----------------------------------------
This Issue is Sponsored by: eEye
Too Many Security Agents Cluttering Your System?
Replace your Firewall, IPS, Anti-Spyware and more with Blink® Professional for less than what you are currently paying in renewals.
Learn more on how you can experience the simplicity of one. One agent. One console. One Policy. One Solution.
Introducing eEye Digital Security's Blink® Professional, the first all-in-one security agent.
http://www.eeye.com/ctrack.asp?ref=SFBlink20061031
------------------------------------------------------------------
I. FRONT AND CENTER
1. Using Nepenthes Honeypots to Detect Common Malware
2. FreeBSD Security Event Auditing
II. LINUX VULNERABILITY SUMMARY
1. IMlib2 Library Multiple Arbitrary Code Execution Vulnerabilities
2. LibRPM Query Report Arbitrary Code Execution Vulnerability
3. Essentia Web Server GET And HEAD Requests Remote Buffer Overflow Vulnerability
4. Linux Kernel ISO9660 Denial of Service Vulnerability
5. Xoops NewList.PHP Cross-Site Scripting Vulnerability
6. OWFS Owserver File Path Denial of Service Vulnerability
7. Linux Kernel Multiple IPV6 Packet Filtering Bypass Vulnerabilities
8. Mozilla Client Products Multiple Remote Vulnerabilities
9. Texinfo File Handling Buffer Overflow Vulnerability
10. IBM Lotus Notes User.ID File Key Information Disclosure Vulnerability
11. IBM Lotus Domino Multiple TuneKrnl Local Privilege Escalation Vulnerabilities
12. ProFTPD Unspecified Remote Code Execution Vulnerability
13. NetKit FTP Server ChDir Information Disclosure Vulnerability
14. Avahi Unauthorized Data Manipulation Vulnerability
15. ELOG Web Logbook ELogD Server Denial Of Service Vulnerability
16. D-Link DWL-G132 ASAGU.SYS Wireless Device Driver Stack Buffer Overflow Vulnerability
17. PowerDNS Remote Denial of Service and Buffer Overflow Vulnerabilities
III. LINUX FOCUS LIST SUMMARY
1. Vulnerability Assessment of a EAL 4 system
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. Using Nepenthes Honeypots to Detect Common Malware
By Jamie Riden
This article describes the use of Nepenthes, a low-interaction honeypot, as an additional layer of network defense. Nepenthes can be used to capture malware, alert an administrator about a network compromise, and assist in containing and removing the infection.
http://www.securityfocus.com/infocus/1880
2. FreeBSD Security Event Auditing
By Federico Biancuzzi
The upcoming release of FreeBSD 6.2 includes the new Security Event Auditing system, that "permits the selective and fine-grained logging of security-relevant system events for the purposes of post-mortem analysis, intrusion detection, and run-time monitoring analysis." Federico Biancuzzi interviewed Robert Watson, founder of the TrustedBSD project, and discussed the advantages and potentialities it brings.
http://www.securityfocus.com/columnists/422
II. LINUX VULNERABILITY SUMMARY
------------------------------------
1. IMlib2 Library Multiple Arbitrary Code Execution Vulnerabilities
BugTraq ID: 20903
Remote: Yes
Date Published: 2006-11-04
Relevant URL: http://www.securityfocus.com/bid/20903
Summary:
The imlib2 Library is prone to arbitrary code-execution vulnerabilities.
An attacker can exploit these issues to execute arbitrary machine code with the privileges of the currently logged in user.
2. LibRPM Query Report Arbitrary Code Execution Vulnerability
BugTraq ID: 20906
Remote: Yes
Date Published: 2006-11-04
Relevant URL: http://www.securityfocus.com/bid/20906
Summary:
The 'librpm' library is prone to an arbitrary code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary machine code with the privileges of the currently logged-in user or to crash the affected application.
3. Essentia Web Server GET And HEAD Requests Remote Buffer Overflow Vulnerability
BugTraq ID: 20910
Remote: Yes
Date Published: 2006-11-07
Relevant URL: http://www.securityfocus.com/bid/20910
Summary:
Essentia Web Server is prone to a stack-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker can exploit this issue to execute arbitrary code within the context of the webserver. Failed exploit attempts will result in a denial-of-service condition.
