ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : Sergey Lentsov                       2:4615/71.10   06 Dec 2001  17:11:31
 To : All
 Subject : URL: http://www.lwn.net/2001/1206/security.php3
 -------------------------------------------------------------------------------- 
 

    [1][LWN Logo] 
    
                                [2]Click Here 
    [LWN.net]
    
    Sections:
     [3]Main page
     Security
     [4]Kernel
     [5]Distributions
     [6]Development
     [7]Commerce
     [8]Linux in the news
     [9]Announcements
     [10]Linux History
     [11]Letters
    [12]All in one big page
    
    See also: [13]last week's Security page.
    
 Security
 
 News and Editorials
 
    Fun with wu-ftpd. As reported last week, a new, remotely exploitable
    vulnerability has been found in wu-ftpd. This server seems to have had
    more than its share of difficulties; one can only hope that we are
    coming to the end of the list.
    
    The people publicizing this hole really tried to do the right thing:
    they gathered together a list of vendors shipping wu-ftpd, and set up
    a coordinated release date for updates. The idea was that everybody
    would have a fix available when the word got out that there was a
    problem. It almost worked, except that somebody at Red Hat slipped up
    and sent an alert out early. Red Hat undoubtedly should have been more
    careful, but, given the number of vendors involved, it's not
    surprising that somebody made a mistake. Coordinating that many groups
    is never going to be easy.
    
    Most of the top-tier distributors have been quick to get their updates
    out there; the full list appears in the "updates" section, below.
    There are a couple of glaring exceptions, however. Turbolinux, in
    particular, is notable in its absence. In fact, according to the
    Turbolinux "[14]Security Center," that distributor has not issued a
    single update since last June. Either Turbolinux has found an amazing
    way to avoid vulnerabilities, or that company is failing its customers
    with regard to security.
    
    Meanwhile, the most important thing is for the wu-ftpd patch to be
    applied as widely as possible. This is the worst sort of
    vulnerability, the kind that wide-ranging, destructive worms are made
    of. Exploits for this vulnerability will be widespread before long;
    sites running the vulnerable code will have reason to regret it before
    long.
    
    (See also: [15]CERT's advisory on this vulnerability).
    
    OpenSSH 3.0.2 released. OpenSSH 3.0.2 has been [16]released. It
    includes a security fix for the "UseLogin" option; sites which enable
    UseLogin are vulnerable to certain types of local attacks. UseLogin is
    not enabled by default, however, so most installations are probably
    not vulnerable.
    
 Security Reports
 
    A Red Hat OpenSSH update. Red Hat has issued [17]a new OpenSSH update
    with some new fixes. One is for the restricted command vulnerability
    first reported in [18]the September 27 LWN security page; despite the
    passage of almost two months, this is the first update we have seen
    for this particular problem. Also fixed is a bug in the code which
    attempts to frustrate passive analysis attacks.
    
    More OpenSSH updates. Both [19]Debian and [20]Red Hat have updated
    OpenSSH to fix the (obscure) UseLogin vulnerability. Both appear to
    have backported that particular fix from OpenSSH 3.0.2 to earlier
    versions. This Red Hat update supersedes the one mentioned above.
    
    Other updates from Debian. Another set of alerts has come from Debian,
    including [21]fml (cross-site scripting vulnerability in this mailing
    list manager), [22]icecast-server (several remotely exploitable
    holes), and [23]xtel (symlink attacks). The icecast update, in
    particular, looks like one that should be applied.
    
    Problems with libgtop_daemon. The libgtop_daemon package, a GNOME
    program which makes system information available remotely, has [24]a
    format string vulnerability which is remotely exploitable. This bug is
    fixed in version 1.0.13. Unfortunately, this package also has [25]a
    buffer overflow problem which remains unfixed as of this writing
    (there is a patch in the advisory, though).
    
    Buffer overflow in frox. The "frox" FTP proxy [26]has a buffer
    overflow problem that could be exploited by a hostile server. The fix
    is to upgrade to version 0.6.7.
    
    web scripts.
    The following web scripts were reported to contain vulnerabilities:
      * The PGPMail script, version 1.31, [27]has a vulnerability that can
        allow execution of commands by a remote attacker. A patch is
        included in the advisory.
    
 Updates
 
    wu-ftpd buffer overflow. The wu-ftpd FTP server contains a remotely
    exploitable buffer overflow vulnerability; anybody running this
    package should already have upgraded. Versions up through 2.6.1 are
    vulnerable, as are 2.7.0 testing snapshots. (First LWN report:
    [28]November 29).
    
