Lucene search
Packet StormPACKETSTORM:11954HistoryAug 17, 1999 - 12:00 a.m.
sans.sec-v3n5.txt
1999-08-1700:00:00
Packet Storm
packetstormsecurity.com
41
`Subject: May SANS Security Digest Vol. 3 Num. 5
Fr: Rob the SANS Mailing List Guy
Here's the May SANS Network Security Digest. I hope your spring
is going well!
RK
-----BEGIN PGP SIGNED MESSAGE-----
=================================================================
| |
| @@@@ @@ @ @ @@@@ |
| @ @ @ @@ @ @ |
| @@@@ @ @ @ @ @ @@@@ Vol. 3, No. 5 |
| @ @@@@@@ @ @ @ @ May 20, 1999 |
| @ @ @ @ @ @@ @ @ |
| @@@@ @ @ @ @ @@@@ |
| |
| The SANS Network Security Digest |
| Editor: Michele D. Crabb-Guel |
| |
| Contributing Editors: |
| Fred Avolio, Steve Bellovin, Matt Bishop, |
| Bill Cheswick, Jean Chouanard, Liz Coolbaugh, |
| Dorothy Denning, Dan Geer, Mark Edmead, Rob Kolstad, |
| Richard Jackson, Peter Neumann, Alan Paller, |
| Marcus Ranum,Gene Schultz, Gene Spafford, John Stewart |
| |
====A Resource for Computer and Network Security Professionals===
CONTENTS:
i) Updated Intrusion Detection FAQ
ii) Final Tutorial Selection for Network Security 1999 (NS99)
iii) SANS Roles and Responsibilities Survey
iv) Summaries of the SANS99 Technical Conference
v) June 1 Web Briefing
1) CIAC ISSUES INFORMATION BULLETIN
2) HP SECURITY PROBLEMS AND PATCHES
3) SUN SECURITY PROBLEMS AND PATCHES
4) SGI SECURITY PROBLEMS AND PATCHES
5) IBM AIX SECURITY PROBLEMS AND PATCHES
6) COMPAQ SECURITY PROBLEMS AND PATCHES
7) NT/WIN95/WIN98 SECURITY PROBLEMS AND PATCHES
8) BSDI/FreeBSD/NetBSD/OpenBSD PROBLEMS AND PATCHES
9) LINUX SECURITY PROBLEMS AND PATCHES
10) CISCO SECURITY PROBLEMS AND PATCHES
11) GENERAL VIRUS INFORMATION
12) QUICK TIDBITS
*****************************************
i) Updated Intrusion Detection FAQ
The new Intrusion Detection FAQ has been updated to version 0.6 at
http://www.sans.org/IDFAQ/ID_FAQ.htm; thanks to Stephen Northcutt and
his cast of dozens of volunteers.
=======================================================================
ii) Final Tutorial Selection for Network Security 1999 (NS99)
Final selections for courses at Network Security 99 (New Orleans, October
3-10) have been made. They include the highest rated programs from
SANS99 plus several new ones that were vetted at SANS99 including
Forensics, Hacker Tools, and Cisco Security Features. For those who
require long lead times, the NS99 registration form is posted at
https://www.sans.org/ns99register.htm, though the supporting web pages
are not quite ready yet. If you register for the conference and at
least one course before June 30, you'll get an extra gift certificate
for books at Amazon.com.
=======================================================================
iii) SANS Roles and Responsibilities Survey
The SANS 1999 Security Roles and Responsibilities Survey aims to create
a chart that correlates job titles with job functions and
responsibilities. It takes 12-15 minutes to fill in for four positions.
Those who participate receive results of the survey during June.
=======================================================================
iv) Summaries of the SANS99 Technical Conference
Chris Calabrese created a session-by-session easy-to-read review of the
SANS99 (Baltimore, May 7-9) sessions he attended, and it is posted at
http://www.sans.org/sans99sum.htm. It's so well written it almost feels
like you were there.
=======================================================================
v) June 1 Web Briefing
See http://www.sans.org/jun1.htm to register for the June 1 web briefing.
