Linux Advisory Watch, September 15th, 2000

[vuln-newsletter-admins () linuxsecurity com]

+----------------------------------------------------------------+
|  LinuxSecurity.com                      Linux Advisory Watch   |
|  September 15th, 2000                    Volume 1, Number 20a  |
+----------------------------------------------------------------+

  Editors:     Dave Wreski                  Benjamin Thomas
               dave () linuxsecurity com       ben () linuxsecurity com

Linux Advisory Watch is a comprehensive newsletter that outlines
the security vulnerabilities that have been announced throughout the
week.  It includes pointers to updated packages and descriptions of
each vulnerability.

This week, advisories were released for xpdf, xchat, screen, pam_smb,
pine4, eject, listmanager, mailman, mod_php3, mgetty, horde, and
glibc. The vendors include RedHat, Slackware, SuSE, FreeBSD,
Mandrake, Conectiva, Debian, Caldera, and TurboLinux.  It is critical
that you update all vulnerable packages.  Many of the advisories
included warn of potential root compromises.

Recently, major problems in pam_smb were announced.  Versions 1.1.5
and before contain a buffer overflow that can allow a remote root
shell. Vulnerable versions of pam_smb can be used to authenticate
attackers attempting to use services such as ssh, and telnet.  If
this package is installed, we advise that you remove/upgrade it
immediately.

-- OpenDoc Publishing ---------------------------------------------

Our sponsor this week is OpenDoc Publishing.  Their 480-page
comprehensive security book, Securing and Optimizing Linux, takes a
hands-on approach to installing, optimizing, configuring, and
securing Red Hat Linux. Topics include sendmail 8.10.1, OpenSSL,
ApacheSSL, OpenSSH and much more! Includes Red Hat 6.2 and Red Hat
6.2 PowerTools edition.

https://secure.linuxports.com/cart/security/

+---------------------------------+
|   Installing a new package:     | ----------------------------//
+---------------------------------+

   # rpm  -Uvh <package-name.rpm>
   # dpkg -i   <package-name.deb>

Packages can be installed easily by using rpm (Red Hat Package
Manager) or dpkg (Debian Package Manager).  Most advisories
issued by vendors are packaged in either an rpm or dpkg.
Additional installation instructions can be found in the body
of the advisory.

+---------------------------------+
|   Checking Package Integrity:   | -----------------------------//
+---------------------------------+

The md5sum command is used to compute a 128-bit fingerprint that is
strongly dependant upon the contents of the file to which it is
applied.  It can be used to compare against a previously-generated
sum to determine whether the file has changed.  It is commonly used
to ensure the integrity of updated packages distributed by a vendor.

  # md5sum <package-name>
    ebf0d4a0d236453f63a797ea20f0758b   <package-name>

The string of numbers can then be compared against the MD5 checksum
published by the packager.  While it does not take into account the
possibility that the same person that may have modified a package
also may have modified the published checksum, it is especially
useful for establishing a great deal of assurance in the integrity
of a package before installing it.


+---------------------------------+
|       Caldera Advisories        | ----------------------------//
+---------------------------------+

* Caldera: 'xpdf' vulnerabilities
September 11th, 2000

  There are two security problems in xpdf, the PDF file viewer. The
  first is that temporary files were created insecurely. The second
  problem is that xpdf was not cautious enough when the user clicked on
  a URL. Xpdf would start the URL viewer (netscape by default) via the
  system shell, not properly taking care of shell meta characters. This
  problem could be exploited by creating PDF files that ran malicious
  code when the user selected a URL in the document.

  Updated Packages:
  ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/
  f0cf08c9febe6c7e16500812a140f846 RPMS/xpdf-0.91-3.i386.rpm

  ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/
  696e6851ecd8b348a9b4c0ef18fd94bd RPMS/xpdf-0.91-3.i386.rpm

  http://www.linuxsecurity.com/advisories/caldera_advisory-702.html


+---------------------------------+
|      Conectiva Advisories       | ----------------------------//
+---------------------------------+


* Conectiva:  'xpdf' vulnerability
September 13th, 2000

  Insecure file creation in /tmp which could be exploited via symlink
  attacks; Shell commands inserted in URLs would be expanded and
  executed by the shell when the user opened such an URL from within
  xpdf. Please note that xpdf is not SUID and therefore any attack
  which uses these vulnerabilities will only have the privileges of the
  user running xpdf.

      Package Name: xpdf-0.91-1cl
  Updated Packages: ftp://atualizacoes.conectiva.com.br

  http://www.linuxsecurity.com/advisories/other_advisory-708.html


* Conectiva:  'pam_smb' vulnerability
September 12th, 2000

  There is a buffer overflow in pam_smb versions 1.1.5 and below that
  could be exploited to gain root privileges. This package is not used
  by default in Conectiva Linux, but it is part of the distribution.
  Remote root access could be gained if a vulnerable pam_smb were to be
  used to authenticate users in remote services, such as ssh, telnet
  and others.