    This week's updates:
      * [29]Conectiva (November 30, 2001)
      * [30]Debian (December 3, 2001)
      * [31]Immunix (November 29, 2001)
      * [32]Mandrake (November 29, 2001)
        
    Previous updates:
      * [33]Caldera (November 28, 2001)
      * [34]Red Hat (November 26, 2001)
      * [35]SuSE (November 28, 2001)
        
    OpenSSH restricted host vulnerability. Versions of OpenSSH prior to
    2.9.9 have a vulnerability that can allow logins from hosts which have
    been explicitly denied access. The fix is to upgrade to [36]OpenSSH
    2.9.9. This problem first appeared in [37]the October 4 LWN security
    page.
    
    This week's updates:
      * [38]SuSE (December 3, 2001)
        
    Previous updates:
      * [39]Conectiva (October 24, 2001)
      * [40]Immunix (October 17, 2001)
      * [41]Mandrake (October 16, 2001)
      * [42]Red Hat (October 19, 2001) (Adds support for version 7.2).
      * [43]Red Hat (October 9, 2001)
      * [44]Trustix (October 17, 2001)
        
    Postfix session log memory exhaustion. Postfix 20010228, and some
    earlier verions, have a denial of service vulnerability. The SMTP
    session log could grow to an unreasonable size. (First LWN report:
    [45]November 29, 2001).
    
    This week's updates:
      * [46]Mandrake (November 29, 2001)
        
    Previous updates:
      * [47]Conectiva (November 26, 2001)
      * [48]Red Hat (November 27, 2001)
        
    Cyrus SASL format string vulnerability. A format string bug in the
    Cyrus SASL authentication API for mail clients and servers may be
    remotely exploitable. (First LWN report: [49]November 29, 2001).
    
    This week's updates:
      * [50]Red Hat (November 29, 2001) (7.x)
      * [51]Red Hat (November 29, 2001) (6.2)
        
    Previous updates:
      * [52]Caldera (November 26, 2001)
      * [53]SuSE (November 23, 2001)
        
    Directory indexing and path discovery in Apache. Versions of Apache
    prior to version 1.3.19 are vulnerable to a custom crafted request
    that can cause modules to misbehave and return a listing of the
    directory contents by avoiding the error page. (First LWN report:
    [54]September 20, 2001).
    
    This week's updates:
      * [55]Red Hat (December 4, 2001)
        
    Previous updates:
      * [56]Mandrake (September 18, 2001)
      * [57]Mandrake (November 27, 2001) (fixes some problems with the
        update)
      * [58]Mandrake (November 28, 2001) (Single Linux Firewall version).
        
 Resources
 
    MandrakeSoft launches security web site. MandrakeSoft has
    [59]announced the launch of a new web site, [60]MandrakeSecure.net,
    dedicated to Linux security. It is mostly of interest, of course, to
    those working with the Mandrake Linux distribution.
    
    Newsletters from LinuxSecurity.com. Here's the latest [61]Linux
    Advisory Watch and [62]Linux Security Week from LinuxSecurity.com.
    
    Secure distribution list. Here's [63]a list of secure Linux
    distributions put together by Deepak Kumar Gupta.
    
 Events
 
    Upcoming Security Events.
    
    Date Event Location
    December 6 - 7, 2001 [64]Lisa 2001 15th Systems Administration
    Conference San Diego, CA.
    December 6, 2001 [65]InfoSecurity Conference & Exhibition Jacob K.
    Javits Center, New York, NY.
    December 10 - 14, 2001 [66]Annual Computer Security Applications
    Conference New Orleans, LA
    December 27 - 29, 2001 [67]18th Chaos Communication Congress Berlin,
    Germany
    
    For additional security-related events, included training courses
    (which we don't list above) and events further in the future, check
    out Security Focus' [68]calendar, one of the primary resources we use
    for building the above list. To submit an event directly to us, please
    send a plain-text message to [69]lwn@lwn.net.
    
    Section Editor: [70]Jonathan Corbet
    December 6, 2001
    
                               [71]Click Here 
    LWN Resources
    [72]Security alerts archive
    Secured Distributions:
    [73]Astaro Security
    [74]Blue Linux
    [75]Castle
    [76]Engarde Secure Linux
    [77]Immunix
    [78]Kaladix Linux
    [79]NSA Security Enhanced
    [80]Openwall GNU/Linux
    [81]Trustix
    Security Projects
    [82]Bastille
    [83]Linux Security Audit Project
    [84]Linux Security Module
    [85]OpenSSH
    Security List Archives
    [86]Bugtraq Archive
    [87]Firewall Wizards Archive
    [88]ISN Archive
    Distribution-specific links
    [89]Caldera Advisories
    [90]Conectiva Updates
    [91]Debian Alerts
    [92]Kondara Advisories
    [93]Esware Alerts
    [94]LinuxPPC Security Updates
    [95]Mandrake Updates
    [96]Red Hat Errata
    [97]SuSE Announcements
    [98]Yellow Dog Errata
    BSD-specific links
    [99]BSDi
    [100]FreeBSD
    [101]NetBSD
    [102]OpenBSD
    Security mailing lists [103]Caldera
    [104]Cobalt
    [105]Conectiva
    [106]Debian
    [107]Esware
    [108]FreeBSD
    [109]Kondara
    [110]LASER5
    [111]Linux From Scratch
    [112]Linux-Mandrake
    [113]NetBSD
    [114]OpenBSD
    [115]Red Hat
    [116]Slackware
    [117]Stampede
    [118]SuSE
    [119]Trustix
    [120]turboLinux
    [121]Yellow Dog
    Security Software Archives
    [122]munitions
    [123]ZedZ.net (formerly replay.com)
    Miscellaneous Resources
    [124]CERT
    [125]CIAC
    [126]Comp Sec News Daily
    [127]Crypto-GRAM
    [128]LinuxLock.org
    [129]LinuxSecurity.com
    [130]Security Focus
    [131]SecurityPortal
    
    
                                                         [132]Next: Kernel
    
    [133]Eklektix, Inc. Linux powered! Copyright Л 2001 [134]Eklektix,
    Inc., all rights reserved
    Linux (R) is a registered trademark of Linus Torvalds
 
 References
 
    1. http://lwn.net/
    2. http://ads.tucows.com/click.ng/pageid=001-012-132-000-000-002-000-000-012
    3. http://lwn.net/2001/1206/
    4. http://lwn.net/2001/1206/kernel.php3
    5. http://lwn.net/2001/1206/dists.php3
    6. http://lwn.net/2001/1206/devel.php3
    7. http://lwn.net/2001/1206/commerce.php3
    8. http://lwn.net/2001/1206/press.php3
    9. http://lwn.net/2001/1206/announce.php3
   10. http://lwn.net/2001/1206/history.php3
   11. http://lwn.net/2001/1206/letters.php3
   12. http://lwn.net/2001/1206/bigpage.php3
   13. http://lwn.net/2001/1129/security.php3
   14. http://www.turbolinux.com/security/
   15. http://lwn.net/2001/1206/a/cert-wu-ftpd.php3
   16. http://lwn.net/2001/1206/a/openssh-3.0.2.php3
   17. http://lwn.net/alerts/RedHat/RHSA-2001:154-06.php3
   18. http://lwn.net/2001/0927/security.php3#openssh
   19. http://lwn.net/alerts/Debian/DSA-091-1.php3
   20. http://lwn.net/alerts/RedHat/RHSA-2001:161-08.php3
   21. http://lwn.net/alerts/Debian/DSA-088-1.php3
   22. http://lwn.net/alerts/Debian/DSA-089-1.php3
   23. http://lwn.net/alerts/Debian/DSA-090-1.php3
   24. http://lwn.net/2001/1206/a/libgtop.php3
   25. http://lwn.net/2001/1206/a/libgtop2.php3
   26. http://lwn.net/2001/1206/a/frox.php3
   27. http://lwn.net/2001/1206/a/pgpmail.php3
   28. http://lwn.net/2001/1129/security.php3#ftpd
   29. http://lwn.net/alerts/Conectiva/CLA-2001:443.php3
   30. http://lwn.net/alerts/Debian/DSA-087-1.php3
   31. http://lwn.net/alerts/Immunix/IMNX-2001-70-036-02.php3
   32. http://lwn.net/alerts/Mandrake/MDKSA-2001:090.php3
   33. http://lwn.net/alerts/Caldera/CSSA-2001-041.0.php3
   34. http://lwn.net/alerts/RedHat/RHSA-2001:157-06.php3
   35. http://lwn.net/alerts/SuSE/SuSE-SA:2001:043.php3
   36. http://lwn.net/2001/1004/a/openssh.php3
   37. http://lwn.net/2001/1004/security.php3#openssh
   38. http://lwn.net/alerts/SuSE/SuSE-SA:2001:044.php3
   39. http://lwn.net/alerts/Conectiva/CLA-2001:431.php3
   40. http://lwn.net/alerts/Immunix/IMNX-2001-70-034-01.php3
   41. http://lwn.net/alerts/Mandrake/MDKSA-2001:081.php3
   42. http://lwn.net/alerts/RedHat/RHSA-2001:114-05.php3
   43. http://lwn.net/alerts/RedHat/RHSA-2001:114-04.php3
   44. http://lwn.net/alerts/Trustix/2001-0023.php3
   45. http://lwn.net/2001/1129/security.php3#imp
   46. http://lwn.net/alerts/Mandrake/MDKSA-2001:089.php3
   47. http://lwn.net/alerts/Conectiva/CLA-2001:439.php3
   48. http://lwn.net/alerts/RedHat/RHSA-2001:156-05.php3
   49. http://lwn.net/2001/1129/security.php3#sasl
   50. http://lwn.net/alerts/RedHat/RHSA-2001:150-06.php3
   51. http://lwn.net/alerts/RedHat/RHSA-2001:151-06.php3
   52. http://lwn.net/alerts/Caldera/CSSA-2001-040.0.php3
   53. http://lwn.net/alerts/SuSE/SuSE-SA:2001:042.php3
   54. http://lwn.net/2001/0920/security.php3#apachepath
   55. http://lwn.net/alerts/RedHat/RHSA-2001:126-27.php3
   56. http://lwn.net/alerts/Mandrake/MDKSA-2001:077.php3
   57. http://lwn.net/alerts/Mandrake/MDKSA-2001:077-1.php3
   58. http://lwn.net/alerts/Mandrake/MDKSA-2001:077-2.php3
   59.
 http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/12-05-200
 1/0001627682&EDATE=
   60. http://www.mandrakesecure.net/
   61. http://lwn.net/2001/1206/a/advisory-watch.php3
   62. http://lwn.net/2001/1206/a/security-week.php3
   63. http://lwn.net/2001/1206/a/secure-distros.php3
   64. http://www.usenix.org/events/lisa2001/
   65. http://www.infosecurityevent.com/
   66. http://www.acsac.org/
   67. http://www.ccc.de/congress
   68. http://securityfocus.com/calendar
   69. mailto:lwn@lwn.net
   70. mailto:lwn@lwn.net
   71. http://ads.tucows.com/click.ng/buttonpos=lwnbuttonsecurity
   72. http://lwn.net/alerts/
   73. http://www.astaro.com/products/index.html
   74. http://bluelinux.sourceforge.net/
   75. http://castle.altlinux.ru/
   76. http://www.engardelinux.org/
   77. http://www.immunix.org/
   78. http://www.kaladix.org/
   79. http://www.nsa.gov/selinux/
   80. http://www.openwall.com/Owl/
   81. http://www.trustix.com/
   82. http://www.bastille-linux.org/
   83. http://lsap.org/
   84. http://lsm.immunix.org/
   85. http://www.openssh.com/
   86. http://www.securityfocus.com/archive/1
   87. http://www.nfr.net/firewall-wizards/
   88. http://www.jammed.com/Lists/ISN/
   89. http://www.calderasystems.com/support/security/
   90. http://www.conectiva.com.br/atualizacoes/
   91. http://www.debian.org/security/
   92. http://www.kondara.org/errata/k12-security.html
   93. http://www.esware.com/actualizaciones.html
   94. http://linuxppc.org/security/advisories/
   95. http://www.linux-mandrake.com/en/fupdates.php3
   96. http://www.redhat.com/support/errata/index.html
   97. http://www.suse.de/security/index.html
   98. http://www.yellowdoglinux.com/resources/errata.shtml
   99. http://www.BSDI.COM/services/support/patches/
  100. http://www.freebsd.org/security/security.html
  101. http://www.NetBSD.ORG/Security/
  102. http://www.openbsd.org/security.html
  103. http://www.calderasystems.com/support/forums/announce.html
  104. http://www.cobalt.com/support/resources/usergroups.html
  105. http://distro.conectiva.com.br/atualizacoes/
  106. http://www.debian.org/MailingLists/subscribe
  107. http://www.esware.com/lista_correo.html
  108. http://www.freebsd.org/handbook/eresources.html#ERESOURCES-MAIL
  109. http://www.kondara.org/mailinglist.html.en
  110. http://l5web.laser5.co.jp/ml/ml.html
  111. http://www.linuxfromscratch.org/services/mailinglistinfo.php
  112. http://www.linux-mandrake.com/en/flists.php3
  113. http://www.netbsd.org/MailingLists/
  114. http://www.openbsd.org/mail.html
  115. http://www.redhat.com/mailing-lists/
  116. http://www.slackware.com/lists/
  117. http://www.stampede.org/mailinglists.php3
  118. http://www.suse.com/en/support/mailinglists/index.html
  119. http://www.trustix.net/support/
  120. http://www.turbolinux.com/mailman/listinfo/tl-security-announce
  121. http://lists.yellowdoglinux.com/ydl_updates.shtml
  122. http://munitions.vipul.net/
  123. http://www.zedz.net/
  124. http://www.cert.org/nav/alerts.html
  125. http://ciac.llnl.gov/ciac/
  126. http://www.MountainWave.com/
  127. http://www.counterpane.com/crypto-gram.html
  128. http://linuxlock.org/
  129. http://linuxsecurity.com/
  130. http://www.securityfocus.com/
  131. http://www.securityportal.com/
  132. http://lwn.net/2001/1206/kernel.php3
  133. http://www.eklektix.com/
  134. http://www.eklektix.com/
 
 --- ifmail v.2.14.os7-aks1
  * Origin: Unknown (2:4615/71.10@fidonet)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор