IT security Advisory 0632
IT security Advisory 0632
This week, advisories were released for yaboot, ttmkfdir, Netpbm,ruby, squirrelmail, sysreport, xpdf, kdegraphics, cups, ucd-snmp,
gaim, ethereal, and gpdf. The distributors include Fedora, Gentoo,
and Red Hat.
Hacks: PHP Web Application Security
Today on Hacks From Pax we'll be discussing PHP web application
security. PHP is a great language for rapidly developing web
applications, and is very friendly to beginning programmers, but
some of its design can make it difficult to write web apps that
are properly secure. We'll discuss some of the main security
"gotchas" when developing PHP web applications, from proper
user input sanitization to avoiding SQL injection
vulnerabilities.
Many PHP application vulnerabilities are caused by not properly
initializing variables. This is an example of how PHP, by not
requiring the developer to initialize a variable before using
it, sacrifices security for ease of use. For example, the
following code is easily exploitable.
if (user_auth()) {
$access = true;
}
if ($access) {
do_sensitive_things();
}
This could be exploited by tacking an ?access=true to the
end of the url, and the if ($access) test would be passed
despite the user_auth() function returning false. This hole
could be closed easily by adding a $access = false; at the
top of the script, but not all security holes are this easy
to spot.
Thankfully, PHP now defaults the register_globals option to
off. This setting would pass the access variable sent by the
url to the script as $_GET[access] rather than just $access.
This closes off many of these types of vulnerabilities, but
when writing PHP code, especially code for distribution,
you should never assume that this option will be set
correctly, and always initialize your PHP variables. Users
in a shared hosting environment may not have the ability to
set these options to their most secure setting.
* Always initialize PHP variables before using them.
* Always set register_globals to off, but never write code
that assumes this setting.
* You can use the ini_get() function to determine if
register_globals is set at runtime.
---
Linux File & Directory Permissions Mistakes
One common mistake Linux administrators make is having file and directory
permissions that are far too liberal and allow access beyond that which
is needed for proper system operations. A full explanation of unix file
permissions is beyond the scope of this article, so I'll assume you are
familiar with the usage of such tools as chmod, chown, and chgrp. If
you'd like a refresher, one is available right here on linuxsecurity.com.
Buffer Overflow Basics
A buffer overflow occurs when a program or process tries to store more
data in a temporary data storage area than it was intended to hold. Since
buffers are created to contain a finite amount of data, the extra
information can overflow into adjacent buffers, corrupting or overwriting
the valid data held in them.
Review: The Book of Postfix: State-of-the-Art Message Transport
I was very impressed with "The Book of Postfix" by authors Ralf
Hildebrandt and Pattrick Koetter and feel that it is an incredible
Postfix reference. It gives a great overall view of the operation
and management of Postfix in an extremely systematic and practical
format. It flows in a logical manner, is easy to follow and the
authors did a great job of explaining topics with attention paid
to real world applications and how to avoid many of the associated
pitfalls. I am happy to have this reference in my collection.
Take advantage of the LinuxSecurity.com Quick Reference Card!
Distribution: Fedora
* Fedora Core 4 Update: yaboot-1.3.12-10
4th,
Updated package.
* Fedora Core 4 Update: ttmkfdir-3.0.9-16.1
5th,
This update fixes a problem with ttmkfdir not including native
encodings of Asian TrueType fonts in fonts.scale files used by the X
font server. Users of Chinese, Japanese, and Korean fonts are
recommended to reinstall the font packages for these languages after
updating ttmkfdir.
* Fedora Core 3 Update: ttmkfdir-3.0.9-14.1
5th,
This update fixes a problem with ttmkfdir not including native
encodings of Asian TrueType fonts in fonts.scale files used by the X
font server. Users of Chinese, Japanese, and Korean fonts are
recommended to reinstall the font packages for these languages after
updating ttmkfdir.
* Fedora Core 4 Update: selinux-policy-targeted-1.25.3-12
5th,
Updated package.
Distribution: Gentoo
* Gentoo: Netpbm Arbitrary code execution in pstopnm
5th,
The pstopnm utility, part of the Netpbm tools, contains a
vulnerability which can potentially result in the execution of
arbitrary code.
* Gentoo: Heartbeat Insecure temporary file creation
7th,
Heartbeat is vulnerable to symlink attacks, potentially allowing a
local user to overwrite arbitrary files.
Distribution: Red Hat
* RedHat: Moderate: ruby Internet Security update
5th,
Updated ruby packages that fix an arbitrary command execution issue
are now available. This update has been rated as having moderate
security impact by the Red Hat Security Response Team.
* RedHat: Moderate: squirrelmail Internet Security update
5th,
An updated squirrelmail package that fixes two security issues is now
available. This update has been rated as having moderate security
impact by the Red Hat Security Response Team.
* RedHat: Low: sysreport Internet Security update
9th,
An updated sysreport package that fixes an insecure temporary file
flaw is now available. This update has been rated as having low
security impact by the Red Hat Security Response Team.
* RedHat: Moderate: xpdf Internet Security update
9th,
An updated xpdf package that fixes a security issue is now available
for Red Hat Enterprise Linux 4. This update has been rated as having
moderate security impact by the Red Hat Security Response Team.
* RedHat: Moderate: kdegraphics Internet Security update
9th,
Updated kdegraphics packages that resolve a security issue in kpdf
are now available. This update has been rated as having moderate
security impact by the Red Hat Security Response Team.
* RedHat: Important: cups Internet Security update
9th,
Updated CUPS packages that fix a security issue are now available for
Red Hat Enterprise Linux. This update has been rated as having
important security impact by the Red Hat Security Response Team.
* RedHat: Low: ucd-snmp Internet Security update
9th,
Updated ucd-snmp packages that a security issue are now available for
Red Hat Enterprise Linux 2.1. This update has been rated as having
low security impact by the Red Hat Security Response Team.
* RedHat: Critical: gaim Internet Security update
10th,
An updated gaim package that fixes a buffer overflow security issue
is now available. This update has been rated as having critical
security impact by the Red Hat Security Response Team.
* RedHat: Critical: gaim Internet Security update
10th,
An updated gaim package that fixes multiple security issues is now
available. This update has been rated as having critical security
impact by the Red Hat Security Response Team.
* RedHat: Moderate: ethereal Internet Security update
10th,
Updated Ethereal packages that fix various security vulnerabilities
are now available. This update has been rated as having moderate
security impact by the Red Hat Security Response Team.
* RedHat: Moderate: gpdf Internet Security update
10th,
An updated gpdf package that fixes a security issue is now available
for Red Hat Enterprise Linux 4. This update has been rated as having
moderate security impact by the Red Hat Security Response Team.
