Kerberos 4/5 problem found

By Jason Meserve
Network World Security and Bug Patch Alert, 03/12/01

Today's roundup of bug patches and security alerts:

Unsafe temp file handling in Kerberos 4 and 5

Massachusetts Institute of Technology is warning of a potential bug in the way Kerberos 4 and 5 handle temporary files. The bug could be exploited by a user to overwrite certain files and possibly gain root access. For more information and patches:

web.mit.edu/kerberos/www/advisories/krb4tkt.txt

@Stake reports buffer overflow in Netscape Directory Server

A bug in Netscape Directory Server could lead to a buffer overflow. By sending a malformed request to the server's messaging service a malicious user could cause the machine to crash. In a worst-case scenario, the user could execute arbitrary code on the server. For more information:

www.atstake.com/research/advisories/2001/a030701-1.txt

Microsoft: Malformed WebDAV request can cause IIS to exhaust CPU resources

Microsoft has released a patch for Internet Information Server 5.0 that fixes a potential denial-of-service vulnerability in the Web server's WebDAV module. WebDAV is an extension to HTTP that allows for remote authoring and management of Web sites. Using a malformed request, a malicious user could hang the system. For more information and a patch:

www.microsoft.com/technet/security/bulletin/MS01-016.asp

Guninski reports possible IIS vulnerability

Security-flaw hunter Georgi Guninski has found another possible bug in Microsoft IIS 5.0. According to Guninksi, "It is possible to remotely restart all IIS-related service using specially crafted request. It is also possible to force IIS to consume memory, which it does not free." He believes it could be a buffer overflow, but he says he's not sure of the exploit. I am sure we'll be hearing more on this soon.

www.guninski.com

HP releases patch for asecure

Hewlett-Packard has released a patch for its asecure package. According to an alert from the company, the package contains a number of files that have unsafe permission settings. The patch can be downloaded by logging on to HP's IT Resource Center:

itrc.hp.com

Linux-Mandrake releases ePerl update

A number of possible, buffer overflow flaws and a potential, remote access vulnerability have been discovered in ePerl. Linux-Mandrake users can download fixes from:

www.linux-mandrake.com/en/ftp.php3

Debian patches Midnight Commander

A flaw in the Midnight Commander package could allow a local user to modify the software to execute a random program under the auspices of another username. Source code for a patch can be downloaded from:

security.debian.org/dists/stable/updates/main/source/mc_4.5.42-11.potato.6.diff.gz

security.debian.org/dists/stable/updates/main/source/mc_4.5.42-11.potato.6.dsc

security.debian.org/dists/stable/updates/main/source/mc_4.5.42.orig.tar.gz

Upgraded nextaw, xaw3d and xaw95 packages available

According to an alert from Debian, "It has been reported that the AsciiSrc and MultiSrc widget in the Athena widget library handles temporary files insecurely." Users can download source code for the new packages at:

security.debian.org/dists/stable/updates/main/source/nextaw_0.5.1-34potato1.diff.gz

security.debian.org/dists/stable/updates/main/source/nextaw_0.5.1-34potato1.dsc

security.debian.org/dists/stable/updates/main/source/nextaw_0.5.1.orig.tar.gz

security.debian.org/dists/stable/updates/main/source/xaw3d_1.3-6.9potato1.diff.gz

security.debian.org/dists/stable/updates/main/source/xaw3d_1.3-6.9potato1.dsc

security.debian.org/dists/stable/updates/main/source/xaw3d_1.3.orig.tar.gz

security.debian.org/dists/stable/updates/main/source/xaw95_1.1-4.6potato1.diff.gz

security.debian.org/dists/stable/updates/main/source/xaw95_1.1-4.6potato1.dsc

security.debian.org/dists/stable/updates/main/source/xaw95_1.1.orig.tar.gz

Denial-of-service vulnerability in man2html

A flaw in man2html could allow it to be modified so that it takes up all available memory, effectively causing a denial-of-service attack. Debian users can download source code for the patch at:

