Internet Productivity Suite: Open Source Security - Trust Internet Productivity Suite's open source architecture to give you the best security and productivity applications available. Collaborating with thousands of developers, Guardian Digital security engineers implement the most technologically advanced ideas and methods into their design.
Network Intrusion Prevention Systems – When They’re Valuable, and When
They’re Not and When They’re Not, Part II
By: Daniel Miessler
The true benefit of network IPS lies in what it can do for companies that can’t keep their systems patched. This may sound negative, but it’s almost as if the request for NIPS technology is analogous to the requestor admitting that they cannot stay on top of system administration.
For anyone willing to make this admission, however, the benefits of network IPS are quite significant. Consider a medium to large sized company where upper management doesn’t see the need for additional (see enough) systems and/or security administrators. (This shouldn’t require much imagination, by the way).
In an environment like this, vulnerabilities are likely to go unpatched for weeks, months, or even years – even in the Internet-facing areas. Many things can lead to machines not getting patched in these sorts of companies – developers claiming that the main bread-winning app will break if the patches are applied, administrator fear of being the cause of downtime, apathy, stupidity – take your pick.
The point is, a strategically-placed network IPS – say in front of the Internet-facing environment – can do something absolutely magical for an systems/security staff -- it can buy them time. Consider a site passing a ton of traffic into their DMZ via multiple protocols to dozens or hundreds of machines, and let’s say several of the applications being interfaced with have known vulnerabilities. If the person in charge knows that they lack the ability to patch all the vulnerable systems (inexcusable, I agree), then the NIPS system can effectively serve as a multi-patch gateway.
If the NIPS product has a signature for 34 of the 42 exploits that could potentially root 180 machines, then putting a network IPS at the bottleneck becomes an alternative to 1. getting cracked, and 2. patching. Make no mistake, though – patching is the better solution, but I recognize that there are sometimes circumstances that prevent good admins from doing their jobs. There are also situations where someone who knows the risks lacks the funding to bring admins aboard that can help them keep their systems in top shape. For either of these cases, network IPS seems like an acceptable evil.
Read Entire Article:
features/features/network-intrusion-prevention-systems-when-theyre-valuable-and-when-theyre-not
LinuxSecurity.com Feature Extras:
Linux File & Directory Permissions Mistakes - One common mistake Linux administrators make is having file and directory permissions that are far too liberal and allow access beyond that which is needed for proper system operations. A full explanation of unix file permissions is beyond the scope of this article, so I'll assume you are familiar with the usage of such tools as chmod, chown, and chgrp. If you'd like a refresher, one is available right here on linuxsecurity.com.
Introduction: Buffer Overflow Vulnerabilities - Buffer overflows are a leading type of security vulnerability. This paper explains what a buffer overflow is, how it can be exploited, and what countermeasures can be taken to prevent the use of buffer overflow vulnerabilities.
Getting to Know Linux Security: File Permissions - Welcome to the first tutorial in the 'Getting to Know Linux Security' series. The topic explored is Linux file permissions. It offers an easy to follow explanation of how to read permissions, and how to set them using chmod. This guide is intended for users new to Linux security, therefore very simple. If the feedback is good, I'll consider creating more complex guides for advanced users. Please let us know what you think and how these can be improved.
Take advantage of our Linux Security discussion
list! This mailing list is for general security-related questions and comments.
To subscribe send an e-mail to
Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headline.
