OpenSSL ASN.1 Parsing Vulnerabilities BugTraq ID: 8732 Remote: Yes Date Published: Sep 30 2003 Relevant URL: http://www.securityfocus.com/bid/8732 Summary: Multiple vulnerabilities were reported in the ASN.1 parsing code in OpenSSL. OpenSSL does not directly implement ASN.1 but does use ASN.1 objects in X.509 certificates and various other cryptographic elements. The following issues were reported:
Two flaws in the ASN.1 parser could lead to denial of service attacks. The first bug may be exploited to cause an out of bounds read operation to occur, most likely resulting in a denial of service. This can be triggered by a malformed or unusual ASN.1 tag value. The second of the described bugs occurs if an application is configured to ignore public key decode errors (specifically the X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY error). This is reportedly not a common configuration in production setups but some applications may ignore decode errors for debugging reasons. As a result, the impact and exposure will vary depending on the targeted application and some applications may be more vulnerable to attacks than others. Remote attackers can exploit this issue with a maliciously crafted SSL client certificate. CAN-2003-0543 and CAN-2003-0544 correspond to these two denial of service issues. The issues are reported to exist in SSLeay and OpenSSL versions prior to 0.9.7c or 0.9.6k. Another vulnerability related to ASN.1 parsing was reported in OpenSSL 0.9.7. ASN.1 encodings that are rejected by the parser due to being invalid may potentially trigger a memory management error. In particular, a double free may result due to an ASN.1 structure (ASN1_TYPE) being deallocated incorrectly. This reportedly could be leveraged to corrupt stack memory. In this manner, sensitive stack variables such as instruction pointers could be overwritten with attacker-supplied values. The issue could be exploited by remote attacks via a maliciously crafted SSL client certificate. This issue has been assigned CVE name CAN-2003-0545. An additional weakness was reported that may aid in exploitation of these issues. In some circumstances, a client may force a server to parse a client certificate when one has not been specifically requested. This could even occur with server implementations that don't enable client authentication. Any applications which use the OpenSSL ASN.1 library to handle external data may present an attack vector for these vulnerabilities. These issues are pending further analysis and will be separated into individual BIDs when analysis is complete. It should be noted that only the k8, k9, and k91 images for Catalyst 6500 series switches and 7200 series Routers of the 12.2SX and 12.2SY release trains are affected. OpenSSL SSLv2 Client_Master_Key Remote Denial Of Service Vul... BugTraq ID: 8746 Remote: Yes Date Published: Oct 02 2003 Relevant URL: http://www.securityfocus.com/bid/8746 Summary: OpenSSL is an open source implementation of the SSL protocol. OpenSSL SSLv2 has been reported prone to a remotely triggered denial of service when processing a specially crafted malicious CLIENT_MASTER_KEY message. It has been reported that a remote attacker may use a maliciously crafted CLIENT_MASTER_KEY message to influence the execution flow of a vulnerable service implementing SSLv2 into a die() procedure. This will effectively cause the affected process to abort, denying service to legitimate users. An attacker may flood an affected service with malicious CLIENT_MASTER_KEY messages, persistently denying service for legitimate users. Other attacks may also be possible. The impact and exposure may vary depending on the particular applications that use vulnerable OpenSSL libraries. This vulnerability is not reported to be present in OpenSSL versions greater than 0.9.6f of the 0.9.6 series of releases, because the use of the die() procedure is no longer implemented. It is not known whether the 0.9.7 series is also affected. FreeBSD Kernel ProcFS Handler UIO_Offset Integer Overflow Vu... BugTraq ID: 8748 Remote: No Date Published: Oct 02 2003 Relevant URL: http://www.securityfocus.com/bid/8748 Summary: All versions of the FreeBSD kernel have been reported prone to an integer overflow vulnerability. The issue presents itself in the procfs handling procedures, and has been reported to be due to a lack of sufficient sanity checks performed on 'uio' offset parameters. It has been reported that a local attacker may exploit this condition because it is possible to indirectly influence the value for the 'uio' offset. Ultimately an attacker may trigger an integer overflow or underflow condition. This may result in a read attempt from non-resident kernel memory, triggering a kernel panic and effectively denying service to legitimate users. A local attacker may also exploit this issue to disclose potentially sensitive data stored in regions of memory that would otherwise be restricted. This issue has been reported to be exploitable on systems that have procfs enabled. FreeBSD Kernel Readv() Integer Overflow Vulnerability BugTraq ID: 8749 Remote: No Date Published: Oct 02 2003 Relevant URL: http://www.securityfocus.com/bid/8749 Summary: A local vulnerability has been discovered within