ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : Sergey Lentsov                       2:4615/71.10   08 Jul 2001  23:38:08
 To : All
 Subject : URL: http://www.lwn.net/2001/0704/security.php3
 -------------------------------------------------------------------------------- 
 

    [1][LWN Logo] 
    
                                [2]Click Here 
    [LWN.net]
    
    Sections:
     [3]Main page
     Security
     [4]Kernel
     [5]Distributions
     [6]On the Desktop
     [7]Development
     [8]Commerce
     [9]Linux in the news
     [10]Announcements
     [11]Linux History
     [12]Letters
    [13]All in one big page
    
    See also: [14]last week's Security page.
    
 Security
 
 News and Editorials
 
    Report from the USENIX security module BOF. The Linux Security Module
    project got its start at the [15]Kernel Hackers' Summit back in March;
    there, Linus Torvalds said that he wanted to see a single,
    well-defined interface for the addition of enhanced security
    mechanisms to the Linux kernel. Numerous security hackers have been
    working on this interface since then; a fair amount of real code has
    been produced.
    
    The security module group met in person, perhaps for the first time,
    at a BOF session at the USENIX technical conference in Boston. Thanks
    to Emily Ratliff, we have [16]a summary of what happened there. It is
    an interesting view into the future of enhanced Linux security.
    
    For example: should security-related modules be allowed to implement
    policy that is more permissive than what the system would do normally?
    The conclusion at the BOF seems to have been that security modules
    should only have veto power. This decision restricts the scope of the
    security policies that can be implemented, but it also makes it easier
    to have confidence in the security of the resulting system. When
    security modules can open new doors, they can also open new holes;
    disallowing this capability for now will make it easier to get a
    secure framework in place soon.
    
    There still hasn't been a decision on whether the Linux capability
    mechanism should be split out and implemented as a security module.
    Capabilities are currently wired deeply into the kernel and would take
    some work to extract. Implementing them as a security module would
    increase flexibility, however, and provide a heavily-used
    demonstration of the security module interface.
    
    Should security decisions relative to files be made based on the
    pathname of the file, or on its inode? Different projects have made
    different decisions in this regard, and the security module structure
    currently supports both modes. Some fear that this implementation may
    be seen as an excessive duplication of functionality.
    
    Finally, should the security module implementation be submitted for
    inclusion in 2.5, once that series opens up? Probably not, as it turns
    out. There's a number of issues still needing to be worked out,
    including basic things like the locking requirements for security
    hooks. It would be a good idea, however, to get this patch into 2.5
    relatively early. It will need a great deal of testing and review
    before it is ready for a stable release.
    
    A study in scarlet. Shaun Clowes has posted the text of a presentation
    of his entitled [17]A Study In Scarlet; it covers a long list of
    security traps in the PHP programming language. PHP provides a great
    deal of functionality and makes life easy for the programmer, but it
    also makes it easy to open up security holes on the system. Anybody
    who writes PHP code for the net should probably have a look at this
    text, followed by a long look at the code.
    
    Another IPFilter license change. The difficulties with the licensing
    of the BSD IPFilter package were covered in the [18]May 24 LWN weekly
    edition. Now, [19]according to the OpenBSD Journal, the license has
    changed again. The new license allows modification and redistribution,
    and thus appears to be a free software license. It resembles the BSD
    license, with one exception: it explicitly disallows placing the code
    under the GPL.
    
 Security Reports
 
    User input validation error in GNATS. Joost Pol found a problem in the
    GNATS bug tracking system; a properly-constructed URL passed to the
    help system can result in the reading of any (accessible to GNATS)
    file on the system. See [20]this advisory for details and upgrade
    information.
    
    PHP 4.0.5 vulnerabilities. Joost Pol has [21]reported a couple of
    vulnerabilities in PHP 4.0.5. Both of them require that the attacker
    be able to load PHP scripts on the target machine. The first involves
    a new argument to the mail() function, which can be used to execute
    commands on the server. The second is a violation of the "safe mode"
    policy which can expose unwanted files to the net. No fix is available
    at this time.
    
    web scripts.
    The following web scripts were reported to contain vulnerabilities:
      * Shaun Clowes has reported remote command execution vulnerabilities
        in a number of PHP-based tools: [22]phpMyAdmin through 2.1.0 (and,
        by extension, phpPgAdmin up to 2.3); [23]phpSecurePages through
        2.4beta; and [24]SquirrelMail prior to 1.0.5.
    
