Security
Brief items
Giving Root to the Web
[This article was contributed by Tom Owen]
These days, pretty much any box with an Ethernet port has a web administration interface running alongside the command line and that iffy SNMP agent. Even if you can ignore horrors like the admin password going through an HTML form and no support for HTTPS, it's unlikely that the web server running in, say, a cheap switch will have been better tested or reviewed than miniserv.pl, the perl HTTP server which runs at the core of Webmin.Webmin is a popular administration package which provides form-based access to configuration files for many standard and optional components. Administrators use a browser and the Webmin forms to manage users DNS zone changes, driver modules and many other tasks. All the applications are perl modules, running via CGI under the miniserv.pl web server.
The recent vulnerability report from the LAC security lab suggests that miniserv.pl can be fooled by control characters in a web authentication string. It apparently needs the "Enable Password Timeout" option to be set in Webmin, but that's an option that many cautious admins will choose anyway. The inevitable exploit makes it concrete and easy. It's nicely set up to get a script kiddy going: a few lines of perl run netcat to fake a single HTTP GET. It's all simple and transparent except for an artfully crafted base64 string on the Authorization: header. The control codes there create a specific session for the default user "admin". A cookie containing the session ID on a local browser is then all the attacker needs to use all the Webmin modules. It's complete server root access with full havoc potential in a very few steps.
A search for "webmin" on Bugtraq shows a trickle of problems, mostly in the last couple of years, ranging from local privilege escalation to full remote admin access. Cross site scripting and other old favorites show up with oddities like leftover environment variables. In fact the the system seems more secure than many, but the consequences of failure are much worse than for ordinary web applications: instead of one function or application being compromised, it's the whole server. This situation raises a question: Can it ever be responsible to put a root function on to a web protocol?
This isn't particularly a Webmin issue. The miniserve.pl fault was promptly fixed in 1.070 but all of those cheap printers, switches and wireless access points are still booting the firmware they shipped with. We can be sure that this is a case where absence of reports doesn't mean the holes aren't there. Despite the potential for trouble, no reduction in web-based administration, even over the public internet, is going to happen soon. It probably won't even begin to happen until someone gets sued for negligence -- it's just too useful, and for remotely-hosted servers it's pretty much essential.
Just looking at Webmin, the value stands out:
- So many people hate text mode configuration
- Even those who love it acknowledge that systems like Bind are ticklish to get right by hand: A display like this is not lovely, but it can save you from forgetting the reverse addresses.
- Checklist purchasers need it: it's a good, demonstrable counterargument to "Linux is impossible to administer" charges.
- Turn off unused web administrator systems (and SNMP too.) Scan to make sure they stay off.
- When it's configurable, standardise on a web administration port to block unconditionally at the firewall. Caldera, for example, uses port 1000.
- Printers and switches don't need Internet access. At the firewall, block the IP range they're in.
- In simple LANs they don't even need a default gateway. 0.0.0.0 is fine.
- Webmin and others offer IP-based access control. Turn it on and only include administrators' machines.
- In the longer term, get that VPN on-line.
New vulnerabilities
apcupsd - remote root vulnerability and buffer overflows
| Package(s): | apcupsd | CVE #(s): | CAN-2003-0098 CAN-2003-0099 | ||||||||||||||||||||
| Created: | February 24, 2003 | Updated: | April 3, 2003 | ||||||||||||||||||||
| Description: | From the MandrakeSoft
advisory:
A remote root vulnerability in slave setups and some buffer overflows in the network information server code were discovered by the apcupsd developers. They have been fixed in the latest unstable version, 3.10.5 which contains additional enhancements like USB support, and the latest stable version, 3.8.6. There are a few changes that need to be noted, such as the port has changed from port 7000 to post 3551 for NIS, and the new config only allows access from the localhost. Users may need to modify their configuration files appropriately, depending upon their configuration. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
BitchX - denial of service
| Package(s): | BitchX | CVE #(s): | |||||||||||||||||
| Created: | February 20, 2003 | Updated: | May 26, 2003 | ||||||||||||||||
| Description: | From this Bugtraq posting:
A denial of service vulnerability exists in BitchX. Sending a malformed RPL_NAMREPLY numeric 353 causes BitchX to segfault. This problem was reported to panasync@efnet#bitchx on Jan 30 2003, as of this writing we are unaware of any patches or workarounds provided by panasync and or any members of #bitchx | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
shadow-utils: useradd tool creates mail spools with incorrect permissions
| Package(s): | shadow-utils | CVE #(s): | CAN-2002-1509 | ||||||||
| Created: | February 20, 2003 | Updated: | February 27, 2003 | ||||||||
| Description: | The shadow-utils package includes programs for converting UNIX password
files to the shadow password format, plus programs for managing user and
group accounts. One of these programs is useradd, which is used to create
or update new user information.
