LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: November 21st, 2014
Linux Security Week: November 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Linux Advisory Watch: January 21st 2005 Print E-mail
User Rating:      How can I rate this item?
Source: LinuxSecurity.com Contributors - Posted by Benjamin D. Thomas   
Linux Advisory Watch This week, advisories were released for twiki, xine, libtiff, mc, gatos, playmidi, chbg, cups, imagemagick, mysql, xpdf, xtrlock, mysql, sword, squid, gimp, dovecot, dhcp, bind, vixie-cron, sysklogd, alsa-lib, grep, kernel-utils, ethereal, mpg123, playmidi, and krb5. The distributors include Conectiva, Debian, Fedora, Gentoo, Mandrake, Red Hat, SuSE, and TurboLinux.


Internet Productivity Suite: Open Source Security - Trust Internet Productivity Suite's open source architecture to give you the best security and productivity applications available. Collaborating with thousands of developers, Guardian Digital security engineers implement the most technologically advanced ideas and methods into their design. Click to find out more!

Assurance via Documentation

In all business environments management must give a certain level of trust to staff in order for work to get done. In security, trust is extremely important. Security managers must trust staff to properly setup and configure systems, give appropriate access, and fix vulnerabilities as they arise. Trusting staff to get the job done is a fundamental part of doing business. As a manager, how can one be sure that the security staff is properly addressing security issues? How can one be sure that vulnerabilities are fixed and logs are monitored? Peter F. Drucker, a well known writer on business management topics once wrote, "if you cannot measure it, you cannot manage it."

This is directly relevant to security. How can a manager be sure that the backups are getting done? Are the IDS and firewall logs properly monitored? A manager can easily have trust in employees, but assurance also must be provided. Management should require staff to log backups, log reviews, server patching, etc. Rather than trusting staff to get the job done, it is necessary to have assurance. All general security maintenance tasks can be, and should be audit-able.

How will extra paper work help security? Will staff get fed up with all of the extra documentation? The purpose of extra documentation is not to burden staff, it is to increasingly justify security spending. If a security department is properly doing its job, incidents will have little affect. However, if the department isn't doing its job, something catastrophic could happen. It is hard for people not in security to see the value in spending more money when there are no security incidents. Having audit-able documented evidence of thwarted security attempts, log reviews, etc. can have a huge impact on the image of the security department. Rather than relying on trust, giving assurance and quantifying security will help get the budget necessary to have the appropriate level of protection.

Until next time, cheers!
Benjamin D. Thomas

 

LinuxSecurity.com Feature Extras:

Encrypting Shell Scripts - Do you have scripts that contain sensitive information like passwords and you pretty much depend on file permissions to keep it secure? If so, then that type of security is good provided you keep your system secure and some user doesn't have a "ps -ef" loop running in an attempt to capture that sensitive info (though some applications mask passwords in "ps" output).

A 2005 Linux Security Resolution - Year 2000, the coming of the new millennium, brought us great joy and celebration, but also brought great fear. Some believed it would result in full-scale computer meltdown, leaving Earth as a nuclear wasteland. Others predicted minor glitches leading only to inconvenience. The following years (2001-2004) have been tainted with the threat of terrorism worldwide.

State of Linux Security 2004 - In 2004, security continued to be a major concern. The beginning of the year was plagued with several kernel flaws and Linux vendor advisories continue to be released at an ever-increasing rate. This year, we have seen the reports touting Window's security superiority, only to be debunked by other security experts immediately after release. Also, Guardian Digital launched the new LinuxSecurity.com, users continue to be targeted by automated attacks, and the need for security awareness and education continues to rise.

 

Bulletproof Virus Protection - Protect your network from costly security breaches with Guardian Digital’s multi-faceted security applications. More then just an email firewall, on demand and scheduled scanning detects and disinfects viruses found on the network. Click to find out more!

Take advantage of our Linux Security discussion list! This mailing list is for general security-related questions and comments. To subscribe send an e-mail to security-discuss-request@linuxsecurity.com with "subscribe" as the subject.

Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headline.