security.debian.org/dists/stable/updates/main/source/man2html_1.5.orig.tar.gz

security.debian.org/dists/stable/updates/main/source/man2html_1.5-23.dsc

security.debian.org/dists/stable/updates/main/source/man2html_1.5-23.diff.gz

Debian releases patch for joe

A flaw in joe (Joe's Own Editor) could allow a malicious user to execute files on the affected machine. Debian users can download source code for the patch at:

security.debian.org/dists/stable/updates/main/source/joe_2.8-15.3.diff.gz

security.debian.org/dists/stable/updates/main/source/joe_2.8-15.3.dsc

security.debian.org/dists/stable/updates/main/source/joe_2.8.orig.tar.gz

Glibc vulnerabilities fixed

Debian has released a patch for the glibc library that fixes two problems that could be used to create or overwrite files on affected systems. The infected modules are LD_Preload and LD_Profile. Source code for the patch can be downloaded from:

security.debian.org/dists/stable/updates/main/source/glibc_2.1.3-17.diff.gz

security.debian.org/dists/stable/updates/main/source/glibc_2.1.3-17.dsc

security.debian.org/dists/stable/updates/main/source/glibc_2.1.3.orig.tar.gz

Vulnerability in slrn patched

The wrapping/unwrapping function of the slrn newsreader contains a vulnerability that could be used to execute arbitrary code on the affected system. Debian users can download source code for the patch from:

security.debian.org/dists/stable/updates/main/source/slrn_0.9.6.2-9potato1.diff.gz

security.debian.org/dists/stable/updates/main/source/slrn_0.9.6.2-9potato1.dsc

security.debian.org/dists/stable/updates/main/source/slrn_0.9.6.2.orig.tar.gz

Linux-Mandrake users can download the appropriate patch from:

www.linux-mandrake.com/en/ftp.php3

Possible denial-of-service flaw in Websweeper

The Websweeper application from Baltimore Technologies contains a possible denial-of-service vulnerability, according to an alert from Defcom labs. By sending an "infinitely long HTTP request" to the Websweeper HTTP server, it is possible to use up all the host machine's memory, rendering the machine useless. No patch is available at the moment. Baltimore Technologies can be found at:

www.baltimore.com/

Today's roundup of virus alerts:

W97M/Marker.BX: This Word macro virus activates if the computer's date is June 2000 or later. If so, it saves the infected file 999,999,991 times in the Windows directory. (Panda Software)

WM/Npad.018: After infecting a document 23 times, this macro virus displays a message in Word's status bar. (Panda Software)

VBS/Julien: Similar to the ILoveYou virus, this one overwrites or copies various file types on the local and any network-attached drive. The file types include JPG, JPEG, GIF, BMP, WAV, MP3 and MID. (Panda Software)

WM97/E4: This Word macro virus executes on the 20th of any month. It creates a file called start.exe (a copy of Joke/Win-Wobble) and runs it. (Sophos)

WM97/Marker-GL: A variant of the Word macro virus WM97/Marker-BN. No word on what damage, if any, it can cause. (Sophos)

From the interesting reading department:

FBI investigating widespread Web site break-ins by crime groups

The FBI Thursday disclosed it has launched 40 separate investigations into alleged hacking incidents by eastern European organized crime groups that are believed to have stolen more than 1 million credit card numbers from e-commerce and online finance Web sites powered by Windows NT servers. Computerworld, 03/08/01.

www.nwfusion.com/news/2001/0308fbi.html

www.nipc.gov/warnings/advisories/2001/01-003.htm

www.microsoft.com/technet/security/nipc.asp

European cybercrime proposal blasted

The Council of Europe's draft cybercrime treaty is vague in areas, slanted toward benefiting law enforcement and needs work overall, according to panelists who spoke about the document at the Computers, Freedom and Privacy conference Wednesday. IDG News Service, 03/08/01.

www.nwfusion.com/news/2001/0308cybercrime.html

IBM e-commerce servers vulnerable to hacks

IBM on Wednesday posted an advisory on its Web site that alerted customers to a tool that could potentially decrypt administrator and customer passwords residing on servers that use some IBM e-commerce software. IDG News Service, 03/08/01.

www.nwfusion.com/news/2001/0308ibmhack.html

Free archives

New to this newsletter? You can check out our past mailings at:

www.nwfusion.com/newsletters/bug/index.html