EnGarde Secure Linux: Why not give it a try?
EnGarde Secure Linux is a Linux server distribution that is geared toward providing a open source platform that is highly secure by default as well as easy to administer. EnGarde Secure Linux includes a select group of open source packages configured to provide maximum security for tasks such as serving dynamic websites, high availability mail transport, network intrusion detection, and more. The Community edition of EnGarde Secure Linux is completely free and open source, and online security and application updates are also freely available with GDSN registration.
Guardian Digital Makes Email Safe For Business - Microsoft 365, Goo....
Introduction: Buffer Overflow Vulnerabilities
In exploiting the buffer overflow vulnerability, the main objective is to overwrite some control information in order to change the flow of control in the program. The usual way of taking advantage of this is to modify the control information to give authority to code provided by the attacker to take control. According to Shaneck, "The most widespread type of exploit is called 'Smashing the Stack' and involves overwriting the return address stored on the stack to transfer control to code placed either in the buffer, or past the end of the buffer." (Shaneck, 2003) The stack is a section of memory used for temporary storage of information. In a stack-based buffer overflow attack, the attacker adds more data than expected to the stack, overwriting data. Farrow explains this in an example, "Let's say that a program is executing and reaches the stage where it expects to use a postal code or zip code, which it gets from a Web-based form that customers filled out." (Farrow, 2002) The longest postal code is fewer than twelve characters, but on the web form, the attacker typed in the letter "A" 256 times, followed by some other commands. The data overflows the buffer allotted for the zip code and the attacker's commands fall into the stack. After a function is called, the address of the instruction following the function call is pushed onto the stack to be saved so that the function knows where to return control when it is finished. A buffer overflow allows the attacker to change the return address of a function to a point in memory where they have already inserted executable code. Then control can be transferred to the malicious attack code contained with the buffer, called the payload (Peikari and Chuvakin, 2004). The payload is normally a command to allow remote access or some other command that would get the attacker closer to having control of the system. As Holden explains, "a computer is flooded with more information than it can handle, and some of it may contain instructions that could damage files on the computer or disclose information that is normally protected- or give the hacker root access to the system." (Holden, 2004)
The best defense against any of these attacks is to have perfect programs. In ideal circumstances, every input in every program would do bounds checks to allow only a given number of characters. Therefore, the best way to deal with buffer overflow problems is to not allow them to occur in the first place. Unfortunately, not all programs are perfect and some have bugs that permit the attacks discussed in this paper. As described by Farrow, "because programs are not perfect, programmers have come up with schemes to defend against buffer overflow attacks." (Farrow, 2002) One technique entails enforcing the computer to use the stack and the heap for data only and to never to execute any instructions found there. This approach can work for UNIX systems, but it can't be used on Windows systems. Farrow describes another scheme using a canary to protect against buffer overflows, but only the kind that overwrite the stack. (Farrow, 2002) The stack canary protects the stack by being put in sensitive locations in memory like the return address (that tells the computer where to find the next commands to execute after it completes its current function). As described by Farrow, "before return addresses get used, the program checks to see if the canary is okay." (Farrow, 2002) If the canary has been hit, the program then quits because it knows that something has gone wrong. As a user of the programs, the best countermeasure is to make sure your systems are fully patched in order to protect yourself from exploits targeting vulnerabilities.
Read Full Article:
features/features/introduction-buffer-overflow-vulnerabilities
LinuxSecurity.com Feature Extras:
EnGarde Secure Community 3.0.4 Released - Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.4 (Version 3.0, Release 4). This release includes several bug fixes and feature enhancements to the Guardian Digital WebTool and the SELinux policy, and several new packages available for installation.
Linux File & Directory Permissions Mistakes - One common mistake Linux administrators make is having file and directory permissions that are far too liberal and allow access beyond that which is needed for proper system operations. A full explanation of unix file permissions is beyond the scope of this article, so I'll assume you are familiar with the usage of such tools as chmod, chown, and chgrp. If you'd like a refresher, one is available right here on linuxsecurity.com.
Introduction: Buffer Overflow Vulnerabilities - Buffer overflows are a leading type of security vulnerability. This paper explains what a buffer overflow is, how it can be exploited, and what countermeasures can be taken to prevent the use of buffer overflow vulnerabilities.