   Contectiva
  Conectiva: twiki Fix for twiki remote vulnerability
  14th, January, 2005

A vulnerability in twiki was found where a remote attacker could exploit it to run arbitrary shell commands on the server. For further information on this vulnerability, please, refer to the authors' announcement[2].

http://www.linuxsecurity.com/content/view/117926
 
  Conectiva: xine-lib Fixes for xine-lib vulnerabilities
  19th, January, 2005

Ariel Berkman discovered a buffer overflow vulnerability[2] in demux_aiff.c, where it reads specific input data into an array without checking the input size.

http://www.linuxsecurity.com/content/view/117967
 
  Conectiva: libtiff3 Fixes for libtiff vulnerabilities
  20th, January, 2005

This announcement fixes several integer overflow vulnerabilities[3,4] that were encountered in libtiff by iDefense which could lead to remote arbitrary code execution.

http://www.linuxsecurity.com/content/view/117982
 
   Debian
  Debian: New mc packages fix several vulnerabilities
  14th, January, 2005

ndrew V. Samoilov has noticed that several bugfixes which were applied to the source by upstream developers of mc, the midnight commander, a file browser and manager, were not backported to the current version of mc that Debian ships in their stable release.

http://www.linuxsecurity.com/content/view/117925
 
  Debian: New gatos packages fix arbitrary code execution
  17th, January, 2005

Erik Sjšlund discovered a buffer overflow in xatitv, one of the programs in the gatos package, that is used to display video with certain ATI video cards. xatitv is installed setuid root in order to gain direct access to the video hardware.

http://www.linuxsecurity.com/content/view/117938
 
  New playmidi packages fix local root exploit
  17th, January, 2005

Erik Sjšlund discovered that playmidi, a MIDI player, contains a setuid root program with a buffer overflow that can be exploited by a local attacker.

http://www.linuxsecurity.com/content/view/117939
 
  Debian: New gallery packages fix several vulnerabilities
  17th, January, 2005

Several vulnerabilities have been discovered in gallery, a web-based photo album written in PHP4.

http://www.linuxsecurity.com/content/view/117942
 
  Debian: New queue packages fix buffer overflows
  18th, January, 2005

"jaguar" of the Debian Security Audit Project has discovered several buffer overflows in queue, a transparent load balancing system.

http://www.linuxsecurity.com/content/view/117951
 
  Debian: New chbg packages fix arbitrary code execution
  18th, January, 2005

Danny Lungstrom discoverd a vulnerability in chbg, a tool to change background pictures. A maliciously crafted configuration/scenario file could overflow a buffer and lead to the execution of arbitrary code on the victim's machine.

http://www.linuxsecurity.com/content/view/117952
 
  Debian: New CUPS packages fix arbitrary code execution
  19th, January, 2005

iDEFENSE has reported a buffer overflow in xpdf, the portable document format (PDF) suite. Similar code is present in the PDF processing part of CUPS. A maliciously crafted PDF file could exploit this problem, resulting in the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/117963
 
  Debian: New ImageMagick packages fix arbitrary code execution
  19th, January, 2005

Andrei Nigmatulin discovered a buffer overflow in the PSD image-decoding module of ImageMagick, a commonly used image manipulation library. Remote exploition with a carefully crafted image could lead to the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/117964
 
  Debian: New mysql packages fix insecure temporary files
  19th, January, 2005

Javier Fernandez-Sanguino Pena from the Debian Security Audit Project discoverd a temporary file vulnerability in the mysqlaccess script of MySQL that could allow an unprivileged user to let root overwrite arbitrary files via a symlink attack and could also could unveil the contents of a temporary file which might contain sensitive information.

http://www.linuxsecurity.com/content/view/117965
 
  Debian: New xpdf packages fix arbitrary code execution
  19th, January, 2005

iDEFENSE has reported a buffer overflow in xpdf, the portable document format (PDF) suite. A maliciously crafted PDF file could exploit this problem, resulting in the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/117966
 
  Debian: New xtrlock packages fix authentication bypass
  20th, January, 2005

A buffer overflow has been discovered in xtrlock, a minimal X display lock program which can be exploited by a malicious local attacker to crash the lock program and take over the desktop session.

http://www.linuxsecurity.com/content/view/117981
 
  Debian: New sword packages fix arbitrary command execution
  20th, January, 2005

Ulf Hþrnhammar discovered that due to missing input sanitising in diatheke, a CGI script for making and browsing a bible website, it is possible to execute arbitrary commands via a specially crafted URL.

http://www.linuxsecurity.com/content/view/117990
 
  Debian: New squid packages fix denial of service
  20th, January, 2005

Several vulnerabilities have been discovered in Squid, the internet object cache, the popular WWW proxy cache.

http://www.linuxsecurity.com/content/view/117991
 
   Fedora
  Fedora Core 3 Update: kernel-2.6.10-1.741_FC3
  14th, January, 2005

Fix slab corruption in ACPI video code.

http://www.linuxsecurity.com/content/view/117924
 
  Fedora Core 2 Update: system-config-kickstart-2.5.19-1.fc2
  14th, January, 2005

This update fixes bug #143946, where system-config-kickstart cannot load kickstart configuration files. It also incorporates all the other fixes and improvements that have taken place since the FC2 version of this utility.

