ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : Sergey Lentsov                       2:4615/71.10   07 Mar 2002  17:14:44
 To : All
 Subject : URL: http://www.lwn.net/2002/0307/security.php3
 -------------------------------------------------------------------------------- 
 

    [1][LWN Logo] [2][oasisi.php?s=4&w=468&h=60] 
    [LWN.net]
 
    Sections:
     [3]Main page
     Security
     [4]Kernel
     [5]Distributions
     [6]Development
     [7]Commerce
     [8]Linux in the news
     [9]Announcements
     [10]Letters
    [11]All in one big page
 
    See also: [12]last week's Security page.
 
 Security
 
 News and Editorials
 
    Flaw weakens Linux security software (News.com). News.com [13]looks at
    the Netfilter security problem. "Security is a nagging concern for the
    computer industry, which must juggle new features with the risk that
    they open up new problems. While the firewall problem the Netfilter
    programmers discovered is limited to a few versions of Linux, a more
    serious problem emerged earlier this month affecting numerous
    operating systems using standard network management software."
 
    Building a Virtual Honeynet (LinuxSecurity). This LinuxSecurity
    article [14]describes the author's experiences with building a virtual
    honeynet on his existing Linux box. "A honeynet is only one type of
    honeypot which is supposed to emulate a real production network, while
    a honeypot is a single host designed as a lure-and-log system (i.e. a
    system with a packet sniffer and a keylogger to log all activity on
    it, and most likely programs that simulate vulnerable services)."
 
 Security Reports
 
    Both PHP3 and PHP4 [15]have vulnerabilities in their file upload code
    which can lead to remote command execution. This one could be ugly;
    sites using PHP should apply updates at the first opportunity. If an
    update isn't available for your distribution, users of PHP 4.0.3 and
    later are encouraged to consider disabling file upload support by
    adding this directive to php.ini:
         file_uploads = Off
 
    CERT has [16]issued this advisory on the problem. [17]This article in
    the Register also talks about the vulnerability.
 
    Developers using the 4.2.0 branch, are not vulnerable because because
    file upload support was completely rewritten for that branch.
 
    Distributor updates seen so far:
      * [18]Debian (March 2, 2002)
      * [19]EnGarde (March 1, 2002)
      * [20]Eridani (March 5, 2002)
      * [21]Mandrake (February 28, 2002)
      * [22]Red Hat (February 27, 2002)
      * [23]Slackware (March 5, 2002)
      * [24]SuSE (February 28, 2002)
      * [25]Trustix (February 28, 2002)
      * [26]Yellow Dog (March 5, 2002)
 
    Apache mod_ssl buffer overflow vulnerability. According to [27]this
    announcement "modssl versions prior to 2.8.7-1.3.23 (Feb 23, 2002)
    make use of the underlying OpenSSL routines in a manner which could
    overflow a buffer within the implementation. This situation appears
    difficult to exploit in a production environment[...]."
 
    Distributor updates seen so far:
      * [28]Conectiva (March 4, 2002)
      * [29]EnGarde (March 1, 2002)
      * [30]Trustix (February 28, 2002)
 
    Two denial of service vulnerabilities in Cistron RADIUS versions 1.6.5
    and prior are described in this [31]CERT advisory for RADIUS. "They
    are remotely exploitable, and on most systems result in a denial of
    service."
 
    Updates are available for:
      * [32]Conectiva (March 6, 2002)
      * [33]Red Hat (March 4, 2002) (Red Hat Powertools 7.0 or 7.1)
 
    Security vulnerability in Zope. There is [34]a security fix for Zope
    available. It seems that the calculation of user privileges is not
    always done as it should be, and users could, in some situations, get
    access to things they shouldn't be allowed to touch.
 
    Debian Security Advisory - xsane. Debian has released an update for
    [35]xsane. Tim Waugh found several insecure uses of temporary files in
    the xsane program, which is used for scanning. This was fixed for
    Debian/stable by moving those files into a securely created directory
    within the /tmp directory.
 
