Category Archives: Emerging Threats

Denial of Service in Linux Kernel

Posted on by
Reply

Two denial of service vulnerabilities were reported in Linux kernels prior to 2.6.23.8 this weekend.

The first is caused by a design flaw in the “wait_task_stopped()” function. It is locally exploitable by manipulating the state of a child process. Kernel version 2.6.24-rc1 is also known to be vulnerable. See CVE-2007-5500 for more details.

The second involves a design flaw in the “write_queue_from” which creates a NULL-pointer issue. This vulnerability is remotely exploitable by sending the system a specially crafted ACK packet. See CVE-2007-5501 for more details.

The original advisory can be viewed at:
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.8

Multiple Buffer Overflows in Samba

Posted on by
Reply

A new samba patch was released yesterday to address two buffer overflows. The first allows for the execution of arbitrary code when the WINS support option is enabled. An attacker would send specially crafted WINS requests to take advantage of this vulnerability. The second d can be exploited by sending a specially crafted GETDC mailslot request. For this second exploit to succeed samba must be configured as a Domain Controller. Samba versions 3.0.0-3.0.26a are know to be vulnerable to these issues.
The original advisory and patches are available at:
http://us1.samba.org/samba/history/security.html

Apple OS X Updates

Posted on by
Reply

Apple has released new security updates for Mac OS X. The updates address a variety of issues including vulnerabilities in the Adobe Flash Player, AppleRAID, BIND, FTP, the kernel and various sub-systems. Successful exploitation of these issues could lead to system access, privilege escalation, Denial of Service issues, etc.

All users are strongly encouraged to update to Mac OS X 10.4.11 or apply Security Update 2007-008.

Full details can be found in the original Apple advisory:
http://docs.info.apple.com/article.html?artnum=307041

Windows updates

Posted on by
Reply

Yesterday was patch Tuesday for Microsoft. This time around only two security fixes were released, one of them fixed a critical issue though. That would be MS07-061, which is known to be exploitable. The exploit allows command execution on the host, so this is a very important update. Make sure all desktop systems are patched immediately. The other updates fixes a potential DNS spoofing issue, described in MS07-062.

Avaya vulns

Posted on by
Reply

Avaya is getting hit again with multiple vulnerabilities. Over the past month, there have been several, so it’s pretty obvious that attackers are digging deep into Avaya’s systems. Fortunately these new vulns are limited to DoS and local information leakage. The DoS affects  Avaya CM 3.0, Intuity, MSS, Message Networking, CCS/SES, and AES. The info leakage issue affects Avaya CMS R12, R13(.1), R14, and Avaya IR 1.3 and 2.0, on Solaris 8, and 2.0 and 3.0 on Solaris 10. All of these issues have already been fixed by Avaya, get the latest versions if you haven’t already.

IE exploit, new attacker tools

Posted on by
Reply

An exploit has been released into the wild that takes advantage of an Internet Explorer bug described in MS-07-055. The exploit currently only works on Windows 2000 with IE 5.0, 5.5 and 6.0 SP1, but attackers are sure to be working on a version for XP which would cause a much larger issue. Vista is not affected by this vulnerability, so if you’re running on that platform, there’s no cause for alarm here.

Some new tools have also been released into the public. The Metasploit project is continuing to be developed, and causing headaches for system admins everywhere. A new version was released in beta, so look forward to new exploits being developed for that framework. Some new SIP attack tools were also released. SIPVicious is an attackers tool package that’s able to scan, war dial and crack SIP PBX’s. VOIP is still getting hit hard, and we don’t see any calming in the future.

Don’t Open that Jar:

Posted on by
Reply

A vulnerability in the handling of the jar: URI handler has been announced. The way that browsers, notably Firefox, handle the jar: handler allows for persistent cross site scripting. Any file with the MIME type of zip can be used to exploit this vulnerability, even without the .zip extension. There’s no workaround for this issue right now. Some options include never visiting jar: links in web pages, or installing the development version of NoScript extension for Firefox. The Firefox development team is working on a resolution, but one is not available at this time. For more information, visit the Mozilla bugs page at https://bugzilla.mozilla.org/show_bug.cgi?id=369814.

In other vulnerability news, a PoC has been released for a stack overflow in Adobe Shockwave. Sun Solaris’ version of Mozilla (1.7) is vulnerable to several issues and should be upgraded.

Oracle 10gR2 Vuln, Old AIX Vuln Exploited

Posted on by
Reply

Oracle Database 10g Release 2 is vulnerable to a buffer overflow. This vulnerability is due to an error in the processing of the NAME and OWNER arguments sent to the XDB.XDB_PITRIG_PKG.PITRIG_DROPMETADATA procedure. If the combined length of the two arguments is of a certain length, a buffer overflow will occur and allow the execution of arbitrary code. This vulnerability can only be exploited by authenticated users. Oracle has a fix slated for release in the next Critical Patch Update.

An exploit has been released for an AIX format string vulnerability. The exploit is coded to address CVE-2006-4254. A patch has been available for quite some time. If you’re an admin of an AIX system and haven’t applied any APAR’s lately, now would be the time to consider doing it.

Leopard Clawing WoW?

Posted on by
Reply

MacOS X Leopard has issues with the firewall. For starters, the firewall is deactivated upon installation. Next, the firewall has changed so that it now operates that the application level and performs signature checks. If Apple does not have a digital signature for an application, it will sign the application itself. If at any time, the binary changes, it will be denied internet access. This is causing problems with applications that change their binaries, such as Skype and World of Warcraft. Users having issues with these applications have reported a reinstall fixing the issue. There’s much discussion about this on the WoW forums.

In other news, a new blind SQL injection tool has been released, http://sqlmap.sourceforge.net/. I haven’t personally used this tool but it looks promising. Also, the “cyber jihad” rumored to start on 11/11 is nothing more than a rumor. I remember the last time they tried this and it fizzled out to nothing, just like it likely will this time. At best they may be able to pull off some DoS attacks, but no extra precautions are required if you are regularly vigilant.

OpenBSD Ouchie, Apple QuickTime and Solaris 10 Vulns

Posted on by
Reply

In a pretty rare occurrence, a remote buffer overflow in OpenBSD has been identified. The vulnerability exists in “dhcpd”, the DHCP daemon, and allows denial of service and arbitrary code execution on 4.0 – 4.2. This issue was originally published in May, but new developments have been made in refining the exploits and in details about the issue. Patches are available, and should be installed as soon as possible.

Apple updated QuickTime to fix several identified issues, including some security problems. The updates are now available, and if you use the Apple update service, you should get them applied automatically. The big problem repaired in this release is a heap overflow that can be used to seize control of machines. We mention this update because QuickTime is one of those pesky applications that seem to turn up everywhere, in many organizations. It would likely be wise to check not only workstations, but also any servers that are used in training, multi-media or presentations. QuickTime seems to be a common tool for these mechanisms.

Lastly, Solaris 10 systems have proven to be vulnerable to a new buffer overflow in the monitoring package “srsexec”. This is installed in many Solaris systems, especially those leveraging the centralized console management and administrative console applications. Attackers with local access to the Solaris system can exploit this issue to execute arbitrary code as “root”, since the binary is suid by default. Patches are already available and should be applied as soon as practical.