| Debian | ||
| Debian: New gaim packages fix denial of service | ||
| 29th, July, 2005
Updated package. advisories/debian/debian-new-gaim-packages-fix-denial-of-service-52162 |
||
| Debian: New gopher packages fix insecure temporary file creation | ||
| 29th, July, 2005
Update package. advisories/debian/debian-new-gopher-packages-fix-insecure-temporary-file-creation |
||
| Debian: New pdns packages fix denial of service | ||
| 1st, August, 2005
Updated package. advisories/debian/debian-new-pdns-packages-fix-denial-of-service |
||
| Debian: New apt-cacher package fixes arbitrary command execution | ||
| 3rd, August, 2005
Updated package. advisories/debian/debian-new-apt-cacher-package-fixes-arbitrary-command-execution |
||
| Fedora | ||
| Fedora Core 3 Update: ethereal-0.10.12-1.FC3.1 | ||
| 28th, July, 2005
Updated package. advisories/fedora/fedora-core-3-update-ethereal-01012-1fc31-14-12-00-119939 |
||
| Fedora Core 3 Update: im-sdk-12.1-10.FC3.1 | ||
| 28th, July, 2005
Updated package. advisories/fedora/fedora-core-3-update-im-sdk-121-10fc31-14-13-00-119940 |
||
| Fedora Core 4 Update: selinux-policy-targeted-1.25.3-6 | ||
| 28th, July, 2005
Updated package. advisories/fedora/fedora-core-4-update-selinux-policy-targeted-1253-6-14-13-00-119941 |
||
| Fedora Core 3 Update: gamin-0.1.1-3.FC3 | ||
| 29th, July, 2005
This should fix the problem where monitoring desktop files works initially but sometimes fails after a while. This is a safe update from 0.1.1-1.FC3 advisories/fedora/fedora-core-3-update-gamin-011-3fc3-13-43-00-119955 |
||
| Fedora Core 4 Update: gamin-0.1.1-3.FC4 | ||
| 29th, July, 2005
This should fix the problem where monitoring desktop files works initially but sometimes fails after a while. This is a safe update from 0.1.1-1.FC4 advisories/fedora/fedora-core-4-update-gamin-011-3fc4-13-44-00-119956 |
||
| Fedora Core 4 Update: pam-0.79-9.4 | ||
| 29th, July, 2005
This update fixes a regression of pam_userdb against FC3 pam and links to shared audit library as audit-libs-devel is now fixed. advisories/fedora/fedora-core-4-update-pam-079-94-13-45-00-119957 |
||
| Fedora Core 4 Update: netpbm-10.28-1.FC4.1 | ||
| 29th, July, 2005
Update package. advisories/fedora/fedora-core-4-update-netpbm-1028-1fc41-13-45-00-119958 |
||
| Fedora Core 3 Update: netpbm-10.28-1.FC3.1 | ||
| 29th, July, 2005
Updated package. advisories/fedora/fedora-core-3-update-netpbm-1028-1fc31-13-46-00-119959 |
||
| Fedora Core 4 Update: ethereal-0.10.12-1.FC4.1 | ||
| 29th, July, 2005
Updated package. advisories/fedora/fedora-core-4-update-ethereal-01012-1fc41-13-46-00-119960 |
||
| Fedora Core 3 Update: mkinitrd-4.1.18.1-1 | ||
| 29th, July, 2005
This update should fix the issue a number of people saw after the recent kernel update where various modules would fail to load during boot, making systems unbootable. After updating this package, remove, and reinstall the recent kernel update, and the initrd will be recreated correctly. advisories/fedora/fedora-core-3-update-mkinitrd-41181-1-16-00-00-119961 |
||
| Fedora Core 4 Update: kdeaddons-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdeaddons-342-0fc41-18-04-00-119963 |
||
| Fedora Core 4 Update: kdesdk-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdesdk-342-0fc41-18-04-00-119964 |
||
| Fedora Core 4 Update: kdepim-3.4.2-0.fc4.2 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdepim-342-0fc42-18-05-00-119965 |
||
| Fedora Core 4 Update: kdemultimedia-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdemultimedia-342-0fc41-18-06-00-119966 |
||
| Fedora Core 4 Update: kdelibs-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdelibs-342-0fc41-18-06-00-119967 |
||
| Fedora Core 4 Update: kdewebdev-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdewebdev-342-0fc41-18-07-00-119968 |
||
| Fedora Core 4 Update: kdebase-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdebase-342-0fc41-18-08-00-119969 |
||
| Fedora Core 4 Update: kdevelop-3.2.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdevelop-322-0fc41-18-08-00-119970 |
||