Take advantage of our Linux Security discussion
list! This mailing list is for general security-related questions and comments.
To subscribe send an e-mail to
Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headline.
| Debian | ||
| Debian: New zgv packages fix arbitrary code execution | ||
| 21st, April, 2006
Updated package. advisories/debian/debian-new-zgv-packages-fix-arbitrary-code-execution |
||
| Debian: New xzgv packages fix arbitrary code execution | ||
| 22nd, April, 2006
Updated package. advisories/debian/debian-new-xzgv-packages-fix-arbitrary-code-execution |
||
| Debian: New blender packages fix several vulnerabilities | ||
| 24th, April, 2006
Several vulnerabilities have been discoverd in in blender, a very fast and versatile 3D modeller/renderer. The Common Vulnerability and Exposures Project identifies the following problems: CVE-2005-3302, CVE-2005-4470 advisories/debian/debian-new-blender-packages-fix-several-vulnerabilities |
||
| Debian: New gdm packages fix local root exploit | ||
| 24th, April, 2006
A vulnerability has been identified in gdm, a display manager for X, that could allow a local attacker to gain elevated privileges by exploiting a race condition in the handling of the .ICEauthority file. advisories/debian/debian-new-gdm-packages-fix-local-root-exploit |
||
| Debian: New abc2ps packages fix arbitrary code execution | ||
| 25th, April, 2006
Updated package. advisories/debian/debian-new-abc2ps-packages-fix-arbitrary-code-execution |
||
| Debian: New Cyrus SASL packages fix denial of service | ||
| 25th, April, 2006
Updated package. advisories/debian/debian-new-cyrus-sasl-packages-fix-denial-of-service |
||
| Debian: New abcmidi packages fix arbitrary code execution | ||
| 26th, April, 2006
Updated package. advisories/debian/debian-new-abcmidi-packages-fix-arbitrary-code-execution |
||
| Debian: New Mozilla Firefox packages fix several vulnerabilities | ||
| 26th, April, 2006
Several security related problems have been discovered in Mozilla Firefox. advisories/debian/debian-new-mozilla-firefox-packages-fix-several-vulnerabilities-71271 |
||
| Debian: New Mozilla Firefox packages fix several vulnerabilities | ||
| 26th, April, 2006
advisories/debian/debian-new-mozilla-firefox-packages-fix-several-vulnerabilities-71271 |
||
| Debian: New OpenVPN packages fix arbitrary code execution | ||
| 27th, April, 2006
Updated package. advisories/debian/debian-new-openvpn-packages-fix-arbitrary-code-execution |
||
| Debian: New Mozilla packages fix several vulnerabilities | ||
| 27th, April, 2006
Updated package. advisories/debian/debian-new-mozilla-packages-fix-several-vulnerabilities-49307 |
||
| Fedora | ||
| Fedora Core 4 Update: kernel-2.6.16-1.2096_FC4 | ||
| 20th, April, 2006
This update includes a number of security issues that have been fixed upstream over the last week or so. advisories/fedora/fedora-core-4-update-kernel-2616-12096fc4-3888-12-51-00-122491 |
||
| Fedora Core 4 Update: kernel-2.6.16-1.2096_FC4 | ||
| 20th, April, 2006
This update includes a number of security issues that have been fixed upstream over the last week or so. advisories/fedora/fedora-core-4-update-kernel-2616-12096fc4-3888-12-51-00-122491 |
||
| Fedora Core 5 Update: gnome-pilot-2.0.13-7.fc5.6 | ||
| 20th, April, 2006
Updated package. advisories/fedora/fedora-core-5-update-gnome-pilot-2013-7fc56-12-51-00-122492 |
||
| Fedora Core 4 Update: gnome-pilot-2.0.13-5.fc4.2 | ||
| 20th, April, 2006
Updated package. advisories/fedora/fedora-core-4-update-gnome-pilot-2013-5fc42-12-52-00-122493 |
||
| Fedora Core 4 Update: qt-3.3.4-15.5 | ||
| 20th, April, 2006
Updated package. advisories/fedora/fedora-core-4-update-qt-334-155-12-52-00-122494 |
||
| Fedora Core 5 Update: tzdata-2006d-1.fc5 | ||
| 20th, April, 2006
Updated package. advisories/fedora/fedora-core-5-update-tzdata-2006d-1fc5-12-53-00-122495 |
||
| Fedora Core 4 Update: tzdata-2006d-1.fc4 | ||
| 20th, April, 2006
Updated package. advisories/fedora/fedora-core-4-update-tzdata-2006d-1fc4-12-53-00-122496 |
||
| Fedora Core 5 Update: procps-3.2.6-3.3 | ||
| 21st, April, 2006
Updated package. advisories/fedora/fedora-core-5-update-procps-326-33-10-55-00-122506 |
||
| Fedora Core 5 Update: procinfo-18-18.2.2 | ||
| 21st, April, 2006
Updated package. advisories/fedora/fedora-core-5-update-procinfo-18-1822-10-55-00-122507 |
||
| Fedora Core 5 Update: gnome-user-share-0.9-4 | ||
| 21st, April, 2006
Fixes login when using password. advisories/fedora/fedora-core-5-update-gnome-user-share-09-4-10-56-00-122508 |
||
| Fedora Core 5 Update: beagle-0.2.5-1.fc5.1 | ||
| 21st, April, 2006
This upgrade to 0.2.5 fixes various bugs, including making the firefox extension work again. It also contains fixes for a minor security issue where you could inject command line argument into the indexer helpers. advisories/fedora/fedora-core-5-update-beagle-025-1fc51-10-56-00-122509 |
||
| Fedora Core 4 Update: jwhois-3.2.3-3.3.fc4.1 | ||
| 21st, April, 2006
Updates jwhois to 3.2.3 and updates the default configuration. advisories/fedora/fedora-core-4-update-jwhois-323-33fc41-10-57-00-122510 |
||
| Fedora Core 5 Update: cscope-15.5-13.3 | ||
| 21st, April, 2006
Updated package. advisories/fedora/fedora-core-5-update-cscope-155-133-12-04-00-122513 |
||
| Fedora Core 5 Update: ethereal-0.99.0-fc5.1 | ||
| 25th, April, 2006
Many security vulnerabilities have been fixed since the previous release. advisories/fedora/fedora-core-5-update-ethereal-0990-fc51-12-05-00-122561 |
||
| Fedora Core 4 Update: ethereal-0.99.0-fc4.1 | ||
| 26th, April, 2006
Many security vulnerabilities have been fixed since the previous release. advisories/fedora/fedora-core-4-update-ethereal-0990-fc41-11-06-00-122574 |
||
| Fedora Core 4 Update: system-config-date-1.8.3-0.fc4.1 | ||
| 26th, April, 2006
Updated package. advisories/fedora/fedora-core-4-update-system-config-date-183-0fc41-17-31-00-122586 |
||
| Fedora Core 5 Update: system-config-date-1.8.3-0.fc5.1 | ||
| 26th, April, 2006
Updated package. advisories/fedora/fedora-core-5-update-system-config-date-183-0fc51-17-31-00-122587 |
||
| Fedora Core 5 Update: pygtk2-2.8.6-0.fc5.1 | ||
| 26th, April, 2006
Updated package. advisories/fedora/fedora-core-5-update-pygtk2-286-0fc51-17-32-00-122588 |
||
| Gentoo | ||
| Gentoo: Cyrus-SASL DIGEST-MD5 Pre-Authentication Denial of Service | ||
| 21st, April, 2006
Cyrus-SASL contains a vulnerability in the DIGEST-MD5 process that could lead to a Denial of Service. |
||
| Gentoo: zgv, xzgv Heap overflow | ||
| 21st, April, 2006
xzgv and zgv attempt to decode JPEG images within the CMYK/YCCK colour space incorrectly, potentially resulting in the execution of arbitrary code. |
||
| Gentoo: Crossfire server Denial of Service and potential | ||
| 22nd, April, 2006
The Crossfire game server is vulnerable to a Denial of Service and potentially to the execution of arbitrary code. |
||
| Gentoo: Mozilla Firefox Multiple vulnerabilities | ||
| 23rd, April, 2006
Several vulnerabilities in Mozilla Firefox allow attacks ranging from execution of script code with elevated privileges to information leaks. |
||
| Gentoo: fbida Insecure temporary file creation | ||
| 23rd, April, 2006
fbida is vulnerable to linking attacks, potentially allowing a local user to overwrite arbitrary files. |
||
| Gentoo: Dia Arbitrary code execution through XFig import | ||
| 23rd, April, 2006
Buffer overflows in Dia's XFig import could allow remote attackers to execute arbitrary code. |
||
| Gentoo: xine-ui Format string vulnerabilities | ||
| 26th, April, 2006
Format string vulnerabilities in xine-ui may lead to the execution of arbitrary code. |
||
| Gentoo: xine-lib Buffer overflow vulnerability | ||
| 26th, April, 2006
xine-lib contains a buffer overflow vulnerability which may lead to the execution of arbitrary code. |
||
| Gentoo: Ethereal Multiple vulnerabilities in protocol dissectors | ||
| 27th, April, 2006
Ethereal is vulnerable to numerous vulnerabilities, potentially resulting in the execution of arbitrary code. |
||
| Mandriva | ||
| Mandriva: Updated cyrus-sasl packages addresses vulnerability | ||
| 24th, April, 2006
A vulnerability in the CMU Cyrus Simple Authentication and Security Layer (SASL) library < 2.1.21, has an unknown impact and remote unauthenticated attack vectors, related to DIGEST-MD5 negotiation. |
||
| Mandriva: Updated php packages address multiple vulnerabilities. | ||
| 24th, April, 2006
A cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP <= 5.1.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed. |
||
| Mandriva: Updated mozilla-firefox packages fix numerous vulnerabilities | ||
| 25th, April, 2006
A number of vulnerabilities have been discovered in the Mozilla Firefox browser that could allow a remote attacker to craft malicious web pages that could take advantage of these issues to execute arbitrary code with elevated privileges, spoof content, and steal local files, cookies, or other information from web pages. |
||
| Mandriva: Updated mozilla packages fix numerous vulnerabilities | ||
| 25th, April, 2006
A number of vulnerabilities have been discovered in the Mozilla Suite that could allow a remote attacker to craft malicious web pages that could take advantage of these issues to execute arbitrary code with elevated privileges, spoof content, and steal local files, cookies, or other information from web pages. |
||
| Mandriva: Updated ethereal packages fix numerous vulnerabilities | ||
| 25th, April, 2006
A number of vulnerabilities have been discovered in the Ethereal network analyzer. These issues have been corrected in Ethereal version 0.99.0 which is provided with this update. |
||
| Mandriva: Updated mozilla-thunderbird packages fix numerous vulnerabilities | ||
| 25th, April, 2006
A number of vulnerabilities have been discovered in the Mozilla Thunderbird email client that could allow a remote attacker to craft malicious web emails that could take advantage of these issues to execute arbitrary code with elevated privileges, spoof content, and steal local files, or other nformation. |
||
| Mandriva: Updated ruby packages fix vulnerability | ||
| 25th, April, 2006
A vulnerability in how ruby's HTTP module uses blocking sockets was reported by Yukihiro Matsumoto. By sending large amounts of data to a server application using this module, a remote attacker could exploit it to render the application unusable and not respond to other client requests. |
||
| Mandriva: Updated module-init-tools packages fix CUPS-related bug | ||
| 27th, April, 2006
The default configuration of module-init-tools was to send a HUP signal to the CUPS daemon whenever the "usblp" kernel module is loaded, for example when a USB printer is plugged in. Due to udev also sending a HUP signal to the CUPS daemon on pluggin in a USB printer there were two HUPs one shortly after the other which often makes the CUPS daemon crashing. |
||
| Red Hat | ||
| RedHat: Critical: thunderbird security update | ||
| 21st, April, 2006
An updated thunderbird package that fixes various bugs is now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. advisories/red-hat/redhat-critical-thunderbird-security-update-41360 |
||
| RedHat: Moderate: ipsec-tools security update | ||
| 25th, April, 2006
Updated ipsec-tools packages that fix a bug in racoon are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. advisories/red-hat/redhat-moderate-ipsec-tools-security-update-58063 |
||
| RedHat: Moderate: php security update | ||
| 25th, April, 2006
Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. advisories/red-hat/redhat-moderate-php-security-update-38610 |
||
| SuSE | ||
| SuSE: Mozilla Firefox, Mozilla Suite | ||
| 20th, April, 2006
Updated package. |
||
| SuSE: MozillaThunderbird various problems | ||
| 25th, April, 2006
Multiple vulnerabilities fixed. |
||