The first hour of this two-parter is: What The Attackers Know About You:
Anatomy of A Christmas '98 Attack which goes behind the scenes and
illuminates the processes, skills, and thinking of a sophisticated
attacker. Part 2, the second hour, is the first SANS ToolTalk: How to
Get Maximum Value Out of TripWire.
=======================================================================
1) CIAC ISSUES INFORMATION BULLETIN (05/17/1999)
CIAC released an Information Bulletin regarding web security. They
continue to receive daily reports regarding web sites that have been
hacked. Many of these hacks could be avoided by using good security
practices. The information bulletin outlines a number of tips to better
secure your web server. For more information see the CIAC Information
Bulletin at:
http://ciac.llnl.gov/ciac/bulletins/j-042.shtml
=======================================================================
2) HP SECURITY PROBLEMS AND PATCHES
The HP Electronic Support Center is located at:
http://us-support.external.hp.com/ (US and Canada)
http://europe-support.external.hp.com/ (Europe)
Note: Log into the HP Electronic Support Center prior to accessing a
specific support page as identified below.
---------------
HP last released a security bulletin on 04/20/1999.
=======================================================================
3) SUN SECURITY PROBLEMS AND PATCHES
Sun Security Bulletins are available at:
http://sunsolve.sun.com/pub-cgi/secBulletin.pl
Sun Security Patches are available at:
http://sunsolve.sun.com/pub-cgi/show.pl?target=patches/patch-access/
---------------
Sun last released a security bulletin on 02/10/1999.
=======================================================================
4) SGI SECURITY PROBLEMS AND PATCHES
SGI maintains a security home page at:
http://www.sgi.com/Support/security/security.html
SGI patches are available at:
ftp://ftp.sgi.com/security/
---------------
SGI last released a security advisory on 03/10/1999.
=======================================================================
5) IBM AIX SECURITY PROBLEMS AND PATCHES
IBM maintains a security home page:
http://www.brs.ibm.com/services/brs/ers/brspwers.nsf/Info/Resources/
IBM maintains an on-line support center:
http://service.boulder.ibm.com/cgi-bin/support/rs6000.support/databases/
---------------
A) IBM has not released any ERS Alerts recently; however they continue
to release security related APARS (Authorized Problem Analysis Reports)
on a regular basis. For general APAR information see:
http://service.boulder.ibm.com/cgi-bin/support/rs6000.support/databases
For latest security APAR, you need to enter the key word 'security' into
the search window, and put an appropriate date range (e.g, April 1999
to May 1999), and select on word stems. The list is then displayed.
Important APARS to review for the last month include:
IX86764 - Linking Users to membership group problem
IX71110 - VSD Driver Security Enhancements
IX89365 - Security related updates in AIX 4.3
IX89364 - Security related updates in AIX 4.2
IX89362 - Security related updates in AIX 4.1
There is a Bugtraq article on the AIX fixes at:
http://www.geek-girl.com/bugtraq/1999_2/0375.html
=======================================================================
6) COMPAQ SECURITY PROBLEMS AND PATCHES
Compaq Tru64 UNIX, OpenVMS, Ultrix, and Windows patches located at:
http://ftp.service.digital.com/public/
---------------
A) 5/11/99 - Compaq announced a Tru64 UNIX vulnerability in
/usr/dt/bin/dtlogin which may allow users to gain root privileges.
Versions affected are V4.0B, V4.0D, V4.0E, V4.0F. A patch is available
for the affected versions. The Compaq reference number is SSRT0600U.