| Fedora Core 4 Update: kdeutils-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdeutils-342-0fc41-18-09-00-119971 |
||
| Fedora Core 4 Update: kdenetwork-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdenetwork-342-0fc41-18-10-00-119972 |
||
| Fedora Core 4 Update: kde-i18n-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kde-i18n-342-0fc41-18-11-00-119973 |
||
| Fedora Core 4 Update: kdegraphics-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdegraphics-342-0fc41-18-11-00-119974 |
||
| Fedora Core 4 Update: kdegames-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdegames-342-0fc41-18-12-00-119975 |
||
| Fedora Core 4 Update: kdeedu-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdeedu-342-0fc41-18-13-00-119976 |
||
| Fedora Core 4 Update: kdebindings-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdebindings-342-0fc41-18-13-00-119977 |
||
| Fedora Core 4 Update: kdeartwork-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdeartwork-342-0fc41-18-14-00-119978 |
||
| Fedora Core 4 Update: kdeadmin-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdeadmin-342-0fc41-18-15-00-119979 |
||
| Fedora Core 4 Update: kdeaccessibility-3.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-kdeaccessibility-342-0fc41-18-15-00-119980 |
||
| Fedora Core 4 Update: arts-1.4.2-0.fc4.1 | ||
| 29th, July, 2005
KDE 3.4.2 update advisories/fedora/fedora-core-4-update-arts-142-0fc41-18-16-00-119981 |
||
| Fedora Core 4 Update: NetworkManager-0.4-20.FC4.1 | ||
| 29th, July, 2005
Network Manager passes logging messages straight to syslog as the format string. advisories/fedora/fedora-core-4-update-networkmanager-04-20fc41-23-05-00-119982 |
||
| Fedora Core 4 Update: libraw1394-1.2.0-1.fc4 | ||
| 31st, July, 2005
Updated package. advisories/fedora/fedora-core-4-update-libraw1394-120-1fc4-21-51-00-119986 |
||
| Fedora Core 4 Update: selinux-policy-targeted-1.25.3-9 | ||
| 1st, August, 2005
Updated package. advisories/fedora/fedora-core-4-update-selinux-policy-targeted-1253-9-11-30-00-119994 |
||
| Fedora Core 4 Update: ckermit-8.0.211-2.FC4 | ||
| 1st, August, 2005
Updated package. advisories/fedora/fedora-core-4-update-ckermit-80211-2fc4-11-31-00-119995 |
||
| Fedora Core 4 Update: httpd-2.0.54-10.1 | ||
| 2nd, August, 2005
This update security fixes for CVE CAN-2005-2088 and CVE CAN-2005-1268, along with some minor bug fixes. advisories/fedora/fedora-core-4-update-httpd-2054-101-14-03-00-120003 |
||
| Fedora Core 4 Update: kdegames-3.4.2-0.fc4.2 | ||
| 2nd, August, 2005
Updated package. advisories/fedora/fedora-core-4-update-kdegames-342-0fc42-14-04-00-120004 |
||
| Fedora Core 3 Update: httpd-2.0.53-3.2 | ||
| 2nd, August, 2005
This update includes version 2.0.53 of the Apache HTTP server, and also adds security fixes for CVE CAN-2005-2088 and CVE CAN-2005-1268. advisories/fedora/fedora-core-3-update-httpd-2053-32-14-04-00-120005 |
||
| Fedora Core 4 Update: gphoto2-2.1.6-1.1 | ||
| 2nd, August, 2005
Updated to new release. advisories/fedora/fedora-core-4-update-gphoto2-216-11-14-05-00-120006 |
||
| Fedora Core 4 Update: coreutils-5.2.1-48.1 | ||
| 2nd, August, 2005
This updated package fixes "who -r" and "who -b". advisories/fedora/fedora-core-4-update-coreutils-521-481-14-06-00-120007 |
||
| Fedora Core 4 Update: iiimf-12.2-4.fc4.2 | ||
| 2nd, August, 2005
Updated package. advisories/fedora/fedora-core-4-update-iiimf-122-4fc42-14-07-00-120008 |
||
| Fedora Core 3 Update: yum-2.2.2-0.fc3 | ||
| 2nd, August, 2005
This update fixes a few minor problems. advisories/fedora/fedora-core-3-update-yum-222-0fc3-17-05-00-120010 |
||
| Fedora Core 3 Update: ethereal-0.10.12-1.FC3.2 | ||
| 3rd, August, 2005
To reduce the risk of future vulnerabilities in Ethereal, the ethereal and tethereal programs in this update have been compiled as Position Independant Executables (PIE). advisories/fedora/fedora-core-3-update-ethereal-01012-1fc32-12-23-00-120018 |
||
| Fedora Core 4 Update: ethereal-0.10.12-1.FC4.2 | ||
| 3rd, August, 2005