 Updates
 
    Samba buffer overflow See [25]the June 28 LWN security page for the
    initial report on the Samba macro vulnerability.
      * [26]Immunix.
      * [27]Linux-Mandrake.
      * [28]SuSE (not vulnerable out of the box).
        
    Previous updates:
      * [29]Debian (June 28)
      * [30]Conectiva (June 28)
      * [31]Samba team patches (June 28)
      * [32]Slackware (June 24th changelog)
      * [33]Caldera (June 28)
      * [34]Red Hat (June 28)
      * [35]Immunix (June 28)
      * [36]Trustix (June 28)
        
    scotty (ntping) buffer overflow See the [37]June 28 LWN security page
    for the initial report of this buffer overflow problem with scotty.
      * [38]SuSE.
        
    xinetd buffer overflow.
    Check the [39]June 14th LWN Security Summary for the initial report.
    The buffer overflow is in the ident logging portion of xinetd, so one
    workaround to the problem is to disable ident logging. Since then,
    more extensive problems have been found in string handling in xinetd,
    and the current round of updates addresses them.
    
    This week's updates:
      * [40]Conectiva.
      * [41]EnGarde Secure Linux. (No mention in advisory of string
        handling problems).
      * [42]Immunix (StackGuard is not fully effective against this
        vulnerability).
      * [43]SuSE .
        
    Previous updates:
      * [44]Debian (June 14).
      * [45]Conectiva (June 14).
        
    Zope Zclass security update.
    Check the [46]May 3rd LWN Security Summary for the original report.
    Sites running Zope should upgrade as soon as possible.
    
    This week's updates:
      * [47]Conectiva.
        
    Previous updates:
      * [48]Debian (May 10th)
      * [49]Linux-Mandrake (May 17).
      * [50]Red Hat (May 17).
      * [51]Progeny (May 17).
        
 Events
 
    Upcoming Security Events.
    
    Date Event Location
    July 11 - 12, 2001 [52]Black Hat Briefings USA '01 Las Vegas, Nevada,
    USA.
    July 17, 2001 [53]The Open Group Security Forum briefing Austin, Texas
    August 6 - 10, 2001 [54]CERT Conference 2001 Omaha, NE, USA.
    August 7, 2001 [55]CIBC World Markets First Annual Security & Privacy
    Conference New York, NY, USA.
    August 13 - 17, 2001 [56]10th USENIX Security Symposium 2001
    Conference Washington, D.C.
    August 13 - 17, 2001 [57]HAL2001 Enschede, The Netherlands
    
    For additional security-related events, included training courses
    (which we don't list above) and events further in the future, check
    out Security Focus' [58]calendar, one of the primary resources we use
    for building the above list. To submit an event directly to us, please
    send a plain-text message to [59]lwn@lwn.net.
    
    Section Editor: [60]Jonathan Corbet
    July 4, 2001
    
                               [61]Click Here 
    Secured Distributions:
    [62]Blue Linux
    [63]Engarde Secure Linux
    [64]Immunix
    [65]Kaladix
    [66]Nexus
    [67]NSA Security Enhanced
    [68]Openwall GNU/Linux
    [69]SLinux
    [70]Trustix
    Security Projects
    [71]Bastille
    [72]Linux Security Audit Project
    [73]Linux Security Module
    [74]OpenSSH
    Security List Archives
    [75]Bugtraq Archive
    [76]Firewall Wizards Archive
    [77]ISN Archive
    Distribution-specific links
    [78]Caldera Advisories
    [79]Conectiva Updates
    [80]Debian Alerts
    [81]Kondara Advisories
    [82]Esware Alerts
    [83]LinuxPPC Security Updates
    [84]Mandrake Updates
    [85]Red Hat Errata
    [86]SuSE Announcements
    [87]Yellow Dog Errata
    BSD-specific links
    [88]BSDi
    [89]FreeBSD
    [90]NetBSD
    [91]OpenBSD
    Security mailing lists [92]Caldera
    [93]Cobalt
    [94]Conectiva
    [95]Debian
    [96]Esware
    [97]FreeBSD
    [98]Kondara
    [99]LASER5
    [100]Linux From Scratch
    [101]Linux-Mandrake
    [102]NetBSD
    [103]OpenBSD
    [104]Red Hat
    [105]Slackware
    [106]Stampede
    [107]SuSE
    [108]Trustix
    [109]turboLinux
    [110]Yellow Dog
    Security Software Archives
    [111]munitions
    [112]ZedZ.net (formerly replay.com)
    Miscellaneous Resources
    [113]CERT
    [114]CIAC
    [115]Comp Sec News Daily
    [116]Crypto-GRAM
    [117]LinuxLock.org
    [118]LinuxSecurity.com
    [119]OpenSEC
    [120]Security Focus
    [121]SecurityPortal
    
