john boletta jbolettasecurityfocuscom securityfocus linux newsletter 92 newsletter sponsored securityfocus deepsight threat management system june 24th august 31st 2002 securityfocus announces free twoweek trial deepsight threat management system early warning system providing customizable comprehensive early warning cyber attacks bulletproof countermeasures prevent attacks hit network deepsight threat management system focus proactively deploying prioritized specific patches protect systems attacks rather reactively searching dozens web sites hundreds emails frantically trying gather information attack recover sign today httpwwwsecurityfocuscomcorporateproductspromotmstriallxshtml front center 1 advanced log processing 2 assessing internet security risk part three internet 3 copyright security hollywood hacking bill 4 securityfocus dpp program ii linux vulnerability summary 1 openssl sslv2 malformed client key remote buffer overflow 2 abyss web server http get request directory contents disclosure 3 dotproject user cookie authentication bypass vulnerability 4 openssl sslv3 session id buffer overflow vulnerability 5 phpbb2 gender mod remote sql injection vulnerability 6 shoutbox form field html injection vulnerability 7 sympoll file disclosure vulnerability 8 openssl asn1 parsing error denial service vulnerability 9 william deich super syslog format string vulnerability 10 frederic tyndiuk eupload plain text password storage 11 utillinux file locking race condition vulnerability 12 openssl kerberos enabled sslv3 master key exchange buffer 13 openssl ascii representation integers buffer overflow 14 parachat phantom user denial service vulnerability 15 openssh trojan horse vulnerability 16 bharat mediratta gallery remote file include vulnerability 17 john g myers munpack malformed mime encoded message buffer 18 dispair remote command execution vulnerability 19 mailreader session hijacking vulnerability 20 john g myers mpackmunpack malformed filename vulnerability 21 fake identd client query remote buffer overflow vulnerability iii linux focus list summary 1 ldap auth thread 2 ldap auth thread 3 administrivia gone fishin thread iv new products linux platforms 1 gateway guardian 2 paksecured linux 3 progressive systems vpn v new tools linux platforms 1 astaro security linux stable 3x v3202 2 fcheck 20759 3 stake sleuth kit task v150 vi sponsorship information front center 1 advanced log processing anton chuvakin reading logs crucial part incident detection response however easy security personnel overwhelmed sheer volume logs article offer brief overview log analysis particularly log transmission log collection log analysis also briefly touch upon log storing archival httponlinesecurityfocuscominfocus1613 2 assessing internet security risk part three internet assessment methodology continued charl van der walt article third series designed help readers assess risk internetconnected systems exposed first installment established reasons technical risk assessment second part started discuss methodology follow performing kind assessment installment continue discuss methodology particularly visibility vulnerability scanning httponlinesecurityfocuscominfocus1612 3 copyright security hollywood hacking bill richard forno proposed copyright enforcement legislation may allow powerful entertainment lobby circumvent fundamental constitutional protections may create chaos internet httponlinesecurityfocuscomcolumnists99 4 securityfocus dpp program attention nonprofit organizations universities signup preferred pricing global earlywarning system cyber attacks securityfocus deepsight threat management system click information httpwwwsecurityfocuscomcorporateproductsdpsectionshtml ii bugtraq summary 1 openssl sslv2 malformed client key remote buffer overflow vulnerability bugtraq id 5363 remote yes date published jul 30 2002 1200am relevant url httpwwwsecurityfocuscombid5363 summary openssl open source implementation ssl protocol used number projects including restricted apache sendmail bind etc commonly found linux unix based systems buffer overflow vulnerability reported versions openssl initiating openssl session information shared client server including key data reported vulnerability lies handling client key value negotiation sslv2 protocol malicious client may exploit vulnerability transmitting malformed key vulnerable server careful exploitation may result execution arbitrary code server process attacker gaining local access vulnerable system primitive attacks may result server process crashing possibly producing denial service condition consequences exploitation may vary nature application using openssl oracle reports corporatetime outlook connector vulnerable microsoft windows 98 nt 2k xp vulnerability originally part bid 5353 multiple openssl buffer overflow vulnerabilities reissued separate vulnerability 2 abyss web server http get request directory contents disclosure vulnerability bugtraq id 5345 remote yes date published jul 29 2002 1200am relevant url httpwwwsecurityfocuscombid5345 summary abyss web server freely available personal web server maintained aprelium technologies runs microsoft windows operating systems well