 |
||||
   January 2000, last Update: 03/08/00 |
||||
| Furhter links lead to the
organization which reported the problem. So you can also read the
original advisory and you are informed about further actions to be
taken and patches to install. By the way: If we're not publishing well-known risks inheritant in any widely used platform or program that doesn't mean this particular platform or program is safe to use! |
||||
|
Here you find our network security
search engine! |
||||
|
|
||||
There is a security hole in the Spectra 1.0 Remote Access Service invoke.cfm template. Normally users must be authenticated in the webtop security context in order to even attempt to use the Remote Access Service. If the user passes a parameter called "bAuthenticated" via the URL, a form field, or a WDDX packet, and the user does not specify a username, a bug allows them to use the Remote Access Service even if they are not in the webtop user directory. A patch to fix this problem is available now. |
||||
|
|
||||
In syslogd a potential Denial-of-Service hole was found: By opening a lot of local syslog connections a user with shell acces could stop the system from responding. Patches are available for Qube 1, Qube 2, RaQ1, RaQ2, and RaQ3. The current version of cgiwrap that runs on RaQ3 and RaQ2, runs under incorrect effective permissions, which could let an attacker view or modify data in another virtual site on the same unit. Patches for RaQ2 and RaQ3. CacheQube, CacheRaQ1, CacheRaQ2, NASRaQ, Qube 1, Qube 2, RaQ1, and RaQ2 should have an updated MIPS kernel installed. There is a potential security problem with the majordomo wrapper which could allow a local user to gain higher privilages. Patches were published for Qube2, RaQ2, and RaQ3. Finally, for RaQx a security hole is fixed now: Due to improper permissions checking in /.cobalt/siteUserMod/siteUserMod.cgi unprevileged Administrators could change passwords of any regular user, in RaQ1 and RaQ2 even the password of root. Experimental patches are available for RaQ1, RaQ2, and RaQ3. |
||||
|
|
||||
A shared object that allows internationalization of the scohelp system contains an exploitable overflowable buffer. Without the patch (letter), systems are vulnerable to network-based system intrusions via this security hole. Two security holes were found in rtpm. Both of them can lead to local system compromises. It's recommended to install the patch (letter). |
||||
|
|
||||
Two security vulnerabilities were found in Microsoft Index Server.
The first is the “Malformed Hit-Highlighting Argument” vulnerability. The ISAPI filter that implements the hit-highlighting (also known as “WebHits”) functionality does not
adequately constrain what files can be requested. By providing a deliberately-malformed argument in a request to
hit-highlight a document, it is possible to escape the virtual directory. This would allow any file residing on the server
itself, and on the same logical drive as the web root directory, to be retrieved regardless of permissions. |
||||
|
|
||||
HP provides a proprietary method for determining
PMTU (Path MTU). When traffic needs to be routed to a destination for which the optimum MTU has not been determined, ICMP packets are used to discover the MTU for that path while data traffic is shipped in parallel.
Depending upon the amount and nature of inbound traffic, an HP-UX 10.30/11.00 system can be used to flood a target system with IP packets which could result in a denial of service. |
||||
|
|
||||
The make(1) program is typically used to schedule building of source code. It has a switch ('-j') to allow parallel building, using temporary files in /tmp to communicate with its child processes by storing the shell command the child should execute. This is handled in an insecure way, repeatedly deleting and reusing the same file name for the entire life of the program. This makes it vulnerable to a race condition wherein a malicious user could observe the name of the temporary file being used, and replace the contents of a later instance of the file with her desired commands after the legitimate commands have been written. It's recommended to install a patch. |
||||
|
|
||||
Greg Hoagland located a buffer overflow using an HTTP GET request with 537 byte path. Afterwards an attacker has control over the system. Further information and code demostrating the problem can be found in the advisory. a patch is not available yet. |
||||
|
|
||||
As reported before, multiple vulnerabilities were found in wu-ftpd shipped with HP9000 Series 700/800 servers. Now a VVOS patch for HP-UX release 11.04 has been published: PHNE_2068. It should be installed as soon as possible. |
||||
|
|
||||
During the past few weeks also the NIPC has seen multiple reports of intruders installing distributed denial of service tools on various computer systems, to create large networks of hosts capable of launching significant coordinated packet flooding denial of service attacks. Further information can be found in the advisory. |
||||
|
|
||||
The majordomo program is a popular application which automates the management of Internet mailing lists.
