Do you feel the love? Last week the 'Love Bug' was a hot topic. It appeared on practically every television/radio news broadcast, in newspapers, and even on the cover of today's TIME magazine. While many non-Windows users were boasting that their operating system was not effected, some took a different stand. In the articles 'Could there be a Linux Love Bug?'and 'What We Talk About When We Talk About Love Bugs,' both authors made the point that scripts such as these that also effect Linux, may be just around the corner. Both articles provide a different perspective. I would recommend taking look at these.
Last week, David Corcoran, founder of the Linux SmartCard Project released an interesting paper: 'Introduction To Authentication.' In this feature he describes Unix passwords, their insecurities, RSA, and using RSA PAM authentication.. This paper also includes how intruders gain access to password protected systems, the basics of public key cryptography, digital signatures, and smartcards. The entire paper can be found at: http://www.linuxsecurity.com/feature_stories/feature_story-44.html
Thank you for reading LinuxSecurity.com's weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines and system advisories. It is distributed each Monday by Guardian Digital, Inc.
Would you like to contribute to this newsletter? We'd love to hear from you. Email newsletter-admins@linuxsecurity.com with comments, suggestions, or information on projects you're working on. To subscribe, send an email to newsletter-admins@linuxsecurity.com with "subscribe" in the subject.
May 11th, 2000 - KNapster Vulnerability Compromises User-readable Files
May 10th, 2000 - Secure Shell Authentication Vulnerability
May 9th, 2000 - FreeBSD: gnapster port allows remote users to view local files
May 9th, 2000 - FreeBSD: Buffer overflow in libmytinfo
May 9th, 2000 - Various SGML editing/formatting updates
Firewall News:
May 8th, 2000 - Building a Linux Bunker: Basic Firewalling
May 8th, 2000 - Firewalls For Home Users Are Essential
Cryptography:
May 10th, 2000 - Installing SSH-2 on SuSE 6.x
Linux Host Security:
May 8th, 2000 - Secure Remote Access With SSH
May 9th, 2000 - Cracked! Part 1: Denial and Truth
May 10th, 2000 - Cracked! Part 2: Watching and Waiting
May 10th, 2000 - Pow-Wow With Apache's Hackers
May 11th, 2000 - What We Talk About When We Talk About Love Bugs
May 12th, 2000 - Could there be a Linux Love Bug?
May 13th, 2000 - Security Issues of Auto-upgrades
Linux Server Security:
May 9th, 2000 - Webserver Security (Part II)
May 9th, 2000 - A Complete, Secure User Login System
May 11th, 2000 - Creating Warning Login Banners
May 11th, 2000 - Stoic Distro for the Paranoid
Vendors/Products/Tools:
May 9th, 2000 - LinuxSolve, Inc. Debuts Industry's First
May 10th, 2000 - Sendmail 8.11.0 Beta Release Includes TLS
Linux Security Projects/Open-Source:
May 9th, 2000 - Linux kernel patch from the Openwall Project
May 12th, 2000 - Why Open-Source Software Matters to End Users
Advisories This Week:
May 11th, 2000 KNapster Vulnerability Compromises User-readable Files
It is possible for anyone to obtain any user-readable file by sending a properly formed "GET" command that contains the full path of the file. This vulnerability exists because knapster fails to check that the requested file is an explicitly shared MP3 file before providing it.
May 9th, 2000 Various SGML editing/formatting updates
Various bugs in the SGML tools shipped with Red Hat Linux 6.2 have been fixed. These include: the install-catalog script could not properly remove some catalogs, the docbook-3.0 catalog entry references non-existent files, the stylesheets have a bug that causes problems when producing tax output
May 10th, 2000 Secure Shell Authentication Vulnerability
A vulnerable secure shell distribution is available from the popular Zedz Consultants FTP site (formally known as replay.com). The RedHat Linux RPM ssh-1.2.27-8i.src.rpm contains a PAM patch which contains faulty logic allowing users to essentially pass through the username/password authentication step and gain shell access. It should be stressed that the ssh distribution 1.2.27-7us.rpm and 1.2.27-7i.rpm available from the web site do not contain this vulnerability. The vulnerable distribution (1.2.27-8i.src.rpm) is located in the "incoming" directory at ftp://ftp.zedz.net/pub/cryptoI/incoming (formerly pub/crypto/incoming). It is also possible that the distribution could have been obtained from the pub/crypto/redhat/unsorted directory.