linux vulnerability reported abyss web server 103 running microsoft windows platform possible attacker make request contents specified directory revealed vulnerability occurs due manner excessive characters handled web requests attacker making get request followed 256 characters cause abyss web server return error page containing directory listing specified directory attacker may able use information launch potentially damaging attacks vulnerable system 3 dotproject user cookie authentication bypass vulnerability bugtraq id 5347 remote yes date published jul 29 2002 1200am relevant url httpwwwsecurityfocuscombid5347 summary dotproject webbased project management software written php designed run unix linux variants dotproject prone issue may allow remote attackers bypass authentication gain administrative access software may accomplished submitting maliciously crafted user_cookie value either manually via manipulation uri parameters example attacker may manually craft cookie user_cookie value 1 submit project management system attacker may also submit malicious web request user_cookie uri parameter set 1 instances attacker gain administrative access project management system problem due software relying user_cookie value authenticate user 4 openssl sslv3 session id buffer overflow vulnerability bugtraq id 5362 remote yes date published jul 30 2002 1200am relevant url httpwwwsecurityfocuscombid5362 summary openssl open source implementation ssl protocol used number projects including restricted apache sendmail bind etc commonly found linux unix based systems vulnerability reported openssl vulnerability affects sslv3 session ids initiating contact sslv3 servers clients servers alike exchange information session information stored session key unique session id reportedly oversized ssl version 3 session id supplied client malicious server possible overflow buffer remote system could result key memory areas vulnerable remote system overwritten including stack frame data attacker may able take advantage vulnerability execute malicious code vulnerable sslv3 client machine oracle reports corporatetime outlook connector vulnerable microsoft windows 98 nt 2k xp vulnerability originally part bid 5353 multiple openssl buffer overflow vulnerabilities reissued separate vulnerability 5 phpbb2 gender mod remote sql injection vulnerability bugtraq id 5342 remote yes date published jul 29 2002 1200am relevant url httpwwwsecurityfocuscombid5342 summary phpbb2 opensource web forum application written php backended number database products run unix linux variants well microsoft windows operating systems gender mod modification phpbb2 allows association gender given user profile sql injection vulnerability reported mod malicious user may modify specified value gender updating profile possible include additional sql statements string subvert sql statement used update user profile reported possible gain administrative access phpbb2 site exploitation issue attacks may possible including ability view sensitive database information modify additional information stored database 6 shoutbox form field html injection vulnerability bugtraq id 5354 remote yes date published jul 29 2002 1200am relevant url httpwwwsecurityfocuscombid5354 summary shoutbox webbased user feedback software written php runs unix linux variants well microsoft windows operating systems shoutbox sufficiently sanitize html tags input supplied via form fields particular user website url field feedback form sanitized html tags attackers may exploit lack input validation inject arbitrary html script code pages generated script may result execution attackersupplied code web client user visits page html script code executed security context site hosting software condition may exploited hijack web content potentially steal cookiebased authentication credentials 7 sympoll file disclosure vulnerability bugtraq id 5360 remote yes date published jul 30 2002 1200am relevant url httpwwwsecurityfocuscombid5360 summary sympoll webbased voting booth software implemented php run unix linux variants well microsoft windows operating systems sympoll prone issue may allow remote attackers disclose contents arbitrary webserver readable files vulnerability present hosts running vulnerable version software php register_globals directive enabled source vulnerability reported insufficient integrity checking variables vendor stated issue believed affect sympoll version 12 exploitation issue microsoft windows operating systems may potentially expose arbitrary system files since webservers typically run system context 8 openssl asn1 parsing error denial service vulnerability bugtraq id 5366 remote yes date published jul 30 2002 1200am relevant url httpwwwsecurityfocuscombid5366 summary openssl open source implementation ssl protocol used number projects including restricted apache sendmail bind etc commonly found linux unix based systems remotely exploitable denial service condition reported openssl asn1 library vulnerability due parsing errors affects ssl tls smime pkcs7 certificate creation routines particular malformed certificate encodings could cause denial service server client implementations depend