Master of Science in Information Security - Earn your Master of Science in Information Security online from Norwich University. Designated a "Center of Excellence", the program offers a solid education in the management of information assurance, and the unique case study method melds theory into practice. Using today's e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life.
Security Basics
In the ever-changing world of global data communications, inexpensive Internet connections, and fast-paced software development, security is becoming more and more of an issue. Security is now a basic requirement because global computing is inherently insecure. As your data goes from point A to point B on the Internet, for example, it may pass through several other points along the way, giving other users the opportunity to intercept, and even alter, your data. Even other users on your system may maliciously transform your data into something you did not intend. Unauthorized access to your system may be obtained by intruders, also known as ``crackers'', who then use advanced knowledge to impersonate you, steal information from you, or even deny you access to your own resources. If you're still wondering what the difference is between a ``Hacker'' and a ``Cracker'', see Eric Raymond's document, ``How to Become A Hacker'', available at: http://www.catb.org/~esr/faqs/hacker-howto.html
How Vulnerable Are We?
While it is difficult to determine just how vulnerable a particular system is, there are several indications we can use:
- The Computer Emergency Response Team consistently reports an increase in computer vulnerabilities and exploits.
- TCP and UDP, the protocols that comprise the Internet, were not written with security as their first priority when it was created more than 30 years ago.
- A version of software on one host has the same vulnerabilities as the same version of software on another host. Using this information, an intruder can exploit multiple systems using the same attack method.
- Many administrators don't even take simple security measures necessary to protect their site, or don't understand the ramifications of implementing some services. Many administrators are not given the additional time necessary to integrate the necessary security measures.
Excerpt from the LinuxSecurity Administrator's Guide:
/howtos
Written by: Dave Wreski (
LinuxSecurity.com Feature Extras:
Linux File & Directory Permissions Mistakes - One common mistake Linux administrators make is having file and directory permissions that are far too liberal and allow access beyond that which is needed for proper system operations. A full explanation of unix file permissions is beyond the scope of this article, so I'll assume you are familiar with the usage of such tools as chmod, chown, and chgrp. If you'd like a refresher, one is available right here on linuxsecurity.com.
Introduction: Buffer Overflow Vulnerabilities - Buffer overflows are a leading type of security vulnerability. This paper explains what a buffer overflow is, how it can be exploited, and what countermeasures can be taken to prevent the use of buffer overflow vulnerabilities.
Getting to Know Linux Security: File Permissions - Welcome to the first tutorial in the 'Getting to Know Linux Security' series. The topic explored is Linux file permissions. It offers an easy to follow explanation of how to read permissions, and how to set them using chmod. This guide is intended for users new to Linux security, therefore very simple. If the feedback is good, I'll consider creating more complex guides for advanced users. Please let us know what you think and how these can be improved.
Take advantage of our Linux Security discussion
list! This mailing list is for general security-related questions and comments.
To subscribe send an e-mail to
Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headline.
| Debian: New turqstat packages fix buffer overflow | ||
15th, September, 2005
Updated package. advisories/debian/debian-new-turqstat-packages-fix-buffer-overflow |
||
| Debian: New centericq packages fix several vulnerabilities | ||
15th, September, 2005
Updated package. advisories/debian/debian-new-centericq-packages-fix-several-vulnerabilities |
||
| Debian: New lm-sensors packages fix insecure temporary file | ||
15th, September, 2005
Updated package. advisories/debian/debian-new-lm-sensors-packages-fix-insecure-temporary-file |
||
| Debian: New kdebase packages fix local root vulnerability | ||
16th, September, 2005
Updated package. advisories/debian/debian-new-kdebase-packages-fix-local-root-vulnerability |
||
| Debian: New python2.2 packages fix arbitrary code execution | ||
22nd, September, 2005
Updated package. advisories/debian/debian-new-python22-packages-fix-arbitrary-code-execution |
||
| Debian: New XFree86 packages fix arbitrary code execution | ||
22nd, September, 2005
Updated package. advisories/debian/debian-new-xfree86-packages-fix-arbitrary-code-execution-5387 |
||
| Fedora Core 4 Update: dia-0.94-12.fc4 | ||
16th, September, 2005
Updated package. advisories/fedora/fedora-core-4-update-dia-094-12fc4-12-03-00-120400 |
||
| Fedora Core 4 Update: qt-3.3.4-15.4 | ||
16th, September, 2005
Updated package. advisories/fedora/fedora-core-4-update-qt-334-154-12-04-00-120401 |
||
| Gentoo: Py2Play Remote execution of arbitrary Python | ||
17th, September, 2005
A design error in Py2Play allows attackers to execute arbitrary code. |
||
| Gentoo: Mailutils Format string vulnerability in imap4d | ||
17th, September, 2005
The imap4d server contains a vulnerability allowing an authenticated user to execute arbitrary code with the privileges of the imap4d process. |
||
| Gentoo: Shorewall Security policy bypass | ||
17th, September, 2005
A vulnerability in Shorewall allows clients authenticated by MAC address filtering to bypass all other security rules. |
||
| Gentoo: Mozilla Suite, Mozilla Firefox Buffer overflow | ||
18th, September, 2005
Mozilla Suite and Firefox are vulnerable to a buffer overflow that might be exploited to execute arbitrary code. |
||
| Gentoo: Apache, mod_ssl Multiple vulnerabilities | ||
19th, September, 2005
mod_ssl and Apache are vulnerable to a restriction bypass and a potential local privilege escalation. |
||
| Gentoo: Clam AntiVirus Multiple vulnerabilities | ||
19th, September, 2005
Clam AntiVirus is subject to vulnerabilities ranging from Denial of Service to execution of arbitrary code when handling compressed executables. |
||
| Gentoo: Apache, mod_ssl Multiple vulnerabilities | ||
19th, September, 2005
mod_ssl and Apache are vulnerable to a restriction bypass and a potential local privilege escalation. |
||
| Gentoo: Shorewall Security policy bypass | ||
19th, September, 2005
A vulnerability in Shorewall allows clients authenticated by MAC address filtering to bypass all other security rules. |
||
| Gentoo: Zebedee Denial of Service vulnerability | ||
20th, September, 2005
A bug in Zebedee allows a remote attacker to perform a Denial of Service attack. |
||
| Gentoo: util-linux umount command validation error | ||
20th, September, 2005
A command validation error in umount can lead to an escalation of privileges. |
||
| RedHat: Important: XFree86 security update | ||
15th, September, 2005
This update has been rated as having important security impact by the Red Hat Security Response Team. advisories/red-hat/redhat-important-xfree86-security-update-11213 |
||
| RedHat: Important: squid security update | ||
15th, September, 2005
An updated Squid package that fixes security issues is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. advisories/red-hat/redhat-important-squid-security-update-83322 |
||
| RedHat: Important: mod_ssl security update | ||
15th, September, 2005
An updated mod_ssl package for Apache that corrects a security issue is now available. This update has been rated as having important security impact by the Red Hat Security Response Team. advisories/red-hat/redhat-important-modssl-security-update-RHSA-2005-773-01 |
||
