2007-1583 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 16, 2007 | Updated: | December 4, 2007 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | A denial of service flaw was found in the way PHP processed a deeply nested
array. A remote attacker could cause the PHP interpreter to crash by
submitting an input variable with a deeply nested array. (CVE-2007-1285)
A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection. (CVE-2007-1583) A flaw was discovered in the way PHP's mail() function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients. (CVE-2007-1718) A heap based buffer overflow flaw was discovered in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution. (CVE-2007-1001) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
vixie-cron: weak permissions may cause errors
| Package(s): | vixie-cron | CVE #(s): | CVE-2007-1856 | ||||||||||||
| Created: | April 17, 2007 | Updated: | December 4, 2007 | ||||||||||||
| Description: | During an internal audit, Raphael Marichez of the Gentoo Linux Security Team found that Vixie Cron has weak permissions set on Gentoo, allowing for a local user to create hard links to system and users cron files, while a st_nlink check in database.c will generate a superfluous error. | ||||||||||||||
| Alerts: |
| ||||||||||||||
Page editor: Jonathan Corbet
Next page:
Kernel development>>