[gull-annonces] SecurityFocus Newsletter #216

[Marc SCHAEFER]

LSH Remote Buffer Overflow Vulnerability
BugTraq ID: 8655
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8655
Summary:
lsh is a free software implementation of the ssh version 2 protocol. It is
available for multiple platforms including Linux, Unix and Apple.

lsh has been reported prone to a remote buffer overflow vulnerability. The
condition is reported to present itself under fairly restrictive
circumstances; specifically the vulnerable server must receive malicious
exploit data before any other communications after it has been started.
The vulnerability has been reported to exist in read_line.c, inside an
error reporting function. It has been reported that the vulnerable
function does not return from a reporting procedure, and instead writes
arbitrary data past the end of a reserved buffer in heap-based memory.
This will eventually lead to the corruption of adjacent heap based
management structures.

This vulnerability has been reported to be exploitable pre-authentication,
resulting in the execution of arbitrary attacker supplied instructions in
the context of the affected daemon.

Although this issue has been reported to affect lsh versions 1.4.x, other
versions may also be affected.

Debian hztty Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 8656
Remote: No
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8656
Summary:
Debtian hztty is a program used to translate Chinese character encodings
in terminal sessions.

It has been reported that hztty is prone to multiple buffer overflow
issues that may allow an attacker to gain unauthroized access to a host
running the vulnerable software.

The conditions are present due to insufficient boundary checking.  An
attacker may leverage the issues by exploiting an unbounded memory copy
operation to overwrite the saved return address/base pointer, causing the
affected procedures to return to an address of their choice.  One of these
issues is due to insufficient bounds checking of data supplied via the
'-I' command line parameter.

It has also been reported that hztty is incorrectly installed as setuid
root by default instead of group utmp privileges.

Successful exploitation may allow an attacker to ultimately execute
arbitrary code in the context of the user who is running the vulnerable
software in order to gain unauthorized root access to a system.

hztty version 2.0-5.2 has been reported to be prone to these issue however
other versions may be affected as well.

Midnight Commander Virtual File System Symlink Buffer Overfl...
BugTraq ID: 8658
Remote: Yes
Date Published: Sep 19 2003
Relevant URL: http://www.securityfocus.com/bid/8658
Summary:
Midnight Commander is a popular file management tool for Unix systems.
Among other features, Midnight Commander is provided with a code layer to
access the file system; this code layer is known as the virtual file
system(VFS).

Midnight Commander has been reported prone to a buffer overflow
vulnerability, when handling symlinks in VFS.

The issue presents itself in the vfs_s_resolve_symlink() function,
reportedly due to an un-initialized buffer being used when Midnight
Commander is handling symlinks in the virtual file system code layer,
specifically in tar and cpio VFS procedures.

An attacker may reportedly trigger this issue, using malicious tar
archives as an attack vector; to overflow the bounds of an un-initialized
reserved buffer in stack based memory. Although unconfirmed, it has been
conjectured that this condition may be leveraged to execute arbitrary
code, however a denial of service condition that causes the affected
Midnight Commander application to crash has been demonstrated.

ipmasq Incorrect Packet Forwarding Default Ruleset Vulnerabi...
BugTraq ID: 8664
Remote: Yes
Date Published: Sep 20 2003
Relevant URL: http://www.securityfocus.com/bid/8664
Summary:
ipmasq is a package that is used to initialize and simplify the
configuration of Linux IP Masquerade.  IP Masquerade is a feature of linux
that allows multiple hosts to share a single IP address.

Debian has reported that the firewall rules configured by ipmasq may
result in incorrect (and potentially insecure) forwarding of traffic on
the gateway host.  According to the report, any traffic destined for
internal hosts arriving at the external interface of the gateway will be
forwarded to the destination host on the internal network regardless of
whether the packet can be associated with an established connection or
not.  This behavior is incorrect and may result in attackers gaining
unauthorized access to internal and potentially more vulnerable hosts.

ipmasq 3.5.10 has been reported to be prone to this vulnerability.

Wu-Ftpd SockPrintf() Remote Stack-based Buffer Overrun Vulne...
BugTraq ID: 8668
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8668
Summary:
Wu-Ftpd is an ftp server based on the BSD ftpd that is maintained by
Washington University. Wu-Ftpd includes an option 'MAIL_ADMIN', which
allows the administrator to be e-mailed when a specific event occurs on
the server. One such event may be the uploading of a remote file.

A remote vulnerability has been discovered in Wu-Ftpd, when configured
using the 'MAIL_ADMIN' option to report file uploads, that could allow for
the execution of arbitrary code. It should be noted that Wu-Ftpd servers
running the default configuration are not affected by this vulnerability.