      Package Name: pam_smb-1.1.6-1cl
  Updated Packages: ftp://atualizacoes.conectiva.com.br/5.1/

  http://www.linuxsecurity.com/advisories/other_advisory-706.html


+---------------------------------+
|        Debian Advisories        | ----------------------------//
+---------------------------------+


* Debian:  'libpam-smb' vulnerability
September 12th, 2000

  libpam-smb contains a buffer overflow that can be used to execute
  arbitrary commands with root privilege. libpam-smb was not shipped
  with Debian 2.1 (slink), but was included in Debian 2.2 (potato).

      Package Name: libpam-smb_1.1.6
  Updated Packages: http://security.debian.org/dists/stable/
                    updates/main/

http://www.linuxsecurity.com/advisories/debian_advisory-705.html


* Debian: horde and imp vulnerabilities
September 10th, 2000

  imp as distributed in Debian GNU/Linux 2.2 suffered from insufficient
  checking of user supplied data: the IMP webmail interface did not
  check the $from variable which contains the sender address for shell
  metacharacters. This could be used to run arbitrary commands on the
  server running imp.

      Package Name: horde_1.2.1-0
  Updated Packages: http://security.debian.org/dists/stable/updates/main/

  http://www.linuxsecurity.com/advisories/debian_advisory-699.html


* Debian: xpdf vulnerabilities
September 10th, 2000

  xpdf as distributed in Debian GNU/Linux 2.2 suffered from two
  problems: 1. creation of temporary files was not done safely which
  made xpdf vulnerable to a symlink attack. 2. when handling URLs in
  documents no checking was done for shell metacharacters before
  starting the browser. This makes it possible to construct a document
  which cause xpdf to run arbitrary commands when the user views an
  URL.

  Package Name: xpdf_0.90-7
  Updated Packages: http://security.debian.org/dists/stable/updates/main/

  http://www.linuxsecurity.com/advisories/debian_advisory-700.html


+---------------------------------+
|        FreeBSD Advisories       | ----------------------------//
+---------------------------------+


* FreeBSD:  'screen' vulnerability
September 13th, 2000

  The screen port, versions 3.9.5 and before, contains a vulnerability
  mwhich allows local users to gain root privileges. This is
  accomplished by inserting string-formatting operators into
  configuration parameters, which may allow arbitrary code to be
  executed.

  Package Name: screen-3.9.8.tgz
  Updated Packages: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports

  http://www.linuxsecurity.com/advisories/freebsd_advisory-709.html


* FreeBSD:  'pine4' vulnerability
September 13th, 2000

  The pine4 port, versions 4.21 and before, contained a bug which would
  cause the program to crash when processing a folder which contains an
  email message with a malformed X-Keywords header. The message itself
  could be deleted within pine if identified, but other operations such
  as closing the folder with the message still present would cause the
  program to crash with no apparent cause, discarding changes to the
  mailbox.

  Package Name: pine-4.21.tgz
  Updated Packages: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports

  http://www.linuxsecurity.com/advisories/freebsd_advisory-711.html


* FreeBSD:  'xchat' vulnerability
September 13th, 2000

  The xchat IRC client provides the ability to launch URLs displayed in
  an IRC window in a web browser by right clicking on the URL. However
  this was handled incorrectly in versions prior to 1.4.3, and prior to
  1.5.7 in the 1.5 development series, and allowed a malicious IRC user
  to embed command strings in a URL which could cause an arbitrary
  command to be executed as the local user if the URL were to be
  "launched" in a browser as described above.

  Package Name: xchat-1.4.3.tgz
  Updated Packages: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/

  http://www.linuxsecurity.com/advisories/freebsd_advisory-712.html


* FreeBSD:  'eject' vulnerability
September 13th, 2000

  The eject program is installed setuid root, and contains several
  exploitable buffers which can be overflowed by local users, yielding
  root privileges.

      Package Name: eject-1.4.tgz
  Updated Packages: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/

  http://www.linuxsecurity.com/advisories/freebsd_advisory-713.html


* FreeBSD:  'listmanager' vulnerability
September 13th, 2000

  The listmanager port, versions prior to 2.105.1, contained several
  locally exploitable buffer overflow vulnerabilities which could be
  used to gain root privileges.

      Package Name:     listmanager-2.105.1.tgz
  Updated Packages: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports

  http://www.linuxsecurity.com/advisories/freebsd_advisory-714.html


* FreeBSD:  'mailman' vulnerability
September 13th, 2000

  The mailman port, versions prior to 2.0b5, contained several locally
  exploitable vulnerabilities which could be used to gain root
  privileges.