For more information see the page:
http://ftp.service.digital.com/public/osf/v4.0b/ssrt0600u.README/
---------------
B) 5/7/99 - Compaq updated an announcement about a Tru64 UNIX
vulnerability in /usr/tcb/bin/edauth which may allow users to gain
unauthorized security information. Versions affected are V3.2G, V4.0,
V4.0A, V4.0B, V4.0C, V4.0D, V4.0E. A patch is available for the affected
versions. The Compaq reference number is SSRT0600U. For more information
see the page:
http://ftp.service.digital.com/public/osf/v4.0b/ssrt0588u.README/
=======================================================================
7) NT/WIN95/WIN98 SECURITY PROBLEMS AND PATCHES
The Microsoft Security page is located at:
http://www.microsoft.com/security/
Additional NT Security Related web pages may be found at:
http://www.ntbugtraq.com/
http://www.ntbugtraq.com/ntfixes.asp
http://www.ntsecurity.net/
---------------
A) 05/20/1999 - Microsoft released a patch that corrects
a security vulnerability in the Window NT Remote Access Service (RAS)
on client machines. The vulnerability, which results from a "malformed
phonebook entry", could leave the client vulnerable to a denial of
service attack and under certain conditions, allow a remote user to
execute arbitrary code. Affected software versions NT 4.0. For more
information refer to the Microsoft Security Bulletin (MS99-016) at:
http://www.microsoft.com/security/bulletins/ms99-016.asp
---------------
B) 05/17/1999 - Microsoft released a patch that corrects the
"Malformed Help File" vulnerability. The vulnerability, which results
>from the ability to write an unchecked buffer (hence the malformed
files), may allow a user to run arbitrary code on an Windows NT. The
patch will prevent the code from being executed but does prevent the
writing of the files. For more information refer to the Microsoft Security
Bulletin (MS99-015) at:
http://www.microsoft.com/security/bulletins/ms99-015.asp
---------------
C) 05/07/1999 - Microsoft released a patch to correct a vulnerability
in the Excel 97 virus warning mechanism. The virus warning feature in
Excel 97 is intended to warn the user before launching/opening an external
file. However, under certain conditions, this feature can be bypassed.
For more information refer to the Microsoft Security Bulletin (MS99-014)
at:
http://www.microsoft.com/security/bulletins/ms99-014.asp
A Microsoft Knowledge Base article is also available at:
http://support.microsoft.com/support/kb/articles/q231/3/04.asp
---------------
D) 05/07/199 & 05/14/1999 - Microsoft released a bulletin and later an
update, regarding a "file viewers" vulnerability. The vulnerability,
which is present in some viewers that are shipped as part of IIS or the
Site Server, may allow a web site visitor to view files on the server
if they are able to guess the name of the file and have access rights
to the file as granted by NT ACLs. The vulnerability does not allow the
web site visitor to modify or upload files.
Affected versions are Site Server 3.0 (this version is included with
the Commerce Edition), MS Commercial Internet System 2.0, MS BackOffice
Server 4.0 and 5.0 and MS IIS 4.0. Patches are not available at this
time; however, there are steps customers can take to eliminate the
vulnerability from their site. For more information, see the Microsoft
Security Bulletin (MS99-013) at:
http://www.microsoft.com/security/bulletins/ms99-013.asp
A Microsoft Knowledge Base article is available at:
http://support.microsoft.com/support/kb/articles/q231/3/68.asp
---------------
E) 04/21/1999 - Microsoft released patches for IE versions 4.0 and 5.0
that correct three separate vulnerabilities. The first vulnerability
is similar to the cross-frame security vulnerability where a malformed
URL can be used to execute a script on a server web site. The second
vulnerability, which only affects IE 5.0, is a new variant of the
"untrusted script paste" problem. The third problem involves the "IMG
SRC" tag in HTML which identifies and loads HTML file. However, the
tag can be used to point to any file type, thus potentially exposing
sensitive information.
Affected versions are IE 4.0 and 5.0 on win95, win98 and NT 4.0 platforms.
For more information see the Microsoft Security Bulletin (MS99-012) at:
http://www.microsoft.com/security/bulletins/ms99-012.asp
---------------
F) 04/21/1999 - Microsoft released a patch for the DHTML edit
vulnerability. The DHTML edit control is an Active X control that allows
users to edit HTML text and view how it might look in a web browser.