The problem is present within the SockPrintf() function, located within
the ftpd.c source file, and occurs due to insufficient bounds checking.

When SockPrintf() is called, a number of formatted arguments are passed to
the svprintf() function and are stored within the local stack buffer. Due
to insufficient bounds checking prior to calling svprintf(), an attacker
capable of influencing data passed to SockPrintf() may be capable of
overrunning the 32768 byte buffer with malicious data.

This issue may be exploitable through the store() function defined in
ftpd.c, which invokes the SockPrintf() function using an uploaded filename
as the 'name' argument. If an attacker was somehow capable of influencing
the size of the path used to store the uploaded file, possibly by creating
nested directories, it may be possible to construct a 'name' argument
greater then 32768 bytes. This would effectively result in the allocated
stack buffer being overrun, and could ultimately allow for the corruption
of sensitive stack variables such as a saved frame pointer or a return
address.

It should be noted that specific operating systems place a limit on the
available size of filenames. For instance, Linux limits the size to 4096
bytes. Due to this limit, this bug may not be exploitable on certain
systems. However, if the aforementioned nested directory creation is
possible, exploitation may still be possible on systems that set smaller
size limits.

Successful exploitation of this vulnerability could result in the
execution of arbitrary code with the privileges of the Wu-Ftpd server,
typically root.

Man Utility Local Compression Program Privilege Elevation Vu...
BugTraq ID: 8675
Remote: No
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8675
Summary:
The man utility is used for formatting and displaying various system
manuals and documentation. The optional .manpath file is used by man to
locate various applications used by the user.

A vulnerability has been reported in man that may allow an attacker to
gain elevated privileges. The problem lies in man failing to carry out
sufficient sanity checks before executing a user-defined compression
program. As a result, it may be possible for an attacker to execute
arbitrary code with user 'man' privileges.

An attacker could exploit this issue by creating a malicious executable,
designed to spawn a shell, and specify it as the compression program.

Multiple Vendor VPN Implementation Vulnerabilities
BugTraq ID: 8676
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8676
Summary:
Multiple VPN implementations, including CIPE, vtun, and tinc are prone to
security vulnerabilities.

The CIPE implementation is prone to a number of cryptographic flaws.  The
flaws include lack of data integrity assurance due to the use of CRC-32
checksums, no inherent measures to protect against message
insertion/deletion attacks and incompatibilities with recent 128-bit block
cipher implementations due to use of 3-bit padding lengths.

Follow-up information has been provided regarding these reported
implementation flaws in CIPE.  It appears that the use of CRC-32 checksums
is a legitimate concern, which may be configurable in future versions of
CIPE.  Incompatibilities with recent 128-bit block cipher implementations
such as AES do present a possibility for cryptographic attacks on inherent
weaknesses that may exist in algorithms that are supported by CIPE.  Other
reported issues such as no inherent protection against message
insertion/deletion attacks are perceived as the result of limitations in
underlying network protocols and it is reported that some of these attacks
may be impractical.

vtun is prone to flaws including weak key generation and lack of inherent
message insertion/deletion protection mechanisms.

tinc is prone to minor cryptographic weaknesses that could expose the
first encrypted block of packets to attacks, potentially exposing
encrypted data.  Additional flaws have been reported in the handshake
protocol that could expose VPN communications to man-in-the-middle attacks
and threaten the integrity of the VPN.

Exploitation of these issues could compromise the security of the VPN.
Replay and man-in-the-middle attacks may be possible, in addition to
attacks which allow adversaries to partially decrypt VPN communications or
abuse trust relationships.  Many of these issues may be exploited in
combination.

These issues are pending further analysis.  This BID will be divided into
individual BIDs when further analysis of the issues is complete.

Multiple Portable OpenSSH PAM Vulnerabilities
BugTraq ID: 8677
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8677
Summary:
Multiple vulnerabilities have been reported to affect Portable OpenSSH
with PAM support enabled. It has been reported that at least one of these
vulnerabilities may be exploitable, under a non-standard configuration
with privsep disabled, by a remote attacker.

Explicit technical details regarding this vulnerability is not currently
available, this BID will be updated, as further analysis of these
conditions is complete.

This vulnerability has been reported to affect Portable OpenSSH versions
3.7p1 and 3.7.1p1. OpenBSD releases of OpenSSH do not contain the
vulnerable code and so are  not reported to be affected.

wzdftpd Login Remote Denial of Service Vulnerability
BugTraq ID: 8678
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8678
Summary:
wzdftpd is an FTP server implementation that is available for the Unix,
Linux, and Microsoft Windows platforms.