the FreeBSD kernel. The problem occurs within the readv() system call, which is used to read data and scatter it into an arbitrary number of buffers specified by an argument. When a file is accessed by a system call in FreeBSD, such as open() or dup2(), the reference counter (f_count) for that file is incremented using the fhold() function and when access is complete the counter is decremented by fdrop(). It has been discovered that the readv() system call fails to call the fdrop() function after a specific procedure had previously triggered a call to fhold(). As a result, by triggering a large number of calls to fhold() in a call to readv(), it may be possible to cause the f_count integer value to wrap. It has been reported that this integer overflow can be triggered by supplying an overly large iovcnt variable in a call to readv(). As a result, an attacker may potentially be capable of trigger kernel memory corruption. This could ultimately result in a system panic or could possibly be leveraged to elevate local privileges to that of the root user. FortiGate Firewall Web Filter Logs HTML Injection Vulnerabil... BugTraq ID: 8750 Remote: Yes Date Published: Oct 02 2003 Relevant URL: http://www.securityfocus.com/bid/8750 Summary: FortiGate are a series of commercial firewall appliances which run an embedded operating system entitled FortiOS. The FortiGate web interface is prone to an HTML injection vulnerability. Denied requests are logged into a web filter log which is viewable through the web administrative interface. HTML and script code will not be sanitized when these requests are logged. To exploit this issue, the attacker must construct for a resource that will be denied by the firewall, based on the defined policies of the targeted firewall. Malicious could then be embedded in the request, which will be logged as part of the request. An attacker could exploit this to cause hostile code to be rendered in the browser of an administrative user who views the logs. This could result in theft of cookie-based authentication credentials from the firewall administrator, potentially allowing for firewall compromise. Since the attacker can control how the logs will be rendered to the administrator, it is also possible to spoof or conceal log entries. This issue reportedly exists in FortiOS releases prior to 2.50MR4. [ hardwae ] Inter7 VPopMail Configuration File Insecure Default Permissi... BugTraq ID: 8751 Remote: No Date Published: Oct 02 2003 Relevant URL: http://www.securityfocus.com/bid/8751 Summary: vpopmail is a freely available, open source virtual domain handling software package. It is available for the Unix and Linux operating systems. A problem has been identified in the default configuration of vpopmail. Because of this, an attacker may be able to gain access to potentially sensitive information. The problem is in the creation of the configuration file. When vpopmail is compiled with MySQL support, authentication data is stored in the /etc/vpopmail.conf file. This file is created with world-readable permissions, which may reveal sensitive information such as authentication credentials for the database. An attacker could use these credentials to potentially gain access to the database as the vpopmail database user. This problem has been reported on Gentoo Linux, but may affect other operating systems. Cisco CatOS Password Prompt Unauthorized Remote Command Exec... BugTraq ID: 8752 Remote: Yes Date Published: Oct 03 2003 Relevant URL: http://www.securityfocus.com/bid/8752 Summary: It has been alleged that it is possible for remote attackers to execute arbitrary commands without proper authorization. Reportedly it is possible to execute shell commands from the password prompt on a device running a vulnerable version of CatOS. The attacker must be able to connect to a vulnerable device via telnet, though it has not been ruled out that other remote administrative services such as SSH do not also present attack vectors. The discoverer of this vulnerability has stated that it is possible to exploit this issue by submitting a shell command to the password prompt, followed by a space and a question mark. Symantec has not been able to confirm the existence of the vulnerability, which if of a very serious nature. However, the author of the report insists that the issue is legitimate. This BID will be updated or retired based on any follow-up information that becomes available. This issue has been reported in CatOS versions 5.4(2) and 5.5(2) on Cisco Catalyst 6509 switches. Other devices and CatOS versions may also be similarly affected. Cisco has replied to this issue stating that it cannot be used to execute commands, retrieve information from the device, or reveal information about traffic processed by the device. Details are available to registered Cisco users at: http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCdr87435 Since this issue cannot be exploited to compromise any security properties on the device, this BID will be retired. [ hardware ] Cisco PIX ICMP Echo Request Network Address Translation Pool... BugTraq ID: 8754 Remote: Yes Date Published: Oct 03 2003 Relevant URL: http://www.securityfocus.com/bid/8754 Summary: A problem has been