May 9th, 2000 FreeBSD: gnapster port allows remote users to view local files
The gnapster port (version 1.3.8 and earlier) contains a vulnerability which allows remote gnapster users to view any file on the local system which is accessible to the user running gnapster. Gnapster does not run with elevated privileges, so it is only the user's regular filesystem access permissions which are involved. The gnapster port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 3200 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.0 contains this problem since it was discovered after the release.
May 9th, 2000 FreeBSD: Buffer overflow in libmytinfo
libmytinfo allows users to specify an alternate termcap file or entry via the TERMCAP environment variable, however this is not handled securely and contains a overflowable buffer inside the library. This is a security vulnerability for binaries which are linked against libmytinfo and which are setuid or setgid (i.e. run with elevated privileges). It may also be a vulnerability in other more obscure situations where a user can exert control over the environment with which an ncurses binary is run by another user.
May 9th, 2000 FreeBSD: golddig port allows users to overwrite local files
The golddig port erroneously installs a level-creation utility setuid root, which allows users to overwrite the contents of arbitrary local files. It is not believed that any elevation of privileges is possible with this vulnerability because the contents of the file are a textual representation of a golddig game level which is highly constrained. The golddig port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains over 3200 third-party applications in a ready-to-install format. The ports collection shipped with FreeBSD 4.0 contains this problem since it was discovered after the release.
May 8th, 2000 Building a Linux Bunker: Basic Firewalling
This article presents a way to convert any spare machine you have into a useful security gateway for your network, utilizing Network Address Translation (NAT), and the firewalling features present in Linux. This article will assume you have already read and applied the techniques discussed in the Installation and Securing Linux articles in the Linux Focus Area here on SecurityFocus.com.
May 8th, 2000 Firewalls For Home Users Are Essential
This article is a basic introduction to firewalls. "Firewalls are an important part of an infrastructure-based security approach. Generally speaking, a firewall is a computer or a network appliance that runs special software that lets network traffic (in the case of the Internet, TCP/IP packets) be filtered on both the incoming and the outgoing paths." It talks briefly about Check Point, Axent, Rebel.com and the Netwinder, and a few others.
May 10th, 2000 Installing SSH-2 on SuSE 6.x and other System V based systems SSH Secure Shell is the de facto standard for remote logins, with an estimated three million users in 80 countries. It solves the most important security problem on the Internet: hackers stealing passwords. Typical applications include remote system administration, file transfers, and access to corporate resources over the Internet. What you will learn here is how to install SSH2 using it's default settings and how to set it up so that the SSH daemon (sshd2) starts when your system reaches a particular run level. These instructions are SuSE 6.x specific but can be easily ported to work on any Sys V Linux distro.
The secure shell protocol (SSH) is one way to provide remote access without giving your information to anyone who might be watching. SSH provides a way to log in to another computer, like rsh or telnet, while encrypting all the information that is exchanged between two computers. Be advised that SSH is not the end of the solution. SSH is a very good place to start, but it doesn't replace other security measures. Firewalls and packet filters can help prevent spoofing. Kerberos, S/Key, and other authentication systems can be used to further augment the end-to-end encryption provided by SSH.
In this article, Noel talks about how to determine if what's happened is an attack, or a misunderstanding. "The phone rings or an email comes in and someone tells you that they have reason to believe that your box or boxes have been cracked. Do you believe it? Is it true? What do you do next? What should you not do? This is the situation any System Administrator can find ourselves in. After all anyone can get these calls and emails. I got a call last month that someone was being attacked from a mail server. It turned out that it was not an attack it was an identd query that was being misunderstood. But some times the call is for real."
May 10th, 2000 Cracked! Part 2: Watching and Waiting
In the second article Noel continues the story of when some Unix boxes that he helped admin were cracked. This article talks about watching the cracker with a sniffer and talking to the the FBI's Computer Crimes Squad. "On this Linux box I set up a sniffer to watch for traffic going to the ISP and some of the sites we had suspected he was coming from. We thought that by watching him to see were he was coming from and what he was doing that we could get some idea of who he was, what his motivations were and most important what he was doing. We also thought that we could use this to find out what kind of skills he had. Was he a script kiddie, or a super cracker like it was claimed?"
Can you be scalped nicely? Apache seems to think being red in the face beats being red in the accounting department after an embarrassing encounter with some clever and well-meaning hackers.
May 11th, 2000 What We Talk About When We Talk About Love Bugs
While it is fun to pick on Microsoft about the love bug virus, those of us in the Linux community should ask ourselves: are we clean? The answer is: not at all. We are just a combination of not having a high enough visibility and pure luck. The visibility issue has to do with the fact that if you are going to write a virus, then writing it for MS-Windows is the best target. There are just more of those systems out there.