The vulnerability results from the fact that users can be tricked into
loading and view sensitive information into the edit window and hence
upload it to the operator's web site. Affected versions are IE version
5.0 on win95, win98 and NT 4.0 and IE 4.0 users who have downloaded the
control and are running on the following platforms: win95, win98, and
x86 version of NT 4.0.
The patch corrects the problem by allowing a web site running the safe
scripting area to upload the data only if the requesting host is in the
same domain. For more information, see the Microsoft Security Bulletin
(MS99-011) at:
http://www.microsoft.com/security/bulletins/ms99-011.asp
A Microsoft Knowledge Base article is available at:
http://support.microsoft.com/support/kb/articles/q226/3/26.asp
=======================================================================
8) BSDI/FreeBSD/NetBSD/OpenBSD PROBLEMS AND PATCHES
BSDI maintains a support web page at:
http://www.BSDI.COM/support/
FreeBSD maintains a security web page at:
ftp://ftp.cdrom.com/pub/FreeBSD/CERT/advisories/
NetBSD's Security web page is at:
http://www.NetBSD.ORG/Security/
OpenBSD's Security web page is at:
http://www.openbsd.org/security.html
---------------
BSDI:
No updates for this period.
FreeBSD:
No updates for this period.
NetBSD:
A) 04/21/1999 - NetBSD released a patch for the SVR4 compatibility device
create vulnerability. The script, which creates the devices, has an
error whereby it creates a device with the wrong Major number. The
erroneous device may allow users "to arbitrarily read or write data
stored on the NetBSD portion of the first IDE disk" Affected versions
of NetBSD 1.3.3 and NetBSD-Current prior to 19990420.
For more information, see the NetBSD release note (SA1999-009) at:
http://www.NetBSD.ORG/Security/advisory.html
Or the Bugtraq article at:
http://www.geek-girl.com/bugtraq/1999_2/0215.html
---------------
B) 04/13/1999 - NetBSD released a patch for file a system locking
vulnerability that results in a system panic or hang. There are certain
kernal operations, such a creating a symbolic link, which may cause the
kernal to panic and hang.
Affected versions prior to NetBSD Current on 19990409 are vulnerable.
For more information see NetBSD release note (SA1999-008) at:
http://www.NetBSD.ORG/Security/advisory.html
Or the Bugtraq article at:
http://www.geek-girl.com/bugtraq/1999_2/0109.html
=======================================================================
9) LINUX SECURITY PROBLEMS AND PATCHES
Caldera OpenLinux security information can be found at:
http://www.caldera.com/news/security/index.html
Debian GNU/Linux maintain a security web page at:
http://www.debian.org/security/
Red Hat Linux maintain a support page at:
http://www.redhat.com/support/
Red Hat ftp site:
ftp://updates.redhat.com/
The latest Slackware release and patches can be found at:
ftp://cdrom.com/pub/linux/
S.u.S.E. information can be found at:
http://www.suse.com/
---------------
Caldera:
A) 04/30/1999 - Caldera released a security advisory regarding a directory
change permission in the rsync program. Under certain circumstances,
rsync may change the permissions of a user's home directory which may
allow other users to view sensitive files that they would normally not
have access to view. Vulnerable versions are OpenLinux 1.0, 1.1, 1.2,
1.3 and 2.2 running rsync versions prior to 2.3.1. Version
2.3.1-1.i286.rpm corrects the problem. Users can also manually change
the permissions on their home directory should they discover they are
incorrect. For more information, see the Caldera Advisory at:
http://www.calderasystems.com/news/security/CSSA-1999:010.0.txt
---------------
B) 04/27/1999 - Caldera released a security advisory regarding
incorrect permissions on the /etc/shadow file that will allow anyone to
view the file. Vulnerable versions include OpenLinux 2.2 previous to
coas-1.0-8. The problem can be corrected by doing a "chmod 600
/etc/shadow" or by installing the coas-1.0-8 package. For more
information see the Caldera Advisory at:
http://www.calderasystems.com/news/security/CSSA-1999:009.0.txt
Or the Bugtraq article at:
http://www.geek-girl.com/bugtraq/1999_2/0291.html
---------------
C) 04/20/1999 - Caldera released an advisory regarding buffer overflows
in the procmail program. This problem was first discussed on the Bugtraq
mailing list on 04/06/1999. A patch is available from Caldera. For more
information see the Caldera Advisory at:
http://www.calderasystems.com/news/security/CSSA-1999:007.0.txt
---------------
Debian:
A) 04/22/1999 - Debian Unix reported a buffer overflow problem with
procmail. This is the same procmail problem discussed on the Bugtraq
mailing list on 04/06/1999. A corrected version is available from Debian
at:
http://www.debian.org/security/1999/19990422
---------------
Red Hat:
A) 05/11/1999 - Red Hat announced a fix for a security vulnerability in
the xscreensaver package shipped with Linux 6.0. In the shipped version,
several security checks were disabled. For more information see:
http://www.redhat.com/corp/support/errata/rh60-errata-general.html
---------------
B) 04/16/1999 - Red Hat released security fixes for three separate
programs: NFS, procmail and lpr. For more information see the Red Hat
Errata notes at:
http://www.redhat.com/corp/support/errata/rh52-errata-general.html
http://www.redhat.com/corp/support/errata/rh51-errata-general.html
http://www.redhat.com/corp/support/errata/rh50-errata-general.html
http://www.redhat.com/corp/support/errata/rh42-errata-general.html
---------------
S.u.S.E.:
No reports this period.
=======================================================================
10) CISCO PROBLEMS AND PATCHES
Cisco Systems maintains an Internet Security Advisories page at:
http://www.cisco.com/warp/public/791/sec_incident_response.shtml
---------------
Cisco last released an Internet Security Advisory on 04/13/1999.
=======================================================================
11) GENERAL VIRUS INFORMATION
We will only include items on viruses that have been widely discussed.
This is not meant to be an all-inclusive update on recent virus problems
and solutions.
Virus information is available from a variety of sites, including:
http://www.antivirus.com/
http://www.avpve.com/
http://www.drsolomon.com/
http://www.datafellows.com/
http://www.nai.com/
http://www.sophos.com/
http://www.symantec.com/avcenter/
Good sources for virus myths and hoaxes are:
http://www.kumite.com/myths/
http://ciac.llnl.gov/ciac/CIACHoaxes.html
---------------
A) The CIH/Chernobyl virus received lots of press this past month as
April 26th came and went. The hardest hit region was the far east.
There are a number of variants of the CIH virus, some can overwrite the
hardisk and the flash BIOS of an infected computer, resulting in a
complete loss of data. Various anti-virus product vendors published
alerts concerning CIH and its variants. For more information see the
following resources:
http://www.avertlabs.com/public/datafiles/valerts/vinfo/spacefiller411.asp
http://www.datafellows.com/cih/
http://www.symantec.com/avcenter/venc/data/cih.html
http://www.symantec.com/avcenter/kill_cih.html
http://www.virusbtn.com/VirusInformation/cih.html
CERT released an Incident Note (IN-99-03) on April 26th regarding the
CIH/Chernobyl virus. The note provides a description of the virus and
suggests some possible solutions along with URLs for vendor related
information. The Incident Note can be found at:
http://www.cert.org/incident_notes/IN-99-03.html
=======================================================================
12) QUICK TIDBITS
A) 05/14/1999 - ssh version 1.2.27 is released. This release includes
a number of bug fixes and enhancements. For for the full list, see the
bugtraq article at:
http://www.geek-girl.com/bugtraq/1999_2/0476.html
---------------
B) 05/11/1999 - An article appeared on Bugtraq describing two security
vulnerabilities in INN 2.0 and higher. The first vulnerability may allow
a news user to execute arbitrary programs as root if they can control
the behavior of the inndstart program. The solution requires a source
code change to the inndstart.c module. The second vulnerability results
>from the fact that the inndstart program is not installed in a directory
which is only accessible by the user news. The solution for this problem
requires the inndstart program to be installed in a directory with 0700
permissions. Versions 1.7.2 and lower are not effected by both
vulnerabilities.