A vulnerability has been reported to exist in the software that may allow
a remote attacker to cause a denial of service condition.  The issue
presents itself when a remote attacker sends a single CRLF character to
the program during the login process.  The attack may cause the software
to act in an unstable manner.

This issue occurs due to improper sanitizing of user-supplied input and a
successful attack may allow a remote attacker to cause the vulnerable
process to crash.

wzdftpd version 0.1rc5 has been reported to be prone to this
vulnerability, however other versions across various platforms may be
affected as well.

ProFTPD ASCII File Transfer Buffer Overrun Vulnerability
BugTraq ID: 8679
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8679
Summary:
ProFTPD is an FTP server implementation that is available for Unix and
Linux platforms.

A remotely exploitable buffer overrun vulnerability has been reported in
ProFTPD.

This issue could be triggered if a malicious file is transferred in ASCII
mode.  Specifically, ASCII transfers are read in 1024 byte chunks and
checked for newlines (\n).  Improper handling of newline characters in
ASCII files may potentially be abused to corrupt memory with
attacker-supplied values.  If sensitive values in memory such as
instruction pointers can be overwritten with attacker-supplied data, it
will be possible to control execution flow of the process and execute
arbitrary code.

Successful exploitation will permit a malicious FTP user with upload
access to execute arbitrary code in the context of the FTP server.  To
exploit the issue, the attacker must upload the malicious file and then
attempt to download it.

It is also reported that ProFTPD does not adequately drop privileges in
some circumstances, which may compound the risks associated with
exploitation.

This issue could also affect versions prior to 1.2.7, though this has not
been confirmed.

MPG123 Remote File Play Heap Corruption Vulnerability
BugTraq ID: 8680
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8680
Summary:
mpg123 is a freely available, open source audio file player.  mpg123 is
available for the Linux and Unix platforms.

A problem in the handling of some types of remote files has been reported
in mpg123.  Because of this, it may be possible for a remote attacker to
execute arbitrary code with the privileges of the mpg123 user.

The problem occurs in the readstring function implemented in the httpget.c
source file.  When the program is used to connect to a remote streaming
server, it receives strings which is places onto the heap.  However, the
readstring function does not sufficiently limit the data in some
instances, making it possible for an attacker to send an arbitrary amount
of data.  An attacker can use this problem to overwrite sensitive process
memory, potentially executing arbitrary instructions.

Ingate Firewall/SIParator Packet Filter Rule Bypass Vulnerab...
BugTraq ID: 8681
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8681
Summary:
Ingate Firewall is a firewall appliance; SIParator is an appliance that
provides for the transmission of SIP-based communications and is designed
to operate with Ingate Firewall.

Ingate Firewall/SIParator products have been reported prone to a TCP
packet filter bypass vulnerability under some circumstances.

The issue presents itself if TCP packet filtering is being used in the
affected software. A malicious packet containing SYN and RST flags set
that passes through the firewall in the reply direction, may bypass
packet-filtering rules if the destination TCP stack implementation ignores
the RST flag and establishes a TCP connection based off the SYN flag.
Ultimately this issue may result in an established TCP connection, that
the affected TCP packet filtering rules were supposed to block.

It is likely that this vulnerability affects Ingate Firewall/SIParator
version 3.2 and prior.

[ hardware ]

XFree86 XLOCALEDIR Buffer Overflow Variant Vulnerability
BugTraq ID: 8682
Remote: Yes
Date Published: Sep 23 2003
Relevant URL: http://www.securityfocus.com/bid/8682
Summary:
XFree86 utilities may be prone to a locally exploitable vulnerability due
to insufficient bounds checking of data supplied via the XLOCALEDIR
environment variable.  This is a variant of the issue described in BID
7002, but is reported to affect XFree86 4.3.0 and the buffer required to
trigger the condition may also vary.  This poses a security risk with
utilities that are setuid/setgid.

The researcher who reported this vulnerability tested the issue with
xscreensaver and it was reportedly possible to overwrite EIP with
attacker-supplied values, however, privilege escalation was not possible
due to the application dropping privileges.  It is possible that some
other utilities may drop privileges before exploitation can occur.  It has
not been established that this issue may be exploited to gain elevated
privileges.

BSD Kernel ARP Cache Flooding Denial of Service Vulnerabilit...
BugTraq ID: 8689
Remote: Yes
Date Published: Sep 22 2003
Relevant URL: http://www.securityfocus.com/bid/8689
Summary:
The Address Resolution Protocol (ARP) is used to map Internet Protocol
(IP) addresses to MAC addresses. When an IP address is resolved to a MAC
address, it is stored in the ARP cache within the BSD kernel.