A vulnerability exists in majordomo versions up to and including 1.94.4.
This vulnerability may allow local users to gain the privileges under which majordomo and the local mail delivery agent executes. Depending on the local majordomo configuration this
may be leveraged to gain additional privileges. Sites using affected versions should immediately upgrade to majordomo
1.94.5. |
||||
|
|
||||
The RDISK utility is used to create an Emergency Repair Disk (ERD) in order to record machine state information as a contingency against system failure. During execution, RDISK creates a temporary file containing an enumeration of the registry. The ACLs on the file allow global read permission, and as a result, an attacker who knew that the administrator was running RDISK could open the file and read the registry enumeration information as it was being created. RDISK erases the file upon successful completion. A patch is available. |
||||
|
|
||||
Systems running with procfs enabled and mounted
are vulnerable to having the stderr output of setuid processes
directed onto a pre-seeked descriptor onto the stack in their own
procfs memory. Note that procfs is not mounted by default in OpenBSD.
It's recommended to install a patch. |
||||
|
|
||||
Microsoft Office includes a conversion utility that converts older Word documents to more recent formats. The conversion utility for Word 5 documents in East Asian languages (Japanese, Korean, Simplified Chinese and Traditional Chinese) has an unchecked buffer. By using a hexadecimal editor to insert specially-malformed information into a document, an attacker could cause Word to run code of his or her choice when the document was opened using an affected version of the converter. Please see the advisory for patches and further information. |
||||
|
|
||||
In the Super Mail Transfer Package (PORT 25) Server for WinNT Version 1.9x a memory leak was detected, which leads to a denial-of-service condition. At the moment a fix is not available. |
||||
|
|
||||
There was recently a report of a vulnerability in UnixWare7 that allowed acccess to read restricted files (/etc/shadow) via an exploit using crafted buffer overflows against some of the pkg* suite of tools. While OpenServer version 5.0.5 does not have exactly the same security vulnerability it does supply these tools and they are susceptible to the same set of buffer overflow issues. It's recommended to install the new set of binaries (letter) published by SCO. |
||||
|
|
||||
In SuSE Linux (including v 6.3) lprold is the default daemon for printing. If the hosts.lpd mechanism is used to permit printing to remote hosts, it can be circumvented if the attacker controls a DNS server: No double-reverse lookup is done for authentication. A second vulnerability involves the manipulation of the control file of a print job: statements are sent to sendmail as arguments, so an attacker may specify a special (own) sendmail config file and eventually get root-access to the machine. It's recommended to install patches from SuSE's Webpage for Patches. |
||||
|
|
||||
RTF files consist of text and control information. The control information
is specified via directives called control words. The default RTF reader
that ships as part of many Windows platforms has an unchecked buffer in the
portion of the reader that parses control words. If an RTF file contains a
specially-malformed control word, it could cause the application to crash.
As Microsoft points out the most serious risk from this vulnerability would result if a user
had preview mode enabled on a E-Mail program like Outlook, and received an
email that exploited the vulnerability. Because preview mode causes the
mail to be parsed without user assent, the mail program would crash. |
||||
|
|
||||
LPC Ports is a facility that allows Local
Procedure Calls on a machine. One of the functions in the LPC Ports API set
enables a server thread to impersonate a client thread on the same machine.