reported in Cisco PIX network firewalls when global IP address pools are exposed to ICMP traffic. This may result in a denial of service to network resources. The problem is in the handling of ICMP echo requests. When a pool of addresses is dedicated to the task of network address translation, the Cisco PIX behavior dictates that traffic received for a specific address means that the address is in use. However, ICMP echo traffic floods for addresses in the Network Address Translation (NAT) pool keeps the addresses in an active state, whether or not the addresses are actually in use. Because of this, it is possible for a remote system to flood the host with requests for addresses in the pool, exhausting the pool of NAT addresses, and preventing traffic from crossing the PIX to external points. [ hardware ] Cisco LEAP Password Disclosure Weakness BugTraq ID: 8755 Remote: Yes Date Published: Oct 03 2003 Relevant URL: http://www.securityfocus.com/bid/8755 Summary: Cisco LEAP is a mutual authentication algorithm based on Extensible Authentication Protocol (EAP). LEAP is used with wireless networks and relies on user's logon password for authentication. Weaknesses in the Cisco LEAP protocol been reported to exist in the software that may allow a remote attacker to gain access to user passwords shared by the client and the network. This problem may allow an attacker to brute force user passwords by employing dictionary attacks. Successful exploitation of this weakness may allow a remote attacker to steal authentication information, potentially allowing for unauthorized network access. [ hardware ] Sun Cobalt RaQ Message.CGI Cross-Site Scripting Vulnerabilit... BugTraq ID: 8757 Remote: Yes Date Published: Oct 03 2003 Relevant URL: http://www.securityfocus.com/bid/8757 Summary: RaQ is a server appliance originally developed by Cobalt. It is now distributed and maintained by Sun Microsystems. A problem with message.cgi script used by Cobalt RaQ appliances could lead to cross-site scripting. This could result in attacks attempting to steal authentication information. The problem is in the handling of input by the message.cgi script. Due to insufficient sanitizing of input, it is possible to render arbitrary script code through the vulnerable script on Cobalt RaQ systems. The attacker must pass the malicious input through the info variable. [ hardware ] Conectiva Vixie-Cron Package Potential Denial Of Service Vul... BugTraq ID: 8759 Remote: No Date Published: Oct 03 2003 Relevant URL: http://www.securityfocus.com/bid/8759 Summary: Vixie cron is an implementation of the popular UNIX program that runs user-specified programs at periodic scheduled times. The Conectiva Vixie-Cron package has been reported prone to a potential denial of service vulnerability. The issue was introduced in a previous Vixie-Cron package update that was designed to address the vulnerability described in BID 2687. This package was found to introduce a problem whilst using cron.allow and cron.deny, to control access to the crontab application. It has been reported that if these files contain more than one user the crontab program will fail. A local attacker, who has the ability to write data into cron.allow and cron.deny files, may instigate an efficient denial of service against the crontab program. Conectiva has addressed this issue by releasing an updated package; all users are advised to apply the applicable packages as soon as possible. Netscreen ScreenOS DHCP Packet Buffer Padding Information Le... BugTraq ID: 8762 Remote: Yes Date Published: Oct 03 2003 Relevant URL: http://www.securityfocus.com/bid/8762 Summary: NetScreen is a line of Internet security appliances integrating firewall, VPN and traffic management features. ScreenOS is the software used to manage and configure the firewall. NetScreen supports Microsoft Windows 95, 98, ME, NT and 2000 clients. A vulnerability has been discovered in Netscreen ScreenOS when the associated device is acting as a DHCP server. Appliances that are not hosting DHCP services are not affected by this issue. The problem specifically lies in that fact that the application fails to re-initialize or zero out a specific memory buffer prior to using the memory to generate DHCP response packets. It has been discovered that this buffer may have previously been used to store HTTP management session information. An attacker could exploit this issue by making a DHCP request and recording the sensitive data located within the packet. This could ultimately expose encoded authentication credentials to the attacker that could be used to launch further attacks against the appliance. [ hardware ] Conexant AccessRunner DSL Console Authentication Bypass Vuln... BugTraq ID: 8765 Remote: Unknown Date Published: Oct 04 2003 Relevant URL: http://www.securityfocus.com/bid/8765 Summary: The Conexant AccessRunner DSL Console is the interface for administering and configuring the DSL device. The Conexant AccessRunner DSL Console is vulnerable to an authentication bypass issue. Reportedly, when the device prompts a user for a password, an attacker can bypass the authentication by simply entering an invalid password. When the screen displaying the incorrect password message is displayed, the