      Package Name: mailman-2.0b5.tgz
  Updated Packages: ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/

  http://www.linuxsecurity.com/advisories/freebsd_advisory-715.html


+---------------------------------+
|       Mandrake Advisories       | ----------------------------//
+---------------------------------+

* Mandrake:  'mod_php3' vulnerability
September 13th, 2000

  It is possible for a remote attacker to supply an arbitrary file name
  as the value for $FOO by submitting a standard form input tag by that
  name, and thus cause the PHP script to process arbitrary files. The
  vulnerability exists in various scripts, and not necessarily with PHP
  itself, as the script determines what actions to perform on the
  uploaded file. The new versions of both PHP3 and PHP4 make it easier
  to secure scripts from this particular vulnerability.

      Package Name: mod_php3-3.0.17
  Updated Packages: ftp://ftp.free.fr/pub/Distributions_Linux/
                  Mandrake/updates

  http://www.linuxsecurity.com/advisories/mandrake_advisory-716.html


* Mandrake:  'mod_perl' vulnerability
September 11th, 2000

  The configuration file, /etc/httpd/conf/addon-modules/mod_perl.conf
  contained an Options directive that was not entirely secure and
  allowed people to browse the /perl/ directory. This update adds the
  "-Indexes" directive to the Options command, thus making the
  directory non-browseable.

      Package Name: mod_perl
  Updated Packages: ftp://ftp.linux.tucows.com/pub/distributions/
                  Mandrake/Mandrake/updates

  http://www.linuxsecurity.com/advisories/mandrake_advisory-704.html


+---------------------------------+
|        RedHat Advisories        | ----------------------------//
+---------------------------------+

* RedHat:  Updated 'xpdf' packages available
September 14th, 2000

  There is a security problem when using tmpnam() and fopen() in
  versions prior to 0.91. The problem is seen when a root user
  overwrites files where a symlink is created between the calls to
  tmpname() and fopen(). There is also a problem with URL-type links in
  PDF documents that contain quote characters which could also be used
  to execute arbitrary commands.

       Package Name: xpdf-0.91-1.5x
   Updated Packages: ftp://updates.redhat.com/5.2/

  http://www.linuxsecurity.com/advisories/redhat_advisory-717.html


* RedHat:  'screen' format string exploit
September 14th, 2000

  Screen allows the user to overload the visual bell with a text
  message that can be set by the user. This text message is handled as
  a format string, instead of as a pure string, so maliciously written
  format strings are allowed to overwrite the stack. Since screen in
  Red Hat Linux 5.2 and earlier releases was setuid root, this security
  hole could be exploited to gain a root shell.

      Package Name: screen-3.7.4-4
  Updated Packages: ftp://updates.redhat.com/5.2/

  http://www.linuxsecurity.com/advisories/redhat_advisory-719.html


* RedHat:  Updated 'mgetty' packages available
September 11th, 2000

  The mgetty-sendfax package contains a vulnerability which allows any
  user with access to the /var/tmp directory to destroy any file on any
  mounted filesystem.

      Package Name: mgetty-1.1.22-1.5
  Updated Packages: ftp://updates.redhat.com/5.2/
                  ftp://updates.redhat.com/6.2/

  http://www.linuxsecurity.com/advisories/redhat_advisory-703.html


+---------------------------------+
|       Slackware Advisories      | ----------------------------//
+---------------------------------+

* Slackware:  'xchat' vulnerability
September 14th, 2000

  An input validation bug was found to affect Slackware Linux 7.0, 7.1,
  and current. Users of Slackware 7.0, 7.1, and -current are urged to
  upgraded to the xchat.tgz package available in the Slackware -current
  branch.

      Package Name: xchat.tgz
  Updated Packages: ftp://ftp.slackware.com/pub/slackware/
                    slackware-current/slakware/gtk/

  http://www.linuxsecurity.com/advisories/slackware_advisory-718.html



+---------------------------------+
|         SuSE Advisories         | ----------------------------//
+---------------------------------+

* SuSE:  'pam_smb' vulnerability
September 13th, 2000

  Versions 1.1.5 and before contain a buffer overflow that would allow
  a remote attacker to gain root access on the target host, provided
  that the target host has the module installed and configured.

      Package Name: pam_smb-1.1.6-0
  Updated Packages: ftp://ftp.suse.com/pub/suse/i386/update

  http://www.linuxsecurity.com/advisories/suse_advisory-707.html


+---------------------------------+
|      TurboLinux Advisories      | ----------------------------//
+---------------------------------+


* TurboLinux: glibc vulnerabilities
September 8th, 2000

  There have been two major security vulnerabilities involving glibc,
  one involving ld.so and unsetenv that allows local user's to gain
  root privileges due to environment variables not getting cleared out
  in some circumstances. Another vulnerability is lack of good checking
  on the locale file specification which can be set to a file provided
  by an attacker to crash an application and gain root access.

      Package Name:  glibc-2.1.2
  Updated Packages:  ftp://ftp.turbolinux.com/pub/updates/6.0/

  http://www.linuxsecurity.com/advisories/turbolinux_advisory-698.html



------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc.                LinuxSecurity.com

     To unsubscribe email vuln-newsletter-request () linuxsecurity com
         with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".