    Debian security update to cfs. Here is [36]this cfs update from Debian
    fixing a set of buffer overflows there.
 
    Debian Security Advisory for CVS. Updated packages are available to
    fix an improper variable initialization in the [37]CVS server. This
    problem has been fixed in version 1.10.7-9 for the stable Debian
    distribution and in versions newer than 1.11.1p1debian-3 for the
    testing and unstable distribution of Debian.
 
    [38]DCP-Portal content management system information path disclosure
    vulnerability. This [39]Bugtraq post describes the vulnerability which
    may "enable a remote user to reveal the absolute path to the web root
    and also more information about the system might be revealed."
 
    web scripts.
    The following web scripts were reported to contain vulnerabilities:
      * Multiple vulnerabilities in the [40]AeroMail Web-based email
        client (implemented in PHP) are described in this [41]Bugtraq
        post.
 
 Updates
 
    Cyrus SASL format string vulnerability. A format string bug in the
    Cyrus SASL authentication API for mail clients and servers may be
    remotely exploitable. (First LWN report: [42]November 29, 2001).
 
    This week's updates:
      * [43]Mandrake (February 28, 2002)
 
    Previous updates:
      * [44]Conectiva (December 11, 2001)
      * [45]Red Hat (November 29, 2001) (7.x)
      * [46]Red Hat (November 29, 2001) (6.2)
      * [47]Caldera (November 26, 2001)
      * [48]SuSE (November 23, 2001)
 
    Multiple vulnerabilities in SNMP implementations. Most SNMP
    implementations out there have a variety of buffer overflow
    vulnerabilities and should be upgraded at first opportunity. See
    [49]this CERT advisory for more. (First LWN report: [50]February 14).
 
    This week's updates:
      * [51]Debian (February 28, 2002) (first update caused some problems)
      * [52]Eridani Linux (February 22, 2002)
 
    Previous updates:
      * [53]Caldera (January 22, 2002)
      * [54]Conectiva (February 14, 2002)
      * [55]Debian (February 14, 2002)
      * [56]Mandrake (February 15, 2002)
      * [57]Red Hat (February 12, 2002)
      * [58]Yellow Dog (February 11, 2002)
 
    Multiple security vulnerabilities in squid. Here is [59]a security
    advisory for the Squid proxy server reporting several vulnerabilities
    in versions up to and including 2.4.STABLE3. At the minimum, the
    vulnerabilities could facilitate denial of service attacks; the
    potential for worse also exists. Sites running squid probably should
    apply the update sooner rather than later. (First LWN report:
    [60]February 28th).
 
    This week's updates:
      * [61]Eridani (March 5, 2002)
      * [62]SuSE (March 5, 2002)
      * [63]Yellow Dog (March 5, 2002)
 
    Previous updates:
      * [64]Conectiva (February 27, 2002)
      * [65]Mandrake (February 21, 2002)
      * [66]Red Hat (February 26, 2002)
      * [67]Trustix (February 22, 2002)
 
    Fixes 8 available from SmoothWall. The SmoothWall Project has released
    [68]fixes 8, which provides major upgrades to Apache, OpenSSL, OpenSSH
    and applies counter controls to theoretical exploits which could
    potentially affect many Linux distributions.
 
 Resources
 
    The CERT Coordination Center (CERT/CC) has issued [69]the quaterly
    CERT summary "to draw attention to the types of attacks reported to
    our incident response team, as well as other noteworthy incident and
    vulnerability information." The last regularly scheduled CERT summary
    was issued in November 2001.
 
    "Fingerprinting Port 80 Attacks: A look into web server, and web
    application attack signatures: Part Two." by Zenomorph is available
    [70]from here. The paper "deals with detecting web application/web
    server attacks along with figuring out what it may mean" to the
    "average administrator. and developer."
 