This issue affects version 2.15; other versions may also be affected.
This issue may be related to the one described in BID 4159 (Essentia Web Server Long URL Buffer Overflow Vulnerability).
4. Linux Kernel ISO9660 Denial of Service Vulnerability
BugTraq ID: 20920
Remote: No
Date Published: 2006-11-05
Relevant URL: http://www.securityfocus.com/bid/20920
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability. This issue affects the ISO9660 filesystem handling code.
An attacker can exploit this issue to crash the affected computer, denying service to legitimate users.
5. Xoops NewList.PHP Cross-Site Scripting Vulnerability
BugTraq ID: 20927
Remote: Yes
Date Published: 2006-11-06
Relevant URL: http://www.securityfocus.com/bid/20927
Summary:
Xoops is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Version 1.0 is vulnerable; other versions may also be affected.
6. OWFS Owserver File Path Denial of Service Vulnerability
BugTraq ID: 20953
Remote: Yes
Date Published: 2006-11-07
Relevant URL: http://www.securityfocus.com/bid/20953
Summary:
OWFS Owserver is prone to a denial-of-service issue.
An attacker can exploit this issue to crash the affected server, denying service to legitimate users.
This issue affects version 2.5p5; other versions may also be affected.
7. Linux Kernel Multiple IPV6 Packet Filtering Bypass Vulnerabilities
BugTraq ID: 20955
Remote: Yes
Date Published: 2006-11-07
Relevant URL: http://www.securityfocus.com/bid/20955
Summary:
The Linux kernel is prone to multiple IPv6 packet-filtering-bypass vulnerabilities because of insufficient handling of fragmented packets.
An attacker could exploit these issues to bypass ip6_table filtering rules. This could result in a false sense of security because filtering rules set up by system administrators can be bypassed in order to access services that are otherwise protected.
8. Mozilla Client Products Multiple Remote Vulnerabilities
BugTraq ID: 20957
Remote: Yes
Date Published: 2006-11-07
Relevant URL: http://www.securityfocus.com/bid/20957
Summary:
The Mozilla Foundation has released two security advisories specifying vulnerabilities in Mozilla Firefox, SeaMonkey, and Thunderbird.
These vulnerabilities allow attackers to:
- crash the applications and potentially execute arbitrary machine code in the context of the vulnerable applications.
- run arbitrary JavaScript bytecode.
Other attacks may also be possible.
The issues described here will be split into individual BIDs as more information becomes available.
These issues are fixed in:
- Mozilla Firefox version 1.5.0.8
- Mozilla Thunderbird version 1.5.0.8
- Mozilla SeaMonkey version 1.0.6
9. Texinfo File Handling Buffer Overflow Vulnerability
BugTraq ID: 20959
Remote: Yes
Date Published: 2006-11-08
Relevant URL: http://www.securityfocus.com/bid/20959
Summary:
Texinfo is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Exploiting this issue allows attackers to cause the affected applications using Texinfo to crash, denying service to legitimate users. Arbitrary code execution may also be possible, but this has not been confirmed.
10. IBM Lotus Notes User.ID File Key Information Disclosure Vulnerability
BugTraq ID: 20960
Remote: Yes
Date Published: 2006-11-08
Relevant URL: http://www.securityfocus.com/bid/20960
Summary:
IBM Lotus Notes is prone to a local information-disclosure vulnerability because it fails to protect sensitive information from unprivileged users.
A local attacker may exploit this issue to obtain encryption key data from an unencrypted file that is used by the application. The attacker may then use this information to retrieve further information or to launch other attacks.
IBM Lotus Notes versions prior to 6.5.5 FP2 and 7.0.2 are vulnerable; other versions may also be affected.
11. IBM Lotus Domino Multiple TuneKrnl Local Privilege Escalation Vulnerabilities
BugTraq ID: 20967
Remote: No
Date Published: 2006-11-08
Relevant URL: http://www.securityfocus.com/bid/20967
Summary:
IBM Lotus Domino is prone to multiple local privilege-escalation vulnerabilities because the application fails to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.
A local attacker can exploit these issues to gain superuser privileges. A successful exploit would lead to the complete compromise of affected computers.