To reduce the risk of future vulnerabilities in Ethereal, the ethereal and tethereal programs in this update have been compiled as Position Independant Executables (PIE). advisories/fedora/fedora-core-4-update-ethereal-01012-1fc42-12-23-00-120019 |
||
| Fedora Core 3 Update: gimp-2.2.8-0.fc3.2 | ||
| 3rd, August, 2005
Updated package. advisories/fedora/fedora-core-3-update-gimp-228-0fc32-12-24-00-120020 |
||
| Fedora Core 4 Update: gimp-2.2.8-0.fc4.2 | ||
| 3rd, August, 2005
Updated package. advisories/fedora/fedora-core-4-update-gimp-228-0fc42-12-25-00-120021 |
||
| Fedora Core 4 Update: readahead-1.1-1.16_FC4 | ||
| 3rd, August, 2005
This update should fix a inverted case where readahead would be triggered on boxes that have less than 384MB of memory, and would not occur if the box had more than 384MB of memory. advisories/fedora/fedora-core-4-update-readahead-11-116fc4-16-33-00-120023 |
||
| Gentoo | ||
| Gentoo: Ethereal Multiple vulnerabilities | ||
| 28th, July, 2005
Ethereal is vulnerable to numerous vulnerabilities potentially resulting in the execution of arbitrary code or abnormal termination. |
||
| Gentoo: Shorewall Security policy bypass | ||
| 29th, July, 2005
A vulnerability in Shorewall allows clients authenticated by MAC address filtering to bypass all other security rules. |
||
| Gentoo: zlib Buffer overflow | ||
| 29th, July, 2005
zlib is vulnerable to a buffer overflow which could potentially lead to execution of arbitrary code. |
||
| Gentoo: fetchmail Buffer Overflow | ||
| 29th, July, 2005
fetchmail is susceptible to a buffer overflow resulting in a Denial of Service or arbitrary code execution. |
||
| Gentoo: Kopete Vulnerability in included Gadu library | ||
| 29th, July, 2005
Kopete is vulnerable to several input validation vulnerabilities which may lead to execution of arbitrary code. |
||
| Gentoo: Mozilla Suite Multiple vulnerabilities | ||
| 29th, July, 2005
Several vulnerabilities in the Mozilla Suite allow attacks ranging from the execution of javascript code with elevated privileges to inormation leakage. |
||
| Gentoo: Clam AntiVirus Integer overflows | ||
| 29th, July, 2005
Clam AntiVirus is vulnerable to integer overflows when handling several file formats, potentially resulting in the execution of arbitrary code. |
||
| Gentoo: sandbox Insecure temporary file handling | ||
| 29th, July, 2005
The sandbox utility may create temporary files in an insecure manner. |
||
| Gentoo: AMD64 x86 emulation base libraries Buffer overflow | ||
| 30th, July, 2005
The x86 emulation base libraries for AMD64 contain a vulnerable version of zlib which could potentially lead to execution of arbitrary code. |
||
| Gentoo: pstotext Remote execution of arbitrary code | ||
| 31st, July, 2005
pstotext contains a vulnerability which can potentially result in the execution of arbitrary code. |
||
| Gentoo: Compress:Zlib: Buffer overflow | ||
| 1st, August, 2005
Compress::Zlib is vulnerable to a buffer overflow which could potentially lead to execution of arbitrary code. |
||
| Gentoo: ProFTPD Format string vulnerabilities | ||
| 1st, August, 2005
Under specific circumstances, ProFTPD is vulnerable to format string vulnerabilities, potentially resulting in the execution of arbitrary code. |
||
| Gentoo: ProFTPD Format string vulnerabilities | ||
| 1st, August, 2005
Under specific circumstances, ProFTPD is vulnerable to format string vulnerabilities, potentially resulting in the execution of arbitrary code. |
||
| Gentoo: nbSMTP Format string vulnerability | ||
| 2nd, August, 2005
nbSMTP is vulnerable to a format string vulnerability which may result in remote execution of arbitrary code. |
||
| Red Hat | ||
| RedHat: Low: dump security update | ||
| 3rd, August, 2005
Updated dump packages that address two security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having low security impact by the Red Hat Security Response Team. advisories/red-hat/redhat-low-dump-security-update-RHSA-2005-583-01 |
||
| RedHat: Moderate: SquirrelMail security update | ||
| 3rd, August, 2005
An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response T am. advisories/red-hat/redhat-moderate-squirrelmail-security-update-90811 |
||
