+----------------------------------------------------------------+
| LinuxSecurity.com Linux Advisory Watch |
| April 9th, 2004 Volume 5, Number 15a |
+----------------------------------------------------------------+
Editors: Dave Wreski Benjamin Thomas
dave@xxxxxxxxxxxxxxxxx ben@xxxxxxxxxxxxxxxxx
Linux Advisory Watch is a comprehensive newsletter that outlines the
security vulnerabilities that have been announced throughout the week.
It includes pointers to updated packages and descriptions of each
vulnerability.
This week, advisories were released for the Linux kernel, interchange,
fte, sysstat, oftpd, squid, heimdal, tcpdump, portage, kde, tcpdump,
sysstat, ClamAV, Automake, and mplayer. The distributors include Debian,
Gentoo, Mandrake, and Turbolinux.
----
NEW Step-by-Step SSL Guide for Apache from Thawte
Thawte's new guide will show you how to test, purchase, install and use a
Thawte Digital Certificate on your Apache web server. Throughout, best
practices for set-up are highlighted to help you ensure efficient ongoing
management of your encryption keys and digital certificates.
http://ad.doubleclick.net/clk;7739216;9007465;r
----
File Integrity Monitoring
Recently, I stumbled across a relatively new tool called AFICK. It stands
for Another File Integrity CHecker. It is similar to both Tripwire and
AIDE. AFICK is GPLed and completely written in PERL. It is extremely
flexible has been tested on a wide range of Linux, Windows, and Unix
system. According to the AFICK project website, it has a decent
performance advantage over AIDE. However, I have not independently
verified this. If you're looking for a new toy to play with, I recommend
giving it a try.
Installing and using AFICK is a piece of cake. The core piece of code is
command line based. A perl-based GUI and webmin module is also available
for easy administration. AFICK is available as an independent tar.gz,
zip, RPM, and Debian package. It is good idea to take a look at the
afick.conf file before attempting to execute the script.
AFICK can be used with only a few simple commands. To use AFICK, an OS
configuration file must be specified and then your system initialized.
This can be done with the following command:
# afick.pl -c linux.conf -i
During the initialization process it builds a database of checksums for
all files on your system. Next, to compare the checksums of your files
and the values stored in the database, run the following command:
# afick.pl -c linux.conf -k
After making changes to a system, it is necessary to update the checksum
database. Updating is also easy:
# afick.pl -c linux.conf -u
As with all integrity checking software, it is advisable to create a
cron-job that will compare the files checksums with a database at a
regular interval. Also, the integrity of the database is very important.
If this is compromised, further changes to the system may go undetected.
Write protected media can be used to help this problem.
While the commands above may seem simple, its functionality is not limited
to those alone. A full listing of command line option are available on
the AFICK website:
http://afick.sourceforge.net/man.html
Until next time, cheers!
Benjamin D. Thomas
ben@xxxxxxxxxxxxxxxxx
----
Guardian Digital Launches Next Generation Internet
Defense & Detection System
Guardian Digital has announced the first fully open source system designed
to provide both intrusion detection and prevention functions. Guardian
Digital Internet Defense & Detection System (IDDS) leverages best-in-class
open source applications to protect networks and hosts using a unique
multi-layered approach coupled with the security expertise and ongoing
security vigilance provided by Guardian Digital.
http://www.linuxsecurity.com/feature_stories/feature_story-163.html
--------------------------------------------------------------------
Interview with Siem Korteweg: System Configuration Collector
In this interview we learn how the System Configuration Collector (SCC)
project began, how the software works, why Siem chose to make it open
source, and information on future developments.
http://www.linuxsecurity.com/feature_stories/feature_story-162.html
--------------------------------------------------------------------
>> Internet Productivity Suite: Open Source Security <<
Trust Internet Productivity Suites open source architecture to give you
the best security and productivity applications available. Collaborating
with thousands of developers, Guardian Digital security engineers
implement the most technologically advanced ideas and methods into their
design.
http://ads.linuxsecurity.com/cgi-bin/newad_redirect.pl?id=gdn10
--> Take advantage of the LinuxSecurity.com Quick Reference Card!