openssl oracle reports corporatetime outlook connector vulnerable microsoft windows 98 nt 2k xp vulnerability originally part bid 5353 multiple openssl buffer overflow vulnerabilities reissued separate vulnerability 9 william deich super syslog format string vulnerability bugtraq id 5367 remote date published jul 31 2002 1200am relevant url httpwwwsecurityfocuscombid5367 summary super open source setuid root utility allows similar functionality sudo utility written use linux unix variant operating systems super prone format string vulnerability problem due incorrect use syslog function log error messages possible corrupt memory passing format strings vulnerable logging function may potentially exploited overwrite arbitrary locations memory attackerspecified values vulnerability result compiling super syslog support due error file errorc users super configuration file still able execute code root privileges successful exploitation issue may allow attacker execute arbitrary instructions root privileges 10 frederic tyndiuk eupload plain text password storage vulnerability bugtraq id 5369 remote yes date published jul 31 2002 1200am relevant url httpwwwsecurityfocuscombid5369 summary frederic tyndiuk eupload small script designed facilitate uploading files remote server written perl work microsoft windows linux unix variant operating systems problem eupload 10 may make possible remote attackers gain access sensitive information eupload cryptographically protect stored passwords passwords contained configuration file passwordtxt stored plain text may read simply viewing file file passwordtxt stored web accessible location accessible retrieval thus trivial attacker obtain user passwords abuse eupload service problem could allow attacker gain access passwords protected resources 11 utillinux file locking race condition vulnerability bugtraq id 5344 remote date published jul 29 2002 1200am relevant url httpwwwsecurityfocuscombid5344 summary utillinux package set commonly used system utilities chfn chsh included many linux distributions race condition reported code shared utillinux utilities condition related file locking failure check existence lockfile prior sensitive operations may specific circumstances open window opportunity attack utillinux utilities often write sensitive files etcpasswd attackers may exploit condition inject arbitrary data files elevate privileges reported attacks complex time dependent require specific circumstances system administrator interaction large passwd file red hat linux known ship utillinux core component distributions derived red hat particular may also vulnerable noted utilities included shadowutils package shipped suse linux vulnerable 12 openssl kerberos enabled sslv3 master key exchange buffer overflow vulnerability bugtraq id 5361 remote yes date published jul 30 2002 1200am relevant url httpwwwsecurityfocuscombid5361 summary openssl open source implementation ssl protocol used number projects including restricted apache sendmail bind etc commonly found linux unix based systems vulnerability reported openssl 097 prerelease versions vulnerability present kerberos enabled system using ssl version 3 initiatiating contact sslv3 server master keys exchanged client server oversized master key supplied ssl version 3 server malicious client may cause buffer overflow vulnerable system result stack memory vulnerable server become corrupted could enable attacker take control sslv3 server process cause execute malicious attacker supplied code vulnerability originally part bid 5353 multiple openssl buffer overflow vulnerabilities reissued separate vulnerability 13 openssl ascii representation integers buffer overflow vulnerability bugtraq id 5364 remote yes date published jul 30 2002 1200am relevant url httpwwwsecurityfocuscombid5364 summary openssl open source implementation ssl protocol used number projects including restricted apache sendmail bind etc commonly found linux unix based systems remotely exploitable buffer overflow conditions reported openssl issue due insufficient checking bounds regards ascii representations integers 64 bit platforms possible overflow buffers vulnerable system overly large values submitted malicious attacker exploitation vulnerability may allow execution arbitrary code privileges vulnerable application service client oracle reports corporatetime outlook connector vulnerable microsoft windows 98 nt 2k xp vulnerability originally part bid 5353 multiple openssl buffer overflow vulnerabilities reissued separate vulnerability 14 parachat phantom user denial service vulnerability bugtraq id 5370 remote yes date published jul 31 2002 1200am relevant url httpwwwsecurityfocuscombid5370 summary parachat webbased chatting system available unix linux variants well microsoft windows operating systems parachat chat servers prone denial service condition user left webpage chat room using back forward buttons browser lieu logging account still logged chat room times 15 minutes later malicious user may repeatedly different users overload chat server phantom users denial service may result 15 openssh trojan horse vulnerability bugtraq id 5374 remote yes date published aug 01 2002 1200am relevant url httpwwwsecurityfocuscombid5374 summary openssh freely available implementation ssh clientserver protocol distributed maintained openssh team reportedly server hosting openssh ftpopenbsdorg compromised recently reported intruder made modifications source code openssh include trojan horse code downloads openssh source code ftpopenbsdorg july 30 2002 july 31 2002 likely contain trojan code trojan code appears included file bftestc reports say trojan run upon compilation openssh trojan process named sh compiling users default shell executed trojan attempts connect 2036215832 port 6667 trojan wait one three commands connection specified address attempted every hour cause trojan execute binsh cause trojan respawn terminate trojan process highly probable trojan give remote root access vulnerable systems following sites also reported carry trojaned version openssh34p1targz ftpftpopenbsdorgpubopenbsdopenssh ftpftpusaopenbsdorgpubopenbsdopenssh ftpftp1seopenbsdorgpubopenbsdopenssh known whether sites affected well freebsd reported following md5 checksum information following md5 checksum trojaned version openssh md5 openssh34p1targz 3ac9bc346d736b4a51d676faa2a08a57 following md5 checksum openssh freebsd ports directory md5 openssh34p1targz 459c1d0262e939d6432f193c7a4ba8a8 note different checksum mean backdoor exist openssh team released advisory fixed versions openssh available download since 1300 utc august 1 2002 following md5 checksum information provided fixed versions openssh md5 openssh34p1targz 459c1d0262e939d6432f193c7a4ba8a8 md5 openssh34p1targzsig d5a956263287e7fd261528bb1962f24c md5 openssh34tgz 39659226ff5b0d16d0290b21f67c46f2 md5 openssh322p1targz 9d3e1e31e8d6cdbfa3036cb183aa4a01 md5 openssh322p1targzsig be4f9ed8da1735efd770dc8fa2bb808a 16 bharat mediratta gallery remote file include vulnerability bugtraq id 5375 remote yes date published aug 01 2002 1200am relevant url httpwwwsecurityfocuscombid5375 summary gallery open source web based photo album written php available linux unix variant well microsoft windows operating systems gallery prone issue may allow remote attackers include arbitrary files located remote servers issue present following php script files provided gallery errorsconfigmodephp errorsneedinitphp errorsreconfigurephp errorsunconfiguredphp captionatorphp attacker may exploit supplying path file initphp remote host value gallery_basedir parameter remote file php script may allow execution attackersupplied php code privileges webserver successful exploitation may provide local access attacker 17 john g myers munpack malformed mime encoded message buffer overflow vulnerability bugtraq id 5385 remote date published aug 02 2002 1200am relevant url httpwwwsecurityfocuscombid5385 summary john g myers mpackmunpack pair utilities encode decode mime format email versions available linux unix variant operating systems well microsoft dos buffer overflow vulnerability reported munpack 15 reportedly possible cause munpack crash receives malformed email nntp news article vulnerability result buffer overflow condition may possible attacker cause munpack execute malicious attacker supplied code however confirmed 18 dispair remote command execution vulnerability bugtraq id 5392 remote yes date published jul 30 2002 1200am relevant url httpwwwsecurityfocuscombid5392 summary dispair webbased targz archive viewer written perl available linux unix operating systems dispair fails sufficiently validate usersupplied input passed shell via perl open function remote attacker may exploit condition injecting arbitrary commands cgi parameters request vulnerable script result successful exploitation attackers may potentially exploit issue execute arbitrary commands underlying shell privileges webserver process 19 mailreader session hijacking vulnerability bugtraq id 5393 remote yes date published aug 02 2002 1200am relevant url httpwwwsecurityfocuscombid5393 summary mailreader open source project allows pop3 mail access web interface mailreader implemented perl work microsoft windows linux unix based operating systems vulnerability reported versions mailreader may possible remote attacker hijack session legitimate user system may result access sensitive information ability send mail otherwise function legitimate user full exploit details available possible vulnerability results session information tracked cgi parameters may trivially spoofed remote user possibility however confirmed 20 john g myers mpackmunpack malformed filename vulnerability bugtraq id 5386 remote date published aug 02 2002 1200am relevant url httpwwwsecurityfocuscombid5386 summary john g myers mpackmunpack pair utilities encode decode mime format email versions available linux unix variant operating systems well microsoft dos vulnerability reported mpackmunpack 15 reportedly possible cause munpack create files outside designated directory mpackmunpack receives mime encoded message attachment refers file using sequence followed filename may decode attachment outside designated directory impact vulnerability limited reported munpack accept single sequence overwrite existing files 21 fake identd client query remote buffer overflow vulnerability bugtraq id 5351 remote yes date published jul 29 2002 1200am relevant url httpwwwsecurityfocuscombid5351 summary fake identd open source ident server designed return information incoming requests implemented tomi ollila available linux number unix based operating systems reportedly versions fake identd fail properly handle long client requests specially formatted request split across multiple tcp packets may cause internal buffer overflow reportedly execution arbitrary code fake identd server process possible fake identd designed drop privileges however also reported behavior flawed versions result exploitation may result execution code root privileges iii linux focus list summary 1 ldap auth thread relevant url httponlinesecurityfocuscomarchive91285167 2 ldap auth thread relevant url httponlinesecurityfocuscomarchive91285168 3 administrivia gone fishin thread relevant url httponlinesecurityfocuscomarchive91285159 iv new products linux platforms 1 gateway guardian netmaster networking solutions inc platforms linux relevant url httpwwwnetmastercomproductsgatewayguardianhtml summary developed netmasters linux distribution tailored specifically firewall applications gateway guardian flexible highend firewall takes revolutionary approach allowing company use lowerend pc internet gateway running pc internet gateway gateway guardian uses pure java application preconfigure hardware internet provider settings firewall rules wizard like format information entered java application writes entire linux operating system custom firewall configuration onto 314 floppy diskette 2 paksecured linux paktronix systems platforms linux relevant url httpwwwpaktronixcomproductspaklinuxphp summary paksecured linux paksecured linux currently complete policy routing operating system broad computing platform base based linux os paksecured linux runs processor families capable running linux kernel policy routing encompasses quality service qos advanced tcpip routing ipv4 ipv6 ipsec encryption vpn structures bandwidth allocation traffic shaping address allocation features nat ip masquerade features available independently various products paksecured linux implements full range policy routing features integrated hardened os distribution designed operate hostile network environments paksecured linux desktop user based functionality specifically targeted servers need high security 24x7 uptime required run without operator intervention coupling needs flexibility power complete policy routing structure puts paksecured linux unique niche 3 progressive systems vpn progressive systems platforms linux propietary hardware relevant url httpwwwprogressivesystemscomproductsvpn summary progressive systems vpn remote access vpn designed let quickly securely allow remote network access whomever choose allow progressive systems vpn features smartgate vone smartgate market share leading extranet vpn product available linux appliance progressive systems v new tools linux platforms 1 astaro security linux stable 3x v3202 astaro relevant url httpwwwastarocomproductsindexhtml platforms linux posix summary astaro security linux firewall solution stateful packet inspection filtering content filtering user authentication virus scanning vpn ipsec pptp much webbased management tool webadmin ability pull updates via internet pretty easy manage based special hardened linux 24 distribution daemons running changeroots protected kernel capabilities 2 fcheck 20759 michael gumienny relevant url httpwwwgeocitiescomfcheck2000fcheck_20759targz platforms aix bsdi dgux digital unixalpha freebsd hpux linux netbsd openbsd perl system supporting perl sco solaris sunos unix unixware windows 2000 windows 3x windows 9598 windows nt summary fcheck stable perl script written generate comparatively monitor unix system baseline file alterations report syslog console log monitoring interface monitoring events done little one minute intervals systems drive space small enough making difficult circumvent freelyavailable opensource alternative tripwire time tested easier configure use 3 stake sleuth kit task v150 stake relevant url httpwwwatstakecomresearchtoolstask platforms freebsd linux macos openbsd solaris summary stake sleuth kit task open source forensic toolkit complete analysis microsoft unix file systems task enables investigators identify recover evidence images acquired incident response live systems task also open source allowing investigators verify actions tool customize specific needs vi sponsorship information newsletter sponsored securityfocus deepsight threat management system june 24th august 31st 2002 securityfocus announces free twoweek trial deepsight threat management system early warning system providing customizable comprehensive early warning cyber attacks bulletproof countermeasures prevent attacks hit network deepsight threat management system focus proactively deploying prioritized specific patches protect systems attacks rather reactively searching dozens web sites hundreds emails frantically trying gather information attack recover sign today httpwwwsecurityfocuscomcorporateproductspromotmstriallxshtml tue 6 aug 2002 100352 0600 mdt securityfocus linux newsletter 92