An hole in the validation portion of the function would allow an
attacker to create both the client and server threads, and manipulate the request
to allow it to run in the context of any desired user on the local machine,
including the System itself. |
||||
|
|
||||
The version of nvi that was distributed with Debian GNU/Linux 2.1 has an error in the default /etc/init.d/nviboot
script. It doesn't handle filenames with embedded spaces correctly, so
it's possible to remove files in the root directory by creating entries in /var/tmp/vi.recover. |
||||
|
|
||||
In at(1) and adduser(8) some minor problems concerning Y2k were found. It's recommended to install the patches for at and adduser. |
||||
|
|
||||
Microsoft Internet Explorer 5.01 under Windows 95 and 5.5 under WinNT 4.0 allows circumventing "Cross Frame Security Policy" by accessing the DOM of "old" documents
JavaScript and a design flaw in IE. This exposes the whole
DOM of the target document and opens lots of security risks. The problem allows reading local files, reading files from any host, window spoofing, getting cookies, etc. |
||||
|
|
||||
UssrLabs discovered a denial of service condition in IMail IMONITOR Server for WinNT Version 5.08 and possibly other versions as well. A cgi script entitle status.cgi checks to see if the server services are running. By executing the script numerous times in a short period of time IMONITOR will crash citing an "Invalid Memory Address". IPSwitch has been informed of the issue. |
||||
|
|
||||
Two security vulnerabilities exist in the lpd (line printer daemon) shipped with the lpr package. First, authentication was not thorough enough. If a remote user was able to control their own DNS so that their IP address resolved to the
hostname of the print server, access would be granted, when it should not be. Secondly, it was possible in the control file of a print job to specify arguments to sendmail. By careful manipulation of control and data files, this could cause sendmail to be executed with a user-specified configuration file. This could lead very easily to a root compromise. |
||||
|
|
||||
The Audio Security File, /etc/opt/audio/audio.sec, is created by the asecure program with 666 permissions. This allows root to add any user as a privileged user via the asecure program. Those privileged users can make changes to their audio security File via asecure. Since asecure has 555 permissions,
audio.sec must be world writable to implement the privileged user feature. Until patches are available,
the recommended solution is to run as root: |
||||
|
|
||||
The CFCACHE tag is a feature available in ColdFusion 4.x to perform template caching to increase page delivery performance by intelligently compiling and storing the output of CFML pages for faster access. When this tag is utilized in a .CFM page it creates several temporary files, including one that contains absolute filenames with directory path information, URL parameters and timestamps. In ColdFusion 4.0x, these files are stored in the same directory as the .CFM page, usually in a publicly accessible web document directory. Because these files are accessible to browsers in the web document directory, users wishing to do so could download this file with a browser and obtain information about the web document directory structure or URL parameters used to call site pages that would not otherwise be accessible. Allaire has released a new version of the CFCACHE tag that is also available in ColdFusion 4.5 that allows users to specify a non-web document directory to store the temporary file, making them inaccessible to browsers. |
||||
|
|
||||
The Allaire Spectra 1.0 Webtop allows authenticated users to access sections of the Webtop they may not have been granted access to by typing explicit URLs. This exploit does not give anyone access to the Webtop who does not
already have permissions to at least one section of the Webtop. |
||||
|
|
||||
The IMAP service included in MCIS Mail has an unchecked buffer. If a malformed request containing random data were passed to the service, it could cause the web publishing, IMAP, SMTP, LDAP and other services to crash. If the malformed request contained specially crafted data, it could also be used to run arbitrary code on the server via a classic buffer overrun attack. It's recommended to install the concerning patch for Intel or Alpha. |
||||
|
|
||||
A security bug was found in userhelper; the bug can be exploited to provide local users with root access.
Both pam and userhelper follow paths including "..". Since pam_start calls down to _pam_add_handler(),
an attacker can open any file on disk. It's
recommended to install the following patches: |
||||
|
|
||||
CERT continues to receive reports of new developments in denial-of-service tools.
The advisory provides pointers to documents discussing some of the more recent attacks and methods to detect some of the tools currently in use. For information on how to protect your systems, see the
advisory. |
||||
|
|
||||
A security hole was discovered in pine prior 4.21. The pine mail agent doesn't filter special shell characters in URLs. So an attacker can trick a user using pine to executing shell commands by sending an email with malicious formatted URL embedded in it. It's recommended to install patches from SuSE's Webpage for Patches. |
||||
|
|
||||
In OpenLinux are two problems in INN that can be exploited in a denial of service attack. In both cases, an article with bad formatting will cause the INN daemon (innd) to crash. It's recommended to upgrade to the latest packages. |
||||
|
|
||||
On HP9000 Series 7/800 running HP-UX releases 10.X and 11.X the program /opt/audio/bin/Aserver can be used to gain root access. Until a patch is available, the only two temporary fixes currently available are to disable the Aserver by removing the file, or to remove execute permissions. |
||||
|
||||
Here you can find the News from December 1999, November 1999, October 1999, September 1999, August 1999, July 1999, June 1999, May 1999, April 1999, and March 1999 |