IBM Lotus Domino versions prior to 6.5.5 Fix Pack 2 and 7.0.2 are vulnerable to these issues.
12. ProFTPD Unspecified Remote Code Execution Vulnerability
BugTraq ID: 20992
Remote: Yes
Date Published: 2006-11-10
Relevant URL: http://www.securityfocus.com/bid/20992
Summary:
ProFTPD is prone to an unspecified remote code-execution vulnerability.
Presumably, a remote attacker can exploit this issue to gain unauthorized access to a computer in the context of the server.
This issue is reported to affected version 1.3.0; other versions may be vulnerable as well.
13. NetKit FTP Server ChDir Information Disclosure Vulnerability
BugTraq ID: 21000
Remote: No
Date Published: 2006-11-10
Relevant URL: http://www.securityfocus.com/bid/21000
Summary:
Netkit FTP Server ('ftpd') is prone to an information-disclosure vulnerability due to a design error.
A local attacker could exploit this issue to bypass access restrictions and gain access to the root directory of the FTP server. Directory information gained may aid in further attacks.
Netkit FTP Server 0.17 and prior versions are affected.
14. Avahi Unauthorized Data Manipulation Vulnerability
BugTraq ID: 21016
Remote: Yes
Date Published: 2006-11-11
Relevant URL: http://www.securityfocus.com/bid/21016
Summary:
Avahi is prone to a vulnerability that may allow remote attackers to manipulate the service.
Avahi versions prior to 0.6.15 are vulnerable.
15. ELOG Web Logbook ELogD Server Denial Of Service Vulnerability
BugTraq ID: 21028
Remote: Yes
Date Published: 2006-11-13
Relevant URL: http://www.securityfocus.com/bid/21028
Summary:
ELOG Web Logbook is prone to a remote denial-of-service vulnerability because the application fails to properly handle specific HTTP requests that contain invalid information.
Successful exploits may allow remote attackers to cause denial-of-service conditions on computers running the affected application.
16. D-Link DWL-G132 ASAGU.SYS Wireless Device Driver Stack Buffer Overflow Vulnerability
BugTraq ID: 21032
Remote: Yes
Date Published: 2006-11-13
Relevant URL: http://www.securityfocus.com/bid/21032
Summary:
The D-Link Wireless Device Driver for DWL-G132 devices is prone to a stack-based buffer-overflow vulnerability because the driver fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.
Exploiting this issue allows attackers to execute arbitrary machine code in the context of the kernel hosting the vulnerable driver. Failed attempts will likely crash the kernel, resulting in denial-of-service conditions.
The ASAGU.SYS driver is primarily used on the Microsoft Window operating system. It should be noted, however, that Linux and BSD machines using the 'ndiswrapper' tool should determine if they are using a vulnerable instance of the driver.
It should also be noted that this vulnerability can only be exploited when an attacker is within the range of broadcast of 802.11 wireless connections.
Version 1.0.1.41 of the ASAGU.SYS driver is reported vulnerable; other versions may also be affected.
17. PowerDNS Remote Denial of Service and Buffer Overflow Vulnerabilities
BugTraq ID: 21037
Remote: Yes
Date Published: 2006-11-13
Relevant URL: http://www.securityfocus.com/bid/21037
Summary:
A denial-of-service vulnerability and a buffer-overflow vulnerability affects PowerDNS.
Successfully exploiting the buffer-overflow issue allows remote attackers to execute arbitrary machine code in the context of the PowerDNS Recursor, facililtating a remote compromise of affected computers. Attackers may exploit the denial-of-service vulnerability to crash the PowerDNS Recursor, denying further DNS service to legitimate users.
PowerDNS Recursor versions prior to 3.1.4 are affected by these issues.
III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Vulnerability Assessment of a EAL 4 system
http://www.securityfocus.com/archive/91/450261
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.
V. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: eEye
Too Many Security Agents Cluttering Your System?
Replace your Firewall, IPS, Anti-Spyware and more with Blink® Professional for less than what you are currently paying in renewals.
Learn more on how you can experience the simplicity of one. One agent. One console. One Policy. One Solution.
Introducing eEye Digital Security's Blink® Professional, the first all-in-one security agent.
No comments:
Post a Comment