LINUX — THE HEADLINES

 2001/10/08 

Linux popularity breeds more worms

 2001/8/29 

SuSE sdbsearch.cgi security weakness

 2001/8/24 

xloadimage buffer overflow

 2001/8/23 

fetchmail-ssl memory overwrite vulnerability

 2001/8/17 

Higher netkit-telnet-ssl versions flawed, too

LINUX — THE LINKS

• Carbonite v1.0 — LKM to aid in RootKit detection
• Integrit file integrity verification program
• KSTAT — Verify your Kernel's Security
• LOMAC Low Water-Mark Mandatory Access Control
• PSAD Port Scan Attack Detector
• KSec: Kernel Security Checker for FreeBSD and OpenBSD
• Snoopy — commands logger
• linuxnewbie.org

  Disclaimer: These hyper-links to external content may be submitted by visitors of this site. Their contents do not represent the opinion of this publication. The links will be reviewed by an editor and may be modified, rejected or deleted at any time.

LINUX — THE NEWS

2001/10/08

10:55 +0100

Linux popularity breeds more worms

[Linux] Windows is not the only operating system to suffer from viruses, worms and distributed denial of service (DDoS) attacks, according to experts at the Virus Bulletin conference in Prague. Jakub Kaminski, of Computer Associates Australia, said that Unix, Solaris and Linux systems have seen some serious threats in the wild for the first time this year, according to a VNUNet article.

The amount and variety of Linux worms has risen sharply over the last 12 months, and viruses such as Ramen have spread widely. "The last 12 months have proved that Linux is here to stay. Unfortunately, there is also a steady increase in the variety and occurrence of malicious software written for Linux. There are a number of new Linux viruses, but the main work is being done in the area of Trojans, especially backdoor ones, and vulnerability exploits such as DDoS attacks," said Kaminski. He predicted that the increasing popularity of Linux systems will bring more viruses that use a cocktail of binary code and shell scripts to cross platforms.

Some BSD systems, such as FreeBSD, NetBSD and OpenBSD, are also at risk because they have the ability to emulate Linux a.out and ELF binaries. Kaminski also said that Linux viruses were able to replicate—a problem that could result from not installing Linux libraries properly. He expects the success of DDoS worms such as Code Red and Nimda to encourage virus writers to launch attacks on more machines, hitting Linux and Solaris by exploiting unpatched systems.

Joe Hartmann, director of antivirus research for North America at Trend Micro, said that most operating systems are at risk from buffer overflows because the C++ programming language they are based on has no buffer clean-up capability. // c.f. SecuritySpace :: [dre].

Comments (0)

2001/8/29

09:14 +0100

SuSE sdbsearch.cgi security weakness

[Linux] The sdbsearch.cgi script is a part of SuSE distribution. A vulnerability in this script allows attackers that are able to write local files (even unprivileged local files) to get them executed with the privileges that sdbsearch.cgi runs with. alerts Maurycy Prodeus. Affected are systems with SuSE version 6.x and 7.x (7.1 and 7.2 have tainting protection, but even with it is still possible to pass sdbsearch files that should not be read).

Sdbsearch.cgi trusts the content of HTTP_REFERER variable, a variable that is set by client during HTTP requests. Pieces of this data (the HTTP_REFERER) are used later in the search engine (as keywords or referring files). A vulnerability in the script occurs if there is the possible of writing local files on the target host (e.g. uploading through FTPd or any other method). A vulnerability in the program allows attackers that access this file to cause the sdbsearch to execute the arbitrary commands. This is caused because sdbsearch will use the open() function to open up the "keylist.txt" file which is known to be vulnerable to the standard pipe open() based attack (only this time without the -T option).

The proof of concept is very simple; just create a harmful keylist.txt in /tmp directory and send a request to HTTP that looks like this: GET /cgi-bin/sdbsearch.cgi?stichwort=keyword HTTP/1.0 Referer: http://example.org/../../../../../tmp /tmp/keylist.txt can include something of the sort of: $ echo -e "keyword\0touch exploitable" > /tmp/keylist.txt After a successful attempt, there will be "exploitable" file in /tmp directory.

As a preliminary patch, filter the HTTP_REFERER variable. // c.f. SecuriTeam :: [dre].

Comments (0)

2001/8/24

09:49 +0100

xloadimage buffer overflow

[Linux] According to Debian Security Advisory DSA-069-1, the version of xloadimage (a graphics files viewer for X) that was shipped in Debian GNU/Linux 2.2 has a buffer overflow in the code that handles FACES format images. This could be exploited by an attacker by tricking someone into viewing a specially crafted image using xloadimage which would allow him to execute arbitrary code.

This problem was fixed in version 4.1-5potato1. Potato was released for alpha, arm, i386, m68k, powerpc and sparc. Get the sources for your platform from security.debian.org/dists/stable/updates/main/. For not yet released architectures please refer to the appropriate directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/. // c.f. SecuriTeam :: [dre].

Comments (0)

2001/8/23

10:10 +0100

fetchmail-ssl memory overwrite vulnerability

[Linux] EnGarde Secure Linux Security Advisory ESA-20010816-01 reports a remotely exploitable memory overwrite vulnerability in the fetchmail-ssl package. An exploit is known to exist.

While doing a routine security audit of the fetchmail package (named "fetchmail-ssl" in EnGarde), Salvatore Sanfilippo found two remotely exploitable bugs in both the imap and pop3 code. Lack of bounds checking may allow an attacker to write arbitrary data into memory. The attacker must have control of the mail server the client (using fetchmail) is attempting to contact in order to exploit this vulnerability.

All fetchmail users should upgrade to the most recent version from fetchmail's Official Web Site. Guardian Digital recently made available the Guardian Digital Secure Update, a means to proactively keep systems secure and manage system software. EnGarde users can automatically update their system using the Guardian Digital WebTool secure interface. // c.f. VulnWatch :: [dre].

Comments (0)

2001/8/17

09:10 +0100

Higher netkit-telnet-ssl versions flawed, too

[Linux] The telnet daemon contained in the netkit-telnet-ssl_0.16.3-1 package in the 'stable' (potato) distribution of Debian GNU/Linux is vulnerable to an exploitable overflow in its output handling. The original bug was found by Scut and announced to bugtraq on Jul 18 2001. At that time, netkit-telnet versions after 0.14 were not believed to be vulnerable. On Aug 10 2001, zen-parse posted an advisory based on the same problem, for all netkit-telnet versions below 0.17. More details can be found on SecurityFocus.

As Debian uses the 'telnetd' user to run in.telnetd, this is not a remote root compromise on Debian systems; the 'telnetd' user can be compromised.

Debian strongly advise to update your netkit-telnet-ssl packages to the telnetd-ssl_0.16.3-1.1 versions for alpha, arm, i386, m68k, powerpc and sparc. For not yet released architectures please refer to the appropriate directory at ftp.debian.org. // c.f. SecuriTeam :: [dre].

Comments (0)