A vulnerability has been discovered in the BSD kernel. The problem lies in
the method in which BSD handles and caches information stored in ARP
requests. Specifically, if an ARP request is received and the IP cannot be
resolved, if a default route exists the MAC address will be given an entry
within the ARP cache regardless. As a result, especially on systems with a
default ipv4 route, an attacker may be capable of filling up the available
ARP cache space and triggering a system panic.

A successful attack can be accomplished by sending a high volume of ARP
requests, each with a unique spoofed IP address, to a target system.

The issue is reported to exist in FreeBSD and MacOS X.  Other systems
which use a BSD-derived kernel may also be prone to the issue.

CFEngine CFServD Transaction Packet Buffer Overrun Vulnerabi...
BugTraq ID: 8699
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8699
Summary:
GNU cfengine is software for automating administration and maintenance of
large networks.  It is available for Unix and Linux variants.

cfengine is prone to a stack-based buffer overrun vulnerability.  This
issue may be exploited by remote attackers who are able to send malicious
transaction packets to cfservd.  cfservd is typically configured to run on
a central master server, which may have some degree of authority over
other systems in the network.

This issue is due to insufficient bounds checking of data that is read in
during a transaction with a remote user.  In particular, the
BusyWithConnection() function in the cfservd.c source file passes
externally supplied data in a 4096 byte stack-based buffer to the
ReceiveTransaction() function in net.c.  A value for the message length is
then read from the socket by ReceiveTransaction().  The message length and
buffer are then passed to the RecvSocketStream() function.  If the message
length is more than 4096 bytes, then adjacent regions of memory will be
corrupted with the superfluous data.  In this manner it is possible to
corrupt stack variables such as an instruction pointer with
attacker-supplied values, allowing for control of execution flow and
execution of malicious instructions embedded in memory by the attacker.

The vulnerability may be exploited to execute arbitrary code with the
privileges of cfservd.  A denial of service may also be the result of
exploitation attempts as cfservd is multi-threaded and may not be
configured to restart itself via a super-server such as inetd.

MPlayer Streaming ASX Header Parsing Buffer Overrun Vulnerab...
BugTraq ID: 8702
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8702
Summary:
MPlayer is a multimedia program designed for the Linux and BSD operating
systems. It supports are wide variety of video files, including the ASX
format.

A vulnerability has been discovered in MPlayer when handling malformed
streaming ASX file headers. The issue has been reported to present itself
within the ASX stream handler of MPlayer, and has been reported to be due
to a lack of sufficient boundary checks performed within the
asf_http_request() function.

An attacker may create a malicious ASX file and host it on a server that
responds to a connecting client with new line data that is sufficient to
subvert boundary checks. When the malicious ASX file stream is
interpreted, excessive data contained as an http_proxy value in the ASX
file header may overrun the bounds of a reserved stack-based buffer in
memory and corrupt adjacent memory.

A remote attacker may leverage this condition to corrupt a saved
instruction pointer and thereby influence execution flow of the vulnerable
application into attacker controlled memory. Ultimately an attacker may
execute embedded instructions in the context of the user running MPlayer.

Apache htpasswd Password Entropy Weakness
BugTraq ID: 8707
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8707
Summary:
A weakness has been discovered in the way that the Apache htpasswd
generates salts. Specifically, the salt is generated based of the current
system time using the following procedure:

(void) srand((int) time((time_t *) NULL));
ap_to64(&salt[0], rand(), 8);

If this procedure were used twice or more within the same second, the
generated salts would be identical. As a result, if the affected system
were implementing the use of default auto-generated passwords, multiple
passwords may have the same salt.  Having a static value across multiple
passwords will make it easier for an attacker to compromise credentials
and gain access to resources protected via htpasswd that they wouldn't
normally have access to.

This may pose a security weakness if an attacker were capable of gain
access to the contents of htpasswd.

This weakness is said to affect Apache 1.3.27 and 1.3.28, however, other
versions may also be affected.

Athttpd Remote GET Request Buffer Overrun Vulnerability
BugTraq ID: 8709
Remote: Yes
Date Published: Sep 25 2003
Relevant URL: http://www.securityfocus.com/bid/8709
Summary:
Athttpd is a web server available for the Linux operating system.

A vulnerability has been reported for Athttpd. The problem occurs due to
insufficient bounds checking when handling GET requests. Specifically,
making a GET request including approximately 820 bytes of data will
effectively overrun the bounds of the internal memory buffer used for its
storage.

As a result, an attacker may be capable of corrupting sensitive data such
as a return address, and effectively control the execution flow of the
program. This would ultimately allow for the execution of arbitrary code.

This vulnerability is said to affect atphttpd 0.4b, however, earlier
versions may also be affected.

[ licence?]