    
                                                         [122]Next: Kernel
    
    [123]Eklektix, Inc. Linux powered! Copyright Л 2001 [124]Eklektix,
    Inc., all rights reserved
    Linux (R) is a registered trademark of Linus Torvalds
 
 References
 
    1. http://lwn.net/
    2. http://ads.tucows.com/click.ng/pageid=001-012-132-000-000-002-000-000-012
    3. http://lwn.net/2001/0704/
    4. http://lwn.net/2001/0704/kernel.php3
    5. http://lwn.net/2001/0704/dists.php3
    6. http://lwn.net/2001/0704/desktop.php3
    7. http://lwn.net/2001/0704/devel.php3
    8. http://lwn.net/2001/0704/commerce.php3
    9. http://lwn.net/2001/0704/press.php3
   10. http://lwn.net/2001/0704/announce.php3
   11. http://lwn.net/2001/0704/history.php3
   12. http://lwn.net/2001/0704/letters.php3
   13. http://lwn.net/2001/0704/bigpage.php3
   14. http://lwn.net/2001/0628/security.php3
   15. http://lwn.net/2001/features/KernelSummit/
   16. http://lwn.net/2001/0704/a/security-module-BOF.php3
   17. http://lwn.net/2001/0704/a/study-in-scarlet.php3
   18. http://lwn.net/2001/0524/
   19. http://www.deadly.org/article.php3?sid=20010630232430
   20. http://sources.redhat.com/gnats/gnatsweb/advisory-jun-26-2001.html
   21. http://lwn.net/2001/0704/a/php-safe-mode.php3
   22. http://lwn.net/2001/0704/a/phpMyAdmin.php3
   23. http://lwn.net/2001/0704/a/phpSecurePages.php3
   24. http://lwn.net/2001/0704/a/SquirrelMail.php3
   25. http://lwn.net/2001/0628/security.php3#sambamacro
   26. http://lwn.net/2001/0704/a/imm-samba.php3
   27. http://lwn.net/2001/0704/a/lm-samba.php3
   28. http://lwn.net/2001/0704/a/suse-samba.php3
   29. http://lwn.net/2001/0628/a/deb-samba.php3
   30. http://lwn.net/2001/0628/a/con-samba.php3
   31. http://lwn.net/2001/0628/a/sec-samba.php3
   32. http://www.slackware.com/changelog/current.php?cpu=i386
   33. http://lwn.net/2001/0628/a/cs-samba.php3
   34. http://lwn.net/2001/0628/a/rh-samba.php3
   35. http://lwn.net/2001/0628/a/im-samba.php3
   36. http://lwn.net/2001/0628/a/tr-samba.php3
   37. http://lwn.net/2001/0628/security.php3#ntping
   38. http://lwn.net/2001/0704/a/suse-scotty.php3
   39. http://lwn.net/2001/0614/security.php3#xinetdbo
   40. http://lwn.net/2001/0704/a/con-xinetd.php3
   41. http://lwn.net/2001/0704/a/esl-xinetd.php3
   42. http://lwn.net/2001/0704/a/imm-xinetd.php3
   43. http://lwn.net/2001/0704/a/suse-xinetd.php3
   44. http://lwn.net/2001/0621/a/deb-xinetd.php3
   45. http://lwn.net/2001/0621/a/con-xinetd.php3
   46. http://lwn.net/2001/0503/security.php3#zopezclass
   47. http://lwn.net/2001/0704/a/con-zope.php3
   48. http://lwn.net/2001/0510/a/deb-zope.php3
   49. http://lwn.net/2001/0517/a/lm-zope.php3
   50. http://lwn.net/2001/0517/a/rh-zope-upd.php3
   51. http://lwn.net/2001/0517/a/progeny-zope.php3
   52. http://www.blackhat.com/
   53. http://www.opengroup.org/austin2001/security_outline.htm
   54. http://www.certconf.org/
   55. http://www.cibcwm.com/eq/conference/security/
   56. http://www.usenix.org/events/sec2001
   57. http://www.hal2001.org/hal/01Home/index.html