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf
+---------------------------------+
| Distribution: Debian | ----------------------------//
+---------------------------------+
4/5/2004 - kernel
2.4 mips/pa-risc Privilege escalation vulnerabilities
Herein is combined the Debian advisories for the same kernel bugs
on both the mips and pa-risc platforms.
http://www.linuxsecurity.com/advisories/debian_advisory-4190.html
4/5/2004 - interchange
Missing input sanitation
This vulnerability can be exploited by an attacker to expose the
content of arbitrary variables.
http://www.linuxsecurity.com/advisories/debian_advisory-4191.html
4/5/2004 - fte
Multiple buffer overflow vulnerabilities
This patch removes setuid root from vfte, which has a number of
known buffer overflows.
http://www.linuxsecurity.com/advisories/debian_advisory-4192.html
4/5/2004 - sysstat
Insecure temporary file vulnerability
As usual for temporary file vulnerabilities, this allows local
users to read/overwrite arbitrary files with the permissions of
the running user.
http://www.linuxsecurity.com/advisories/debian_advisory-4193.html
4/5/2004 - oftpd
Denial of service vulnerability
A remote attacker could cause the oftpd process to crash by
specifying a large value in a PORT command.
http://www.linuxsecurity.com/advisories/debian_advisory-4194.html
4/5/2004 - squid
ACL bypass vulnerability
A URL can be crafted to be ignored (and automatically pass) by
Squid's ACL system.
http://www.linuxsecurity.com/advisories/debian_advisory-4195.html
4/6/2004 - heimdal
Cross-realm impersonation vulnerability
Patch fixes an error which allows someone with control over a
realm to impersonate anyone in the cross-realm trust path.
http://www.linuxsecurity.com/advisories/debian_advisory-4197.html
4/6/2004 - xine-ui Insecure temporary file vulnerability
Cross-realm impersonation vulnerability
Bug allows attacker to read/write arbitrary files with the
permissions of the program user.
http://www.linuxsecurity.com/advisories/debian_advisory-4198.html
4/7/2004 - tcpdump
Denial of service vulnerability
Crafted invalid ISAKMP packets can remotely crash tcpdump.
http://www.linuxsecurity.com/advisories/debian_advisory-4203.html
+---------------------------------+
| Distribution: Gentoo | ----------------------------//
+---------------------------------+
4/6/2004 - Portage
Insecure temporary file vulnerability
Exploitation of this bug could allow an attacker to wipe out the
contents of an arbitrary file.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4199.html
4/6/2004 - kde
Buffer overflow vulnerability
KDE-PIM may be vulnerable to a remote buffer overflow attack that
may allow unauthorized access to an affected system.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4200.html
4/6/2004 - tcpdump
Multiple buffer overflows
Attacker could exploit this to execute arbitrary code with the
permissions of the 'pcap' user.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4201.html
4/7/2004 - sysstat
Multiple vulnerabilities
Multiple vulnerabilities may allow an attacker to execute
arbitrary code or overwrite arbitrary files.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4204.html
4/7/2004 - ipsec-tools Key non-verification vulnerability
Multiple vulnerabilities
racoon (a utility in the ipsec-tools package) does not verify
digital signatures on Phase1 packets.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4207.html
4/7/2004 - util-linux Information leak vulnerability
Multiple vulnerabilities
Due to a pointer error, the 'login' program might leak sensitive
information.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4208.html
4/7/2004 - ClamAV
Denial of service vulnerability
ClamAV is vulnerable to a denial of service attack when processing
certain RAR archives.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4209.html
4/8/2004 - Automake
Symbolic link vulnerability
Automake may be vulnerable to a symbolic link attack which may
allow an attacker to modify data or elevate their privileges.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4210.html
+---------------------------------+
| Distribution: Mandrake | ----------------------------//
+---------------------------------+
4/6/2004 - mplayer
Buffer overflow vulnerability
Exploitation could result in the execution of arbitrary code with
the permissions of the user.
http://www.linuxsecurity.com/advisories/mandrake_advisory-4202.html
4/7/2004 - fileutils/coreutils Denial of service vulnerability
Buffer overflow vulnerability
'ls' can be made to segfault upon listing directories with large
numbers of files on an amd64 platform.
http://www.linuxsecurity.com/advisories/mandrake_advisory-4205.html
+---------------------------------+
| Distribution: Turbolinux | ----------------------------//
+---------------------------------+
4/7/2004 - apache/httpd/libxml2/mod_python Multiple vulnerabilities
Buffer overflow vulnerability
Many fixes for buffer overflows and DOS attacks.
http://www.linuxsecurity.com/advisories/turbolinux_advisory-4206.html
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
