This is a remote code execution security breach, which makes it one of the worst types of security breach there is. Such breaches, turn remote access into local access and are just a short hop away from privilege escalation and you loosing control of your computer(often without you ever knowing about it). I know the common sentiment is that Linux boxes are not really targeted by hackers, but, you have to rid yourself of that sentiment and quickly. As it turns out, people who commit most digital crime prefer Linux boxes as either spoof web site hosts or command and control machines for botnets. As such, your Linux machines are actually more desired by the phishers and bot-herders than the rank and file Windows machines that make up the vast majority of botnets.

The arena of digital crime and digital warfare is heating up, and with your highly desired Linux machine it’s important to understand these security concerns and stay vigilant and on top of your systems security.

-John W

Recently discovered vulnerabilities have been patched in Wordpress 2.2.3, upgrade now!

• Ubuntu = http://www.ubuntu.com/usn/
• SuSE = http://www.novell.com/linux/security/securitysupport.html
• Red Hat = http://www.redhat.com/errata/
• Debian = http://www.debian.org/security/
• Gentoo = http://www.gentoo.org/security/en/glsa/index.xml
• Slackware = http://www.slackware.com/security/
• Mandriva = http://www.mandriva.com/security/

I attempted to find the Sabayon security announcements page, but could not locate it. Several other distributions also lack security pages(such as CentOS which does have security team), so I’d recommend using the parent distro’s security pages in combination with staying on the bug tracking lists of the specific distro.

-John W

Of course this type of forensics is probably more the arena of law enforcement or other legal prosecution, as I wouldn’t ever consider a cracked machine, regardless of the cleanup effort, to be 100% remediable.  It’s just not possible to be absolutely sure you’ve covered every possible backdoor even when you have a good, incorruptible  tripwire DB and binary.  IMHO it’s generally always safer to rebuild from scratch and transpose the data on a web server with a good air-gap technique from backups.

-John W

Kernel and Subsystems

• A NULL pointer dereference condition was discovered in the netfilter subsystem. This vulnerability can be used to remotely crash a system by using carefully crafted SCTP protocol packets which will cause an “unknown chunk type” error.
• There is a lack of range checking in nf_conntrack h323 that may lead to NULL pointer dereferences. This could be exploited remotely to cause a system crash.

Common Applications

• Pidgin: A vague report of a remote code execution vulnerability due to an input validation error has been reported at Wasbisabilabi.
  • I should note that I’ve never really trusted IM clients, and it should never be installed on a production server, for ANY reason.
• NuFW: On versions 2.0 and higher, using a time based attack vector, remote attackers can bypass the firewall using “out of period” packet transmissions.

-John