When creating a user account, the version of useradd included in Red Hat Linux 7.2, 7.3, and 8.0 creates a mailbox file with incorrectly-set group ownership. Instead of setting the file's group ownership to the 'mail' group, it is set to the user's primary group. On systems where other users share the same primary group, this would allow those users to be able to read and write other user mailboxes. | ||||||||||
| Alerts: |
| ||||||||||
usermin - unauthorized access
| Package(s): | usermin, webmin | CVE #(s): | |||||||||||||||||
| Created: | February 24, 2003 | Updated: | February 27, 2003 | ||||||||||||||||
| Description: | - From announcement:
"Due to a remotely exploitable security hole being discovered that effects all previous Webmin releases, version 1.070 is now available for download from http://www.webmin.com/ and mirror sites. This problem was reported by Cintia M. Imanishi, but fortunately there have been no known malicious exploits of it yet. However, all users should upgrade to 1.070 as soon as possible." "Also available is Usermin 1.000 which fixes the exact same security hole. It includes the same File Manager features, as well as support for IMAP folders and an IMAP inbox in the Read Mail module." Read this alert for the details. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
vnc - replay and cookie vulnerabilities
| Package(s): | vnc | CVE #(s): | CAN-2002-1336 CAN-2002-1511 | ||||||||||||||||||||
| Created: | February 21, 2003 | Updated: | May 5, 2003 | ||||||||||||||||||||
| Description: | VNC is a tool for providing a remote graphical user interface. Two
vulnerabilities have been found in versions of VNC shipped by Red Hat.
The VNC server acts as an X server, but the script for starting it generates an MIT X cookie (which is used for X authentication) without using a strong enough random number generator. This could allow an attacker to be able to more easily guess the authentication cookie. The VNC DES authentication scheme is implemented using a challenge-response architecture, producing a random and different challenge for each authentication attempt. A bug in the function for generating the random challenge caused the random seed to get reset to the current time on every authentication attempt. Therefore, two authentication attempts within the same second could receive the same challenge. An eavesdropper could exploit this vulnerability by replaying the response, thereby gaining authentication. All users of VNC are advised to upgrade to these erratum packages, which contain patches to correct these issues. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
zlib 1.1.4 has buffer overrun
| Package(s): | zlib | CVE #(s): | CAN-2003-0107 | ||||||||||||||||||||||||||||
| Created: | February 25, 2003 | Updated: | April 29, 2003 | ||||||||||||||||||||||||||||
| Description: | From this Bugtraq
posting:
"zlib contains a function called gzprintf(). This is similar in behaviour to fprintf() except that by default, this function will smash the stack if called with arguments that expand to more than Z_PRINTF_BUFSIZE (=4096 by default) bytes." | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
Resources
Nessus 2.0 released
Version 2.0 of the Nessus security scanner has been released. It includes a reworked and reimplemented NASL language, an improved plugin system, a new port scanner, improved HTML reporting, and more.Linux Advisory Watch
The February 21 Linux Advisory Watch newsletter from LinuxSecurity.com is available.
Events
Call For Papers Announcement: Black Hat Briefings Amsterdam
The 2003 Black Hat Briefings will be held May 14 and 15 in Amsterdam. The call for papers has gone out with a submission deadline of March 25.
Page editor: Jonathan Corbet
Next page:
Kernel development>>