http://www.linuxsecurity.com/content/view/117934
 
  Fedora Core 3 Update: gimp-2.2.2-0.fc3.2
  16th, January, 2005

This is a major version upgrade from 2.0.x to 2.2.x but it is designed to be binary compatible in order that old plug-ins and scripts continue to work.

http://www.linuxsecurity.com/content/view/117937
 
  Fedora: NetworkManager-0.3.3-1.cvs20050112.1.fc3 update
  17th, January, 2005

Please see RPM Changelog for fixes and new features since the last version.

http://www.linuxsecurity.com/content/view/117948
 
  Fedora Core 3 Update: gimp-help-2-0.1.0.6.0.fc3.1
  18th, January, 2005

The GIMP User Manual is a newly written User Manual for the GIMP.

http://www.linuxsecurity.com/content/view/117953
 
  Fedora Core 3 Update: gimp-2.2.2-0.fc3.3
  18th, January, 2005

clip thumbnail quality at 75 and don't barf on saving images at quality 0

http://www.linuxsecurity.com/content/view/117954
 
  Fedora Core 2 Update: dovecot-0.99.13-4.FC2
  18th, January, 2005

This is a bug fix update for the Dovecot IMAP server. This brings the Red Hat Dovecot rpm up to date with the latest upstream release from Timo Sirainen, version 0.99.13 released on Jan 6th 2005.

http://www.linuxsecurity.com/content/view/117955
 
  Fedora Core 3 Update: dovecot-0.99.13-3.FC3
  18th, January, 2005

This is a bug fix update for the Dovecot IMAP server. This brings the Red Hat Dovecot rpm up to date with the latest upstream release from Timo Sirainen, version 0.99.13 released on Jan 6th 2005.

http://www.linuxsecurity.com/content/view/117956
 
  Fedora Core 3 Update: dhcpv6-0.10-11_FC3
  19th, January, 2005

Updated dhcpv6 package, adding Relay Agent support, Support for prefix delegation to radvd on interface other than lease reception interface and Fix cores on resolv.conf and radvd.conf update

http://www.linuxsecurity.com/content/view/117969
 
  Fedora Core 3 Update: dhcp-3.0.1-30_FC3
  19th, January, 2005

Updated DHCP and DHCLIENT packages.

http://www.linuxsecurity.com/content/view/117970
 
  Fedora Core 3 Update: bind-9.2.4-8_FC3
  19th, January, 2005

Updated BIND packages.

http://www.linuxsecurity.com/content/view/117971
 
  Fedora Core 3 Update: vixie-cron-4.1-20_FC3
  19th, January, 2005

Updated vixie-cron package.

http://www.linuxsecurity.com/content/view/117972
 
  Fedora Core 3 Update: sysklogd-1.4.1-26_FC3
  19th, January, 2005

Updated sysklogd packages.

http://www.linuxsecurity.com/content/view/117973
 
  Fedora Core 3 Update: gpdf-2.8.2-2.2
  19th, January, 2005

Add patch for CAN-2005-0064

http://www.linuxsecurity.com/content/view/117976
 
  Fedora Core 2 Update: gpdf-2.8.2-2.1
  19th, January, 2005

Add patch for CAN-2005-0064

http://www.linuxsecurity.com/content/view/117977
 
  Fedora Core 2 Update: cups-1.1.20-11.10
  20th, January, 2005

This package fixes a buffer overflow which may possibly allow attackers to execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue.

http://www.linuxsecurity.com/content/view/117983
 
  Fedora Core 3 Update: cups-1.1.22-0.rc1.8.4
  20th, January, 2005

This package fixes a buffer overflow which may possibly allow attackers to execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue.

http://www.linuxsecurity.com/content/view/117984
 
  Fedora Core 3 Update: alsa-lib-1.0.6-7.FC3
  20th, January, 2005

A flaw in the alsa mixer code was discovered, which disabled stack execution protection for the libasound.so library distributed with Fedora Core 3. The effect of this flaw resulted in stack execution protection, through NX or Exec-Shield, which was disabled for any application linked to libasound.

http://www.linuxsecurity.com/content/view/117985
 
  Fedora Core 3 Update: grep-2.5.1-31.4
  20th, January, 2005

This update fixes a small regression in handling multibyte input for "grep -Fi", and further improves performance when processing UTF-8 input.