    The draft Guidelines on Securing Public Web Servers is available for
    public comment from the United States National Institute of Standards
    and Technology (NIST). NIST is seeking comments and suggestions on
    this draft. If you are interested, the document is available [71]from
    NIST.
 
    Open Source Security Testing Methodology Manual 2.0 has been posted
    for peer-review. More information is available in [72]the
    announcement. The manual is available for download from [73]here.
 
    Linux security week. The [74]Linux Security Week and [75]Linux
    Advisory Watch publications from LinuxSecurity.com are available.
 
    IT Security Cookbook Now Available (LinuxSecurity). LinuxSecurity
    [76]talks with Sean Boran, author of "IT Security Cookbook".
    "LinuxSecurity.com: Why is it important for IT professionals to read
    your cookbook? 
 
    Sean Boran: Because it starts at the top (policies) and goes all the
    way down to technical recommendations.
    "
 
 Events
 
    RAID 2002 Last Call for Papers. The Fifth International Symposium on
    Recent Advances in Intrusion Detection has issued [77]this last call
    for papers. RAID 2002 will be held in Zurich, Switzerland October
    16-18, 2002. It is organized by Swiss Federal Institute of Technology
    and IBM Research Division. The deadline for submissions is the end of
    March 2002.
 
    DEF CON TEN Call for Papers. DEF DON TEN has issued [78]this call for
    papers. "Papers and presentations are now being accepted for DEF CON
    TEN, the largest 'hacking' convention on the planet. Papers and
    requests to speak will be received and reviewed from NOW until July
    1st."
 
    Upcoming Security Events.
 
    Date Event Location
    March 11 - 14, 2002 [79]Financial Cryptography 2002 Sothhampton,
    Bermuda
    March 18 - 21, 2002 [80]Sixth Annual Distributed Objects and
    Components Security Workshop (Pier 5 Hotel at the Inner
    Harbor)Baltimore, Maryland, USA
    March 18 - 20, 2002 [81]InfoSec World Conference and Expo/2002
    Orlando, FL, USA
    April 1 - 7, 2002 [82]SANS 2002 Orlando, FL., USA
    April 5 - 7, 2002 [83]Rubicon Detroit, Michigan, USA
    April 7 - 10, 2002 [84]Techno-Security 2002 Conference Myrtle Beach,
    SC
    April 14 - 15, 2002 [85]Workshop on Privacy Enhancing Technologies
    2002 (Cathedral Hill Hotel)San Francisco, California, USA
    April 16 - 19, 2002 [86]The Twelfth Conference on Computers, Freedom &
    Privacy (Cathedral Hill Hotel)San Francisco, California, USA
    April 23 - 25, 2002 [87]Infosecurity Europe 2002 Olympia, London, UK
    May 1 - 3, 2002 [88]cansecwest/core02 Vancouver, Canada
    May 4 - 5, 2002 [89]DallasCon Dallas, TX., USA
    May 12 - 15, 2002 [90]2002 IEEE Symposium on Security and Privacy (The
    Claremont Resort)Oakland, California, USA
    May 13 - 14, 2002 [91]3rd International Common Criteria
    Conference(ICCC) Ottawa, Ont., Canada
    May 13 - 17, 2002 14th Annual Canadian Information Technology Security
    Symposium(CITSS) (Ottawa Congress Centre)Ottawa, Ontario, Canada
 
    For additional security-related events, included training courses
    (which we don't list above) and events further in the future, check
    out Security Focus' [92]calendar, one of the primary resources we use
    for building the above list. To submit an event directly to us, please
    send a plain-text message to [93]lwn@lwn.net.
 