Nobody could have missed last week's "love bug" furore. The email-borne virus swept the globe, affecting innumerable Windows users and bogging down help desks and tech support departments worldwide. The uproar in the mainstream press was matched only by the righteous smugness of Linux users on mailing lists, newsgroups, and discussion websites. The general consensus is that Linux is virtually immune to viruses and was not affected by the "love bug". However, the reasons for Linux's immunity, and the likelihood of future threats, bear closer examination.
Package managers with download capabilities make it easy to download and install the latest software releases, bugfixes, and security patches. Could they also make it easy to download and install the latest exploits without your knowing about it? In today's editorial, I put that question to representatives of Red Hat and Debian, makers of the two most widely-used Linux package management systems.
This second part of our two-part series on webserver security explores the problem of keeping private data in publicly accessible areas of you server and keeping data from untrustworthy sources from entering your system. Covers Apache, FTP server, PHP and CGI issues.
May 9th, 2000 A Complete, Secure User Login System
Tim Perdue writes about a new PHP library he's written. "When I started seeing spam messages posted to the new column annotation system, I knew I would have to create some sort of user authentication system that helps weed out the losers. ... So the new system needed to rely on cookies while not being totally exploitable. It was an interesting dilemma. I knew I couldn't simply set a user_name cookie when they logged in (the user name cookie is easy to spoof). I also knew I didn't want to set a simple hash and have to confirm that hash against my database."
Here is a good source for help in developing a Warning banner. "A requirement for successfully prosecuting those unauthorized users who improperly use a government computer is that the computer must have a warning banner displayed at all access points. That banner must warn authorized and unauthorized users."
"Finally, a Linux distribution geared at easing the security-conscious minds of such self-professed paranoiacs as G. Gordon Liddy has hit the streets. Nexus developers are taking names, ranks and numbers.
According to its makers, Nexus is a free, portable and secure Linux distribution. "Its target audience is the enterprise application, the paranoid system administrator and other areas where security is not a `nice-to-have' additional feature, but an essential requirement," claimed anonymous Nexus developers in a recent announcement.
May 9th, 2000 LinuxSolve, Inc. Debuts Industry's First "Immunized" Secure Server Appliances Running on Linux
LinuxSolve(TM), Inc., the Santa Clara-based developer and integrator of pre-packaged turnkey security solutions for e-business, will be showing its line of "immunized" secure server appliances this week at Networld + Interop 2000 in Las Vegas, Nevada. The secure server appliances run on the unique LinuxSolve(TM) SecureWorks(TM) server platform, a hardened version of the Red Hat Linux operating system containing several security enhancements over all other Linux distributions commercially available today. LinuxSolve(TM) will be showing the LinuxSolve(TM) WebSolve(TM), InterSolve(TM), and SpeedSolve(TM) Secure Servers from May 9 through May 12 at the Las Vegas Convention Center in booth 1979, which belongs to their business partner, WireX(R) Communications.
May 10th, 2000 Sendmail 8.11.0 Beta Release Includes TLS
"... Transport Layer Security (TLS) is now in open source sendmail. As the official announcement explains, "Ever since the easing of crypto export regulations in the United States, we have been working on releasing the STARTTLS and SMTP Authentication Security Layer code into the open source. We have finally obtained legal approval to do so and Sendmail, Inc. has donated the STARTTLS code to the open source version." If that ain't worth an uptick in the version number, what is?"
May 9th, 2000 Linux kernel patch from the Openwall Project
This patch is a collection of security-related features for the Linux kernel, all configurable via the new 'Security options' configuration section. In addition to the new features, some versions of the patch contain various security fixes. The number of such fixes changes from version to version, as some are becoming obsolete (such as because of the same problem getting fixed with a new kernel release), while other security issues are discovered.
May 12th, 2000 Why Open-Source Software Matters to End Users
Open-source software (OSS) is important to end-users since it is a critical enabler of the Internet, as much of the code that drives the Internet derives from OSS. In fact, all Internet, intranet, and extranet applications depend on OSS, since many servers on the Internet are built using at least some OSS for operating system, web server, mail, and other Internet infrastructure functions. While it is possible to construct the Internet and web applications completely with proprietary software, OSS counters the proprietary grip of vendors who lock up data and lock in obsolescence. OSS ensures that the web remains open and based on open standards.
News: Forums