attacker simply has to press the 'Enter' key to gain access to the console. ** The discoverer of this issue has reported that it may not be present in some devices. There is currently no known reason for why some devices are vulnerable while others are not. This record will be updated if and when further details become available. [ hardware ] JBoss HSQLDB Remote Command Injection Vulnerability BugTraq ID: 8773 Remote: Yes Date Published: Oct 06 2003 Relevant URL: http://www.securityfocus.com/bid/8773 Summary: JBoss is a freely available, open source Java Application server. It is distributed and maintained by JBoss Group and is available for a number of platforms including Microsoft Windows and Unix/Linux variants. A remote command injection vulnerability has been reported in JBoss. The issue is reportedly exposed via the HSQLDB component, which is a SQL database server that manages JMS connections. A number of unspecified flaws cause this condition, including programming errors in the sun.* classes, logic errors in the org.apache.* classes of the JDK and the default configuration settings. As a result, it is possible to pass commands to the HSQLDB component via the port it listens on. It should be noted that the port may vary between versions, by default it is 1701/TCP for version 3.2.1 and 1476/TCP for 3.0.8. It has been reported that this issue could be exploited to mount a number of attacks, including execution of database commands, denial of service attacks, log manipulation, information disclosure and execution of operating system commands on some supported platforms. This issue is reported to exist with JBoss 3.2.1/3.0.8 on any Java 1.4.x-enabled platforms. Other versions may be similarly affected. The consequences may vary depending on the capabilities of the underlying operating system, but it is believed that this could be exploited to execute arbitrary operating system commands on Windows 2000 and XP systems. SuSE Linux SuSEWM Configuration File Insecure Temporary File... BugTraq ID: 8778 Remote: No Date Published: Oct 06 2003 Relevant URL: http://www.securityfocus.com/bid/8778 Summary: SuSEConfig is a component of the SuSE Linux operating system. It is designed to be a standardized configuration tool to SuSE operating systems. A problem exists in the SuSEWM configuration file used by SuSEConfig. Because of this, it may be possible for a local attacker to gain elevated privileges. The problem is in the handling of temporary files. When the configuration file is executed by SuSEConfig, the predictable temporary file /tmp/susewm.$$ is created, where $$ signifies an arbitrary value. Improper file creation checks make it possible for an attacker to symbolically link a predicted file name to a sensitive system file. Upon execution of SuSEConfig, the contents of the file at the end of the symbolic link will be modified. The reported impact is privilege escalation, though the method through which this is gained is unclear. This BID will be further updated as more information becomes available. SuSE Linux JavaRunt Configuration File Insecure Temporary Fi... BugTraq ID: 8779 Remote: No Date Published: Oct 06 2003 Relevant URL: http://www.securityfocus.com/bid/8779 Summary: SuSEConfig is a component of the SuSE Linux operating system. It is designed to be a standardized configuration tool to SuSE operating systems. A problem exists in the JavaRunt configuration file used by SuSEConfig. Because of this, it may be possible for a local attacker to gain elevated privileges. The problem is in the handling of temporary files. When the configuration file is executed by SuSEConfig, the predictable temporary file /tmp/.java_wrapper is created. Improper file creation checks make it possible for an attacker to symbolically link the predicted file name to a sensitive system file. Upon execution of SuSEConfig, the contents of the file at the end of the symbolic link will be corrupted, potentially with attacker-supplied data. Exploitation could permit privilege escalation. The reported impact is privilege escalation, though the method through which this is gained is unclear. This BID will be further updated as more information becomes available. SLocate User-Supplied Database Heap Overflow Vulnerability BugTraq ID: 8780 Remote: No Date Published: Oct 06 2003 Relevant URL: http://www.securityfocus.com/bid/8780 Summary: slocate is the Secure Locate program. It is available for various UNIX and Linux operating systems, and is maintained by public domain. It has been reported that a vulnerability exists in the handling of user-supplied databases by slocate. Because of this, an attacker may be able to gain elevated privileges. The problem is a heap-based off-by-one condition. Because of this, it is possible for an attacker to potentially overwrite memory management structures with attacker-supplied values. This could allow an attacker to execute code with the privileges of the slocate program, typically installed with setgid privileges of the slocate group. This problem may be related to the issue identified in Bugtraq ID 7629. _______________________________________________ gull-annonces mailing list [EMAIL PROTECTED] http://lists.alphanet.ch/mailman/listinfo/gull-annonces