For more information, see the Bugtraq article at:
http://www.geek-girl.com/bugtraq/1999_2/0431.html
---------------
C) 05/10/1999 - During the opening session of the SANS99 Technical
Conference, Alan Paller and Rob Kolstad presented SANS Technology
Leadership Awards to the editors of Bugtraq, NTBugtraq and the SANS
Digest as "The Three Most Valuable Security Publications". During the
Fall of 1998, the SANS Community was asked to rate which security
information sources provided them with the most useful information.
The list included such publications as InfoWorld, SysAdmin, and others.
However, the three most selected choices were write-ins. The individuals
who received the awards were:
Elias Levey (a.k.a Aleph1), Editor of Bugtraq
Russ Cooper, Editor of NTBugtraq
Michele D. Crabb-Guel, Primary editor of the SANS Digest
---------------
D) 05/06/1999 - ISS released an XForce Alert reporting multiple
vulnerabilities in Oracle 8. The vulnerabilities, which involve insecure
file creation and manipulation, may allow malicious local users to
exploit the Oracle administrative tools and gain access to view, modify
and append information. For more information see the ISS Xforce Alert
at:
http://www.iss.net/xforce/alerts/advise26.html
---------------
E) 05/02/1999 - Article published on advances in cryptographic code
breaking by an Israeli scientist. Adi Shamir, one of the worlds foremost
cryptographers and the "S" in RSA public-key cryptosystem will soon
introduce a design for a device that will be able to quickly crack the
private keys in public-key cryptography for key sizes of 512 bits or
less. The paper that describes the device was first presented during
EUROCRYPT rump session.
For more information see:
http://www.rsa.com/rsalabs/html/twinkle.html
The paper is available at:
http://jya.com/twinkle.htm
---------------
F) 04/28/1999 - The UK Government announced their completion of the
evaluation of NT 4.0 under the ITSEC regime and has awarded it a rating
of E3/F-C2. For more information see the summary posted by MS at:
http://www.microsoft.com/security/issues/e3fc2summary.asp
---------------
G) 04/07/199 - rsync version 3.2.1 was released. This version corrects
a security vulnerability with transferring empty directories. For more
information see:
http://rsync.samba.org/cgi-bin/rsync?findid=1706#themesg
---------------
H) 04/06/1999 - procmail version 3.13.1 was released. This version
corrects several buffer overflow problems and eliminates keyword conflicts
with newer versions of gcc. The new version may be downloaded from:
http:/www.procmail.org/procmail.tar.gz
For more information, see the Bugtraq article at:
http://www.geek-girl.com/bugtraq/1999_2/0040.html
---------------
I) Kurt Seifried has published a Linux Administrators Security Guide
(LASG). Check it out at: https://www.seifried.org/lasg/
---------------
J) nmap 2.2-BETA4 is now available. For more information on nmap and
to download the new version, go to:
http://www.insecure.org/nmap/index.html#download
******************
Copyright 1999, The SANS Institute. No copying, forwarding, or posting
allowed without written permission (write <[email protected]> for permission).
Email <[email protected]> for information on subscribing. You'll receive
a free subscription package and sample issue in return. To unsubscribe
or change address, forward this note to <[email protected]> with
appropriate instructions.
The digest is available at no cost to practicing security, networking
and system administration professionals in medium and large organizations.
Archives of past issues are posted at http://www.sans.org/digest.htm .
-----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition
iQCVAwUBN0Sn1qNx5suARNUhAQFbrgQAllPqW2KVLug24tjBrn15AeswUJYfki4O
+BnW90NxPAvNU2En1uMfgkv9qVdEzRFnMTlhD9hQ9VOg11BP7cmQ3wKpVgwUMZG5
wuERE9TWe70701DrjgvVm4eMA9Nffr4cAKvg807Sn/C/JkLwYBwOA7BwBT9LXqTR
pcuA+CqZtXk=
=h2FJ
-----END PGP SIGNATURE-----
`