    Section Editor: [94]Dennis Tenney
    March 7, 2002
 
    LWN Resources
    [95]Security alerts archive
    Secured Distributions:
    [96]Astaro Security
    [97]Blue Linux
    [98]Castle
    [99]Engarde Secure Linux
    [100]Immunix
    [101]Kaladix Linux
    [102]NSA Security Enhanced
    [103]Openwall GNU/Linux
    [104]Trustix
    Security Projects
    [105]Bastille
    [106]Linux Security Audit Project
    [107]Linux Security Module
    [108]OpenSSH
    Security List Archives
    [109]Bugtraq Archive
    [110]Firewall Wizards Archive
    [111]ISN Archive
    Distribution-specific links
    [112]Caldera Advisories
    [113]Conectiva Updates
    [114]Debian Alerts
    [115]Kondara Advisories
    [116]Esware Alerts
    [117]LinuxPPC Security Updates
    [118]Mandrake Updates
    [119]Red Hat Errata
    [120]SuSE Announcements
    [121]Turbolinux
    [122]Yellow Dog Errata
    BSD-specific links
    [123]BSDi
    [124]FreeBSD
    [125]NetBSD
    [126]OpenBSD
    Security mailing lists
    [127]Caldera
    [128]Cobalt
    [129]Conectiva
    [130]Debian
    [131]Esware
    [132]FreeBSD
    [133]Kondara
    [134]LASER5
    [135]Linux From Scratch
    [136]Linux-Mandrake
    [137]NetBSD
    [138]OpenBSD
    [139]Red Hat
    [140]Slackware
    [141]Stampede
    [142]SuSE
    [143]Trustix
    [144]turboLinux
    [145]Yellow Dog
    Security Software Archives
    [146]munitions
    [147]ZedZ.net (formerly replay.com)
    Miscellaneous Resources
    [148]CERT
    [149]CIAC
    [150]Comp Sec News Daily
    [151]Crypto-GRAM
    [152]LinuxLock.org
    [153]LinuxSecurity.com
    [154]Security Focus
    [155]SecurityPortal
                                                         [156]Next: Kernel
 
    [157]Eklektix, Inc. Linux powered! Copyright Л 2002 [158]Eklektix,
    Inc., all rights reserved
    Linux (R) is a registered trademark of Linus Torvalds
 
