Get the LinuxSecurity news you want faster with RSS
Powered By
Linux Advisory Watch: July 8th 2005
Source: LinuxSecurity.com Contributors - Posted by Pax Dickinson
This week, advisories were released for
ppxp, gaim, clamav, razor, trac, zlib, bzip2, cvs, spamassassin, sudo,
ht, fuse, netpbm, kernel, cryptsetup, selinux-policy, kdevelop, kde,
php, gjdoc, javacc, lucene, grep, php-xmlrpc, phpBB, realplayer,
tikiwiki, and cacti.
The distributors include Fedora, Gentoo, and Red Hat.
Internet
Productivity Suite: Open Source Security - Trust Internet Productivity
Suite's open source architecture to give you the best security and productivity
applications available. Collaborating with thousands of developers, Guardian Digital
security engineers implement the most technologically advanced ideas and methods
into their design.
Pull the Plug Revisited: An Interview Five Years Later By: Benjamin D. Thomas
Five years after our original interview with Brian Gemberling, founder of PullthePlug.org, we catch up with Daniel Alvarez and the rest of the site's administrative management. Its structured management and focus on the community will ensure many years of continued success. You're asking, what is pull the plug?
LinuxSecurity.com: Please explain again for our readers what Pull the Plug is about. What is the concept? How does it work? Who can participate?
PullthePlug.org: The concept of PullThePlug has always been to provide an arena for like minded individuals to discuss, train, and learn about computer security and associated technologies.
The primary focus of PullThePlug as a community is to deliver information and resources on computer security to a wide range of audiences. Some services we currently offer are war-game machines (vortex, semtex, catalyst, blackhole), mailing lists, IRC channels, and live lectures (http://www.pulltheplug.org/about/suntzu/) and repository/web hosting for research efforts (http://www.pulltheplug.org/about/rcs/).
As a result of PullThePlug being community driven (by the community for the community), anybody can participate in some way or another. More often then not, new talents are seen when participating in our wargames or contributing to mailing lists, and people are also free to join the IRC and discuss any topic of interest, or provide ideas or services which help in furthering the community driven learning experience.
Linux File
& Directory Permissions Mistakes - One common mistake Linux administrators
make is having file and directory permissions that are far too liberal and
allow access beyond that which is needed for proper system operations. A full
explanation of unix file permissions is beyond the scope of this article,
so I'll assume you are familiar with the usage of such tools as chmod, chown,
and chgrp. If you'd like a refresher, one is available right here on linuxsecurity.com.
Introduction:
Buffer Overflow Vulnerabilities - Buffer overflows are a leading type
of security vulnerability. This paper explains what a buffer overflow is,
how it can be exploited, and what countermeasures can be taken to prevent
the use of buffer overflow vulnerabilities.
Getting
to Know Linux Security: File Permissions - Welcome to the first
tutorial in the 'Getting to Know Linux Security' series. The topic explored
is Linux file permissions. It offers an easy to follow explanation of how
to read permissions, and how to set them using chmod. This guide is intended
for users new to Linux security, therefore very simple. If the feedback is
good, I'll consider creating more complex guides for advanced users. Please
let us know what you think and how these can be improved.
Take advantage of our Linux Security discussion
list! This mailing list is for general security-related questions and comments.
To subscribe send an e-mail to security-discuss-request@linuxsecurity.com
with "subscribe" as the subject.
Thank you for reading the LinuxSecurity.com
weekly security newsletter. The purpose of this document is to provide our readers
with a quick summary of each week's most relevant Linux security headline.
Debian: New trac package fixes upload/download vulnerability
6th, July, 2005
Stefan Esser discovered an input validation flaw within Trac, a wiki
and issue tracking system, that allows download/upload of files and
therefore can lead to remote code execution in some configurations.
http://www.linuxsecurity.com/content/view/119506
Debian: New zlib packages fix denial of service
6th, July, 2005
An error in the way zlib handles the inflation of certain compressed
files can cause a program which uses zlib to crash when opening an
invalid file.
http://www.linuxsecurity.com/content/view/119509
Debian: New bzip2 packages prevent decompression bomb
Debian: New cvs packages fix arbitrary code execution
7th, July, 2005
Derek Price, the current maintainer of CVS, discovered a buffer
overflow in the CVS server, that serves the popular Concurrent
Versions System, which could lead to the execution of arbitrary code.
http://www.linuxsecurity.com/content/view/119523
Debian: New spamassassin packages fix potential DOS
7th, July, 2005
A vulnerability was recently found in the way that SpamAssassin parses
certain email headers. This vulnerability could cause SpamAssassin to
consume a large number of CPU cycles when processing messages containing
these headers, leading to a potential denial of service (DOS) attack.
http://www.linuxsecurity.com/content/view/119524
Debian: New sudo packages fix pathname validation race
7th, July, 2005
A local user who has been granted permission to run commands via sudo
could run arbitrary commands as a privileged user due to a flaw in
sudo's pathname validation. This bug only affects configurations which
have restricted user configurations prior to an ALL directive in the
configuration file.
http://www.linuxsecurity.com/content/view/119525
Debian: New ht packages fix arbitrary code execution
8th, July, 2005
Several problems have been discovered in ht, a viewer, editor and
analyser for various executables, that may lead to the execution of
arbitrary code.
http://www.linuxsecurity.com/content/view/119530
Debian: New fuse packages fix information disclosure
8th, July, 2005
Sven Tantau discovered a security problem in fuse, a filesystem in
userspace, that can be exploited by malicious local users to disclose
potentially sensitive information.
http://www.linuxsecurity.com/content/view/119532
Security-enhanced Linux is a patch of the Linux® kernel and a number
of utilities with enhanced security functionality designed to add
mandatory access controls to Linux. The Security-enhanced Linux
kernel contains new architectural components originally developed to
improve the security of the Flask operating system.
http://www.linuxsecurity.com/content/view/119526
Stefan Esser of the Hardened - PHP Project discovered that some of
the recent vulnerabilities were incorrectly fixed, as well as a new
vulnerability.
The updated sections appear below.
Cacti is vulnerable to several SQL injection, authentication bypass and
file inclusion vulnerabilities.
http://www.linuxsecurity.com/content/view/119522
Updated Zlib packages that fix a buffer overflow are now available for Red
Hat Enterprise Linux 4.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
http://www.linuxsecurity.com/content/view/119508
RedHat: Important: php security update
7th, July, 2005
Updated PHP packages that fix two security issues are now available.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
http://www.linuxsecurity.com/content/view/119521
Only registered users can write comments. Please login or register.
