ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : Sergey Lentsov                       2:4615/71.10   10 May 2002  19:51:24
 To : All
 Subject : URL: http://www.lwn.net/2002/0502/security.php3
 -------------------------------------------------------------------------------- 
 

    [1][LWN Logo] 
    [LWN.net]
 
    Sections:
     [2]Main page
     Security
     [3]Kernel
     [4]Distributions
     [5]Development
     [6]Commerce
     [7]Linux in the news
     [8]Announcements
     [9]Letters
    [10]All in one big page
 
    See also: [11]last week's Security page.
 
 Security
 
 News and Editorials
 
    Netscape flaw exposes hard drives (ZDNet). ZDNet [12]is covering the
    [13]XMLHttpRequest security bug in Mozilla-based browsers. " The bug
    is found in versions of Mozilla from 0.9.7 to 0.9.9 on various
    operating system platforms, and in Netscape versions 6.1 and higher.
    The flaw doesn't affect Mozilla 1.0 release candidate 1 because
    XMLHttpRequest appears to be broken in that release, according to
    Mozilla developers." (Thanks to Manfred Scheible)
 
    John Villalovos wrote to tell us that [14]the fix for this bug will be
    in the next Mozilla release.
 
    A world without secrets (ZDNet). ZDNet [15]takes a look at Richard
    Hunter and his book "World Without Secrets: Business, Crime and
    Privacy in the Age of Ubiquitous Computing". "His poster child for the
    evil network army is the infamous Al Qaeda, and the good exemplified
    by the Open Source movement."
 
 Security Reports
 
    sudo local root exploit. Sudo 1.6.5p2 and earlier [16]can be tricked
    into allocating less memory than it should when used with the password
    prompt parameter (-p). A local attacker may use the flaw to gain root
    privileges. The problem is fixed in [17]sudo 1.6.6.
 
    Updates are available from:
      * [18]Conectiva (April 26, 2002)
      * [19]Debian (April 26, 2002)
      * [20]EnGarde (April 29, 2002)
      * [21]Gentoo (April 26, 2002)
      * [22]Mandrake (April 25, 2002)
      * [23]Red Hat (April 25, 2002)
      * [24]Red Hat (April 25, 2002) (Red Hat Powertools)
      * [25]Slackware (April 26, 2002)
      * [26]SuSE (April 30, 2002)
      * [27]Trustix (April 29, 2002)
 
    Revised OpenSSH security advisory. The OpenSSH advisory reported
    [28]last week has been [29]revised. "Buffer overflow in OpenSSH's