 References
 
    1. http://lwn.net/
    2. http://oasis.lwn.net/oasisc.php?s=4&w=468&h=60
    3. http://lwn.net/2002/0307/
    4. http://lwn.net/2002/0307/kernel.php3
    5. http://lwn.net/2002/0307/dists.php3
    6. http://lwn.net/2002/0307/devel.php3
    7. http://lwn.net/2002/0307/commerce.php3
    8. http://lwn.net/2002/0307/press.php3
    9. http://lwn.net/2002/0307/announce.php3
   10. http://lwn.net/2002/0307/letters.php3
   11. http://lwn.net/2002/0307/bigpage.php3
   12. http://lwn.net/2002/0228/security.php3
   13. http://news.com.com/2100-1001-848467.html
   14. http://www.linuxsecurity.com/feature_stories/feature_story-100.html
   15. http://lwn.net/2002/0307/a/php-upload.php3
   16. http://lwn.net/2002/0307/a/cert-php.php3
   17. http://www.theregister.co.uk/content/55/24248.html
   18. http://lwn.net/alerts/Debian/DSA-115-1.php3
   19. http://lwn.net/alerts/EnGarde/ESA-20020301-006.php3
   20. http://lwn.net/2002/0307/a/el-squid-php.php3
   21. http://lwn.net/alerts/Mandrake/MDKSA-2002:017.php3
   22. http://lwn.net/alerts/RedHat/RHSA-2002:035-13.php3
   23. http://lwn.net/alerts/Slackware/sl-1015349340.php3
   24. http://lwn.net/alerts/SuSE/SuSE-SA:2002:007.php3
   25. http://lwn.net/alerts/Trustix/2002-0033.php3
   26. http://lwn.net/alerts/YellowDog/YDU-20020305-1.php3
   27. http://online.securityfocus.com/archive/1/258646
   28. http://lwn.net/alerts/Conectiva/CLA-2002:465.php3
   29. http://lwn.net/alerts/EnGarde/ESA-20020301-005.php3
   30. http://lwn.net/alerts/Trustix/2002-0034.php3
   31. http://lwn.net/2002/0307/a/0203-radius.php3
   32. http://lwn.net/alerts/Conectiva/CLA-2002:466.php3
   33. http://lwn.net/alerts/RedHat/RHSA-2002:030-08.php3
   34. http://lwn.net/2002/0307/a/zope-proxy-roles.php3
   35. http://lwn.net/alerts/Debian/DSA-118-1.php3
   36. http://lwn.net/alerts/Debian/DSA-116-1.php3
   37. http://lwn.net/alerts/Debian/DSA-117-1.php3
   38. http://www.dcp-portal.com/
   39. http://lwn.net/2002/0307/a/dcp-portal.php3
   40. http://the.cushman.net/projects/aeromail/
   41. http://lwn.net/2002/0307/a/aeromail.php3
   42. http://lwn.net/2001/1129/security.php3#sasl
   43. http://lwn.net/alerts/Mandrake/MDKSA-2002:018.php3
   44. http://lwn.net/alerts/Conectiva/CLA-2001:444.php3
   45. http://lwn.net/alerts/RedHat/RHSA-2001:150-06.php3
   46. http://lwn.net/alerts/RedHat/RHSA-2001:151-06.php3
   47. http://lwn.net/alerts/Caldera/CSSA-2001-040.0.php3
   48. http://lwn.net/alerts/SuSE/SuSE-SA:2001:042.php3
   49. http://lwn.net/2002/0214/a/cert-snmp.php3
   50. http://lwn.net/2002/0214/security.php3
   51. http://lwn.net/alerts/Debian/DSA-111-2.php3
   52. http://lwn.net/2002/0228/a/el-sec.php3
   53. http://lwn.net/alerts/Caldera/CSSA-2002-004.0.php3
   54. http://lwn.net/alerts/Conectiva/CLA-2002:462.php3
   55. http://lwn.net/alerts/Debian/DSA-111-1.php3
   56. http://lwn.net/alerts/Mandrake/MDKSA-2002:014.php3
   57. http://lwn.net/alerts/RedHat/RHSA-2001:163-20.php3
   58. http://lwn.net/alerts/YellowDog/YDU-20020211-1.php3
   59. http://lwn.net/2002/0228/a/squid.php3
   60. http://lwn.net/2002/0228/security.php3#squid
   61. http://lwn.net/2002/0307/a/el-squid-php.php3
   62. http://lwn.net/alerts/SuSE/SuSE-SA:2002:008.php3
   63. http://lwn.net/alerts/YellowDog/YDU-20020305-2.php3
   64. http://lwn.net/alerts/Conectiva/CLA-2002:464.php3
   65. http://lwn.net/alerts/Mandrake/MDKSA-2002:016.php3
   66. http://lwn.net/alerts/RedHat/RHSA-2002:029-09.php3
   67. http://lwn.net/alerts/Trustix/2002-0031.php3
   68. http://lwn.net/2002/0307/a/sw-fixes8.php3
   69. http://lwn.net/2002/0307/a/certquaterlysummary.php3
   70. http://www.cgisecurity.net/papers/fingerprinting-2.txt
   71. http://csrc.nist.gov/publications/drafts.html
   72. http://lwn.net/2002/0307/a/sectestingmethod.php3
   73. http://www.osstmm.org/download.htm
   74. http://lwn.net/2002/0307/a/security-week.php3
   75. http://lwn.net/2002/0307/a/advisory-watch.php3
   76. http://www.linuxsecurity.com/feature_stories/itcookbook-feature.html
   77. http://lwn.net/2002/0307/a/raidpapercall.php3
   78. http://lwn.net/2002/0307/a/defconten.php3
   79. http://www.fc02.ai/
   80. http://www.omg.org/news/meetings/docsec2002/call.htm
   81.
 http://www.misti.com/northamerica.asp?page=4&subpage=2&disp=showconf&id=os02®
 ion=1
   82. http://www.sans.org/SANS2002.php
   83. http://www.rubi-con.org/
   84. http://www.TECHSEC.com/
   85. http://www.pet2002.org/
   86. http://www.cfp2002.org/
   87. http://www.infosec.co.uk/
   88. http://cansecwest.com/
   89. http://www.dallascon.com/
   90. http://www.ieee-security.org/TC/SP02/sp02index.html
   91. http://www.cse-cst.gc.ca/en/iccc/iccc.html
   92. http://securityfocus.com/calendar
   93. mailto:lwn@lwn.net
   94. mailto:lwn@lwn.net
   95. http://lwn.net/alerts/
   96. http://www.astaro.com/products/index.html
   97. http://bluelinux.sourceforge.net/
   98. http://castle.altlinux.ru/
   99. http://www.engardelinux.org/
  100. http://www.immunix.org/
  101. http://www.kaladix.org/
  102. http://www.nsa.gov/selinux/
  103. http://www.openwall.com/Owl/
  104. http://www.trustix.com/
  105. http://www.bastille-linux.org/
  106. http://lsap.org/
  107. http://lsm.immunix.org/
  108. http://www.openssh.com/
  109. http://www.securityfocus.com/archive/1
  110. http://www.nfr.net/firewall-wizards/
  111. http://www.jammed.com/Lists/ISN/
  112. http://www.calderasystems.com/support/security/
  113. http://www.conectiva.com.br/atualizacoes/
  114. http://www.debian.org/security/
  115. http://www.kondara.org/errata/k12-security.html
  116. http://www.esware.com/actualizaciones.html
  117. http://linuxppc.org/security/advisories/
  118. http://www.linux-mandrake.com/en/fupdates.php3
  119. http://www.redhat.com/support/errata/index.html
  120. http://www.suse.de/security/index.html
  121. http://www.turbolinux.com/security/
  122. http://www.yellowdoglinux.com/resources/
  123. http://www.BSDI.COM/services/support/patches/
  124. http://www.freebsd.org/security/security.html
  125. http://www.NetBSD.ORG/Security/
  126. http://www.openbsd.org/security.html
  127. http://www.calderasystems.com/support/forums/announce.html
  128. http://www.cobalt.com/support/resources/usergroups.html
  129. http://distro.conectiva.com.br/atualizacoes/
  130. http://www.debian.org/MailingLists/subscribe
  131. http://www.esware.com/lista_correo.html
  132. http://www.freebsd.org/handbook/eresources.html#ERESOURCES-MAIL
  133. http://www.kondara.org/mailinglist.html.en
  134. http://l5web.laser5.co.jp/ml/ml.html
  135. http://www.linuxfromscratch.org/services/mailinglistinfo.php
  136. http://www.linux-mandrake.com/en/flists.php3
  137. http://www.netbsd.org/MailingLists/
  138. http://www.openbsd.org/mail.html
  139. http://www.redhat.com/mailing-lists/
  140. http://www.slackware.com/lists/
  141. http://www.stampede.org/mailinglists.php3
  142. http://www.suse.com/en/support/mailinglists/index.html
  143. http://www.trustix.net/support/
  144. http://www.turbolinux.com/mailman/listinfo/tl-security-announce
  145. http://lists.yellowdoglinux.com/ydl_updates.shtml
  146. http://munitions.vipul.net/
  147. http://www.zedz.net/
  148. http://www.cert.org/nav/alerts.html
  149. http://ciac.llnl.gov/ciac/
  150. http://www.MountainWave.com/
  151. http://www.counterpane.com/crypto-gram.html
  152. http://linuxlock.org/
  153. http://linuxsecurity.com/
  154. http://www.securityfocus.com/
  155. http://www.securityportal.com/
  156. http://lwn.net/2002/0307/kernel.php3
  157. http://www.eklektix.com/
  158. http://www.eklektix.com/
 
 --- ifmail v.2.14.os7-aks1
  * Origin: Unknown (2:4615/71.10@fidonet)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор