Security
Brief items
Relaxing with the XDR Vulnerability
[This article was contributed by Tom Owen]
A vulnerability in a library is unsettling. When the affected code is in glibc it seems like genuine grounds for alarm. Not only the library itself, but potentially every static-linked executable may need to be replaced or rebuilt, and it takes a very confident system administrator to swear to the link status of everything on the system.
These vulnerabilities do appear from time to time. Fortunately, it generally turns out that thought is a substitute for panicky rebuilds. The XDR vulnerability provides a handy example.
RPC (Remote Procedure Call) is an upper-layer network protocol developed by Sun as part of their vision of network-centric computing. Services offered via RPC appear to be simple functions which are called by applications; this system has been a key basis for many distributed applications, with NFS being the most famous. One obstacle to passing program data between hosts is the varying binary representation of basic data types like integers and floating point numbers. Ones-complement integers aren't much of a problem these days, but little and big endian byte orders are in use as are non-IEEE floating point formats. The solution used by Sun is for all hosts to convert data to and from a standard network representation; this representation is called "external data representation," or XDR.
The routines for XDR data conversion are included in glibc. One of these routines (xdr_array()) has a vulnerability where a crafted message can cause a buffer overflow. Finding out how much to worry about this vulnerability is really a matter of finding all of the uses of the XDR code in your system.
The place to start is with the new glibc itself. There's no good reason not to install this update -- it's insurance against changes in the future if nothing else. Another sensible precaution for any site is to ensure that RPC network traffic is stopped at the firewall. Running RPC across the public Internet is a fine security challenge, but not an obvious win. A complete block takes a bit of research as RPC ports sometimes vary from site to site, but blocking TCP and UDP for 111 (the portmapper) and 2049 (NFS) is a start. If RPC can't get in from outside then you won't be interpreting any external messages as XDR.
For many Linux sites RPC is needed to support NFS, or other services like NIS. That's the first stopping point -- all sites without NFS and without some other need for RPC-based services can stop now. Job done.
The next set of easy exits is for the bulk of those RPC and NFS sites.
Dynamic linking has its downside, but like most good ideas, its disadvantages turn out to be the same as its benefits. For certain, dynamic linking means that a working system can be silently wrecked by installing an application with an incompatible version of some library. But that same feature gets us out of trouble here -- if ever there was a library to link dynamically, glibc -- stable and ubiquitous -- is it.
Distributors that have published fixes are typically offering the updated library itself and perhaps some NFS daemons. Since most applications use dynamic linking with glibc, replacing that library is sufficient to close the vulnerability. For most sites, updating glibc is all that is required.
Everybody left counts as a programmer or a builder. Programmers will know whether they have a problem. The rest of us -- call us naive builders -- are the ones with the problem. It's here that we have to fall back on the safe course. If we truly can't tell whether we're using the XDR functions or static linking then, finally, it's time to rebuild and reinstall our applications.
New vulnerabilities
bonsai: multiple vulnerabilites
| Package(s): | bonsai | CVE #(s): | CAN-2003-0152 CAN-2003-0153 CAN-2003-0154 CAN-2003-0155 | ||||
| Created: | March 21, 2003 | Updated: | March 26, 2003 | ||||
| Description: | Remi Perrot fixed several security related bugs in bonsai, the Mozilla CVS
query tool by web interface. Vulnerabilities include arbitrary code
execution, cross-site scripting and access to configuration parameters.
The Common Vulnerabilities and Exposures project identifies the following problems:
| ||||||
| Alerts: |
| ||||||
delegate - remote code execution vulnerability
| Package(s): | delegate | CVE #(s): | |||||
| Created: | March 20, 2003 | Updated: | March 26, 2003 | ||||
| Description: | According to a SNS security advisory, a remote code execution vulnerability exists in the application level gateway DeleGate version 8.4.0 and earlier. Fetching a large robots.txt file through DeleGate HTTP proxy could result in a buffer overflow. | ||||||
| Alerts: |
| ||||||
evolution: multiple vulnerabilities
| Package(s): | Evolution | CVE #(s): | CAN-2003-0128 CAN-2003-0129 CAN-2003-0130 | ||||||||||||||||||||||||||||
| Created: | March 21, 2003 | Updated: | May 14, 2003 | ||||||||||||||||||||||||||||
| Description: | Multiple vulnerabilities have been found in Ximian's Evolution Mail User
Agent, according to this
CoreLabs advisory.
"Three vulnerabilities were found that could lead to various forms of exploitation ranging from denying to users the ability to read email, provoke system unstability, bypassing security context checks for email content and possibly execution of arbitrary commands on vulnerable systems." Ximian Evolution is a personal and workgroup information management solution for Linux and UNIX-based systems. The software integrates email, calendaring, meeting scheduling, contact management, and task lists, in one application. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
glibc: integer overflow in the xdrmem_getbytes() function
| Package(s): | glibc krb5 dietlibc | CVE #(s): | CAN-2003-0028 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 21, 2003 | Updated: | May 27, 2003 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | An integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, and glibc, allows remote attackers to execute arbitrary code via certain integer values in length fields See CAN-2003-0028 and CERT advisory CA-2003-10 for more information. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
ircii: buffer overflow vulnerability
| Package(s): | ircii | CVE #(s): | |||||||||||||
| Created: | March 20, 2003 | Updated: | April 22, 2003 | ||||||||||||
| Description: | Timo Sirainen audited ircII based clients (see this Bugtraq post) and found some buffer overflow vulnerabilities in ircii-20020912. | ||||||||||||||
| Alerts: |
| ||||||||||||||
kerberos - cryptographic weakness
| Package(s): | kerberos, heimdal, openafs | CVE #(s): | CAN-2003-0138 CAN-2003-0139 | ||||||||||||||||||||||||||||||||||||||||
| Created: | March 26, 2003 | Updated: | May 27, 2003 | ||||||||||||||||||||||||||||||||||||||||
| Description: | Version 4 of the Kerberos protocol contains a cryptographic weakness which enables a chosen-plaintext attack. A suitably equipped attacker can impersonate any principal in the realm. Another weakness allows the creation of false Kerberos tickets. Given the weaknesses in the cryptography, cross-realm authentication cannot be performed in a secure way.
OpenAFS kaserver implements version 4 of the Kerberos protocol, and therefore is also vulnerable. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
mutt: buffer overflow in IMAP client code
| Package(s): | mutt | CVE #(s): | CAN-2003-0140 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 21, 2003 | Updated: | April 22, 2003 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | Core
Security Technologies has found a remotely exploitable buffer overflow
in mutt's IMAP client code. This Bugtraq post
contains additional information.
The problem has been fixed in Mutt 1.4.1 (stable) and 1.5.4 (unstable). | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
Resources
CERT Quarterly Summary
CERT has sent out its quarterly summary listing the vulnerabilities that it sees being most frequently exploited. Along with a number of Windows issues, this summary lists the sendmail buffer overflow, the Samba vulnerability, and the CVS and SSH bugs.Stopping DDOS Attacks (Linux Journal)
The Linux Journal has an article on dealing with distributed denial of service attacks. "What about getting the Feds involved? In the GRC.com case I mentioned above, the FBI was totally uninterested. Of course, this case occurred in May 2001. It seems that the new Department of Homeland Security is somewhat more interested in such things. Then again, this is the same outfit that sat on the recent Sendmail vulnerability for two+ months. Hackers everywhere are justifiably skeptical."
Events
DEF CON 0x0b call for papers
The call for papers for DEF CON 0x0b has gone out. "We are also continuing to improve speaker quality. It is no longer enough to have green hair and an attitude."
Page editor: Jonathan Corbet
Next page:
Kernel development>>