SERVER SOFTWARE (WEB, MAIL, FTP etc., MS-IIS) — THE HEADLINES

 2002/2/13 

How to hack unbreakable Oracle servers

 2002/1/23 

Netscape server flaws exposed

 2001/11/30 

Linux servers at risk from 'serious' flaw in WU-FTP

 2001/11/23 

Bugs in WS_FTP and WU-FTPD

 2001/11/09 

Alarming Netcraft web server security survey

SERVER SOFTWARE (WEB, MAIL, FTP etc., MS-IIS) — THE LINKS

• CmdAsp.asp checks your IIS server

  Disclaimer: These hyper-links to external content may be submitted by visitors of this site. Their contents do not represent the opinion of this publication. The links will be reviewed by an editor and may be modified, rejected or deleted at any time.

SERVER SOFTWARE (WEB, MAIL, FTP etc., MS-IIS) — THE NEWS

2002/2/13

13:26 +0100

How to hack unbreakable Oracle servers

[Server Software] Security researcher David Litchfield has identified a vast number of attacks against Oracle application servers and has written them up in a PDF-paper which includes defensive strategies as well.

From this The Register learned, contrary to Oracle President Larry Ellison's claims, that Oracle is vulnerable to buffer overflow attacks, DoS attacks, and remote exploitation to name but a few difficulties. Litchfield willingly allows that Oracle makes the most secure product on the market, and compliments Oracle for its obvious dedication to security. But as for being unbreakable, well, we all know that nothing is.

First up we have a PL/SQL buffer overrun vulnerability. This is in the Apache front end affecting Windows NT/2K, where Apache runs in the System (root) account and consequently allows code to run with full privileges. One problem is that the admin help pages are not PW protected. Thus a call to one of the pages can initiate a buffer overflow if it contains enough garbage (around 1K bytes). A quick fix would be to alter the admin path with something unique, making it difficult to guess.

Next, a directory traversal is possible due to a URL decoding glitch. This would allow an attacker to move from the Web environment to read files readable to the OS. It's also possible to administer PL/SQL DADs (Database Access Descriptors) without authentication, Litchfield has discovered. An obvious goal in this case would be to add a password so the attacker can escalate his privileges.

These are only the first three taken in order for illustration. There are in fact scores of attacks listed in this compendium, including authentication bypassing, path mapping, SOAP vulnerabilities, weak default paths, and terribly guessable or forcable default passwords (examples are provided—but system/manager is our absolute favorite). // c.f. SecuritySpace :: [dre].

Comments (0)

2002/1/23

10:59 +0100

Netscape server flaws exposed

[Server Software] CERT/CC has released details of multiple vulnerabilities in the Netscape Enterprise Server and iPlanet servers which could allow an attacker to crash a server or gain access, reports VNUnet.

Discovered by security firm ProCheckUp, the first vulnerability is a remotely exploitable denial of service attack on Netscape Enterprise Servers versions 4.0 and 4.1, and iPlanet 4.x web servers running on Windows. "Essentially, by entering a simple command within their web browser remote attackers can cause the server to crash," says CERT Vulnerability Note VU#191763. "The mitigating factor is that web publishing has to be enabled. However, this is quite common."

A second vulnerability in the same versions of the software allows an attacker to force an authentication session which, although "not a severe weakness", may allow attackers to perform a brute force password crack. This is a problem because "it provides an unpublished feature which would be unknown to the web server administrators or designers", according to ProCheckUp.

Richard Brain, technical director at the security firm, said: "It should be noted that, even though Netscape servers are not as popular as Apache or IIS servers, they are commonly used by businesses running high-end ecommerce or banking sites." // c.f. SecuritySpace :: [dre].

Comments (0)

2001/11/30

12:30 +0100

Linux servers at risk from 'serious' flaw in WU-FTP

[Server Software] A vulnerability in the most widely used FTP server program for Linux has left numerous sites open to online attackers, a situation worsened when Red Hat mistakenly released information on the flaw early, leaving other Linux companies scrambling to get a fix out, reports ZDNet. CERT/CC has issued Advisory CA-2001-33 accordingly.

The software flaw affects all versions of WU-FTP, the server program originally created at Washington University, St. Louis, for servers running FTP (file transfer protocol) functions for transferring files over the Internet. While the exact number of active FTP servers on the Internet is not known, the software is the most commonly installed file server and accompanies most major Linux distributions, including those from Red Hat, SuSE, Caldera International, Turbolinux, Connectiva, Cobalt Networks, MandrakeSoft and Wirex.

The problem, known in security circles as the WU-FTP "Globbing Heap Corruption Vulnerability," allows attackers to get remote access to all files on a server, provided they can access the FTP service. Since most such servers provide anonymous access to anyone on the Internet, a great number will be vulnerable.

The impact of the software vulnerability was exacerbated because many Linux software companies were caught flat-footed by a surprise early release of information regarding the vulnerability. The group that discovered the flaw, Core ST, informed Linux software companies and the open-source group that manages development for WU-FTP of the vulnerability in mid-November. On Tuesday, however, while the companies were working together on a fix, Red Hat mistakenly released a security advisory to its own customers, almost a week early.

Normally, an advisory is a good thing, but other Linux software sellers had expected any advisories to be published on 3 December, giving them time to work on fixes. Instead, the surprise announcement left the customers of other companies' products vulnerable. Now, end users know they are vulnerable but don't have a patch to apply. For its part, Red Hat apologised for the problem. "We put a stop to this," Mark Cox, senior engineering director for Red Hat said. "This will not happen again. It was a bad mistake." // c.f. SecuritySpace, RUS-CERT, CERT/CC :: [dre].

Comments (0)

2001/11/23

11:21 +0100

Bugs in WS_FTP and WU-FTPD

[Server Software] WS_FTP server 2.0.3 (and possibly earlier versions) contains a buffer overflow that affects the STAT command. This buffer overflow gives an attacker the ability to run code on the target with SYSTEM RIGHTS, because the server runs as a service with the SYSTEM user running it by default, warns Andreas Junestam.

The parsing code for the STAT command suffers from a buffer overflow. By sending a STAT command followed by an argument greater than 479 (475 bytes + new return address) bytes, the buffer will overflow and the EIP will be overwritten. The overflow is dependant on the size of the name of the server because the argument, the server name and some more information is wsprint'ed together in the buffer.

A proof-of-concept exploit is available at SecuriTeam. Download new version (2.0.4) from: ipswitch.com.

The SecurityFocus Vulnerability Help Team is in the process of notifying vendors of a remotely exploitable problem in WU-FTPD. The WU-FTPD has been notified already. Users of this server should watch for further bulletins and consider temporarily switching to another software. // c.f. RUS-CERT :: [dre].

Comments (0)

2001/11/09

13:07 +0100

Alarming Netcraft web server security survey

[Server Software] The number of sites found to be vulnerable by Netcraft's tests peaked at over 60% in June, and shows how ripe the Internet was for Code Red. A significant fall since shows the combined impact of Code Red and Microsoft's first cumulative security patch.

One would expect that Microsoft is delighted at the success of the cumulative patch, but disappointed that a significant minority of the Microsoft-IIS community is still likely to be very exposed, as some 1 in 10 of the ecommerce and encrypted transactions sites tested by Netcraft had backdoors in place to allow external attackers to monitor the systems, or have commands executed on the machines. // c.f. intern :: [dre].

Comments (0)