http://www.linuxsecurity.com/content/view/117992
 
  Fedora Core 2 Update: xpdf-3.00-3.7
  20th, January, 2005

Applied patch to fix CAN-2005-0064 (bug #145050)

http://www.linuxsecurity.com/content/view/117993
 
  Fedora Core 3 Update: xpdf-3.00-10.2
  20th, January, 2005

Applied patch to fix CAN-2005-0064 (bug #145050)

http://www.linuxsecurity.com/content/view/117994
 
  Fedora Core 2 Update: kernel-utils-2.4-9.1.131_FC2
  20th, January, 2005

Update microcode_ctl to 1.11 (#131885)

http://www.linuxsecurity.com/content/view/117997
 
  Fedora Core 3 Update: kernel-utils-2.4-13.1.49_FC3
  20th, January, 2005

Update microcode_ctl to 1.11

http://www.linuxsecurity.com/content/view/117998
 
  Fedora Core 3 Update: hal-0.4.6-1.FC3
  20th, January, 2005

New upstream release

http://www.linuxsecurity.com/content/view/118004
 
  Gentoo: Squid Multiple vulnerabilities
  16th, January, 2005

Squid contains vulnerabilities in the the code handling NTLM (NT Lan Manager), Gopher to HTML and WCCP (Web Cache Communication Protocol) which could lead to denial of service and arbitrary code execution.

http://www.linuxsecurity.com/content/view/117936
 
   Gentoo
  Gentoo: ImageMagick PSD decoding heap overflow
  20th, January, 2005

ImageMagick is vulnerable to a heap overflow when decoding Photoshop Document (PSD) files, which could lead to arbitrary code execution.

http://www.linuxsecurity.com/content/view/118003
 
  Gentoo: Ethereal Multiple vulnerabilities
  20th, January, 2005

Multiple vulnerabilities exist in Ethereal, which may allow an attacker to run arbitrary code, crash the program or perform DoS by CPU and disk utilization.

http://www.linuxsecurity.com/content/view/118005
 
   Mandrake
  Mandrake: CUPS multiple vulnerabilities fix
  17th, January, 2005

A buffer overflow was discovered in the ParseCommand function in the hpgltops utility. An attacker with the ability to send malicious HPGL files to a printer could possibly execute arbitrary code as the "lp" user (CAN-2004-1267).

http://www.linuxsecurity.com/content/view/117947
 
  Mandrake: Updated mpg123 packages fix
  19th, January, 2005

A vulnerability in mpg123's ability to parse frame headers in input streams could allow a malicious file to exploit a buffer overflow and execute arbitray code with the permissions of the user running mpg123.

http://www.linuxsecurity.com/content/view/117978
 
  Mandrake: Updated playmidi packages
  19th, January, 2005

Erik Sjolund discovered a buffer overflow in playmidi that could be exploited by a local attacker if installed setuid root. Note that by default Mandrakelinux does not ship playmidi installed setuid root.

http://www.linuxsecurity.com/content/view/117979
 
  Mandrake: Updated xine packages fix
  19th, January, 2005

iDefense discovered that the PNA_TAG handling code in pnm_get_chunk() does not check if the input size is larger than the buffer size (CAN-2004-1187). As well, they discovered that in this same function, a negative value could be given to an unsigned variable that specifies the read length of input data (CAN-2004-1188). Ariel Berkman discovered that xine-lib reads specific input data into an array without checking the input size making it vulnerable to a buffer overflow problem (CAN-2004-1300).

http://www.linuxsecurity.com/content/view/117980
 
   Red Hat
  RedHat: Updated kernel packages fix security
  18th, January, 2005

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 3 are now available.

http://www.linuxsecurity.com/content/view/117962
 
  RedHat: Updated krb5 packages fix security
  19th, January, 2005

Updated Kerberos (krb5) packages that correct buffer overflow and temporary file bugs are now available for Red Hat Enterprise Linux.

http://www.linuxsecurity.com/content/view/117974
 
  RedHat: Updated php packages fix security issues
  19th, January, 2005

Updated php packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1.

http://www.linuxsecurity.com/content/view/117975
 
   SuSE
  SuSE: php4, mod_php4 remote code execution
  17th, January, 2005

Stefan Esser and Marcus Boerger found several buffer overflow problems in the unserializer functions of PHP (CAN-2004-1019) and Ilia Alshanetsky (CAN-2004-1065) found one in the exif parser. Any of them could allow remote attackers to execute arbitrary code as the user running the PHP interpreter.

http://www.linuxsecurity.com/content/view/117944
 
   TurboLinux
  TurboLinux: xpdf Buffer overflow
  20th, January, 2005

These vulnerabilities may allow remote attackers to execute arbitrary code via malformed PDF files.

http://www.linuxsecurity.com/content/view/117986
 

Only registered users can write comments.
Please login or register.

Powered by AkoComment!

 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.