   58. http://securityfocus.com/calendar
   59. mailto:lwn@lwn.net
   60. mailto:lwn@lwn.net
   61. http://ads.tucows.com/click.ng/buttonpos=lwnbuttonsecurity
   62. http://bluelinux.sourceforge.net/
   63. http://www.engardelinux.org/
   64. http://www.immunix.org/
   65. http://www.maganation.com/~kaladix/
   66. http://Nexus-Project.net/
   67. http://www.nsa.gov/selinux/
   68. http://www.openwall.com/Owl/
   69. http://www.slinux.org/
   70. http://www.trustix.com/
   71. http://www.bastille-linux.org/
   72. http://lsap.org/
   73. http://lsm.immunix.org/
   74. http://www.openssh.com/
   75. http://www.securityfocus.com/bugtraq/archive/
   76. http://www.nfr.net/firewall-wizards/
   77. http://www.jammed.com/Lists/ISN/
   78. http://www.calderasystems.com/support/security/
   79. http://www.conectiva.com.br/atualizacoes/
   80. http://www.debian.org/security/
   81. http://www.kondara.org/errata/k12-security.html
   82. http://www.esware.com/actualizaciones.html
   83. http://linuxppc.org/security/advisories/
   84. http://www.linux-mandrake.com/en/fupdates.php3
   85. http://www.redhat.com/support/errata/index.html
   86. http://www.suse.de/security/index.html
   87. http://www.yellowdoglinux.com/resources/errata.shtml
   88. http://www.BSDI.COM/services/support/patches/
   89. http://www.freebsd.org/security/security.html
   90. http://www.NetBSD.ORG/Security/
   91. http://www.openbsd.org/security.html
   92. http://www.calderasystems.com/support/forums/announce.html
   93. http://www.cobalt.com/support/resources/usergroups.html
   94. http://distro.conectiva.com.br/atualizacoes/
   95. http://www.debian.org/MailingLists/subscribe
   96. http://www.esware.com/lista_correo.html
   97. http://www.freebsd.org/handbook/eresources.html#ERESOURCES-MAIL
   98. http://www.kondara.org/mailinglist.html.en
   99. http://l5web.laser5.co.jp/ml/ml.html
  100. http://www.linuxfromscratch.org/services/mailinglistinfo.php
  101. http://www.linux-mandrake.com/en/flists.php3
  102. http://www.netbsd.org/MailingLists/
  103. http://www.openbsd.org/mail.html
  104. http://www.redhat.com/mailing-lists/
  105. http://www.slackware.com/lists/
  106. http://www.stampede.org/mailinglists.php3
  107. http://www.suse.com/en/support/mailinglists/index.html
  108. http://www.trustix.net/support/
  109. http://www.turbolinux.com/mailman/listinfo/tl-security-announce
  110. http://lists.yellowdoglinux.com/ydl_updates.shtml
  111. http://munitions.vipul.net/
  112. http://www.zedz.net/
  113. http://www.cert.org/nav/alerts.html
  114. http://ciac.llnl.gov/ciac/
  115. http://www.MountainWave.com/
  116. http://www.counterpane.com/crypto-gram.html
  117. http://linuxlock.org/
  118. http://linuxsecurity.com/
  119. http://www.opensec.net/
  120. http://www.securityfocus.com/
  121. http://www.securityportal.com/
  122. http://lwn.net/2001/0704/kernel.php3
  123. http://www.eklektix.com/
  124. http://www.eklektix.com/
 
 --- ifmail v.2.14.os7-aks1
  * Origin: Unknown (2:4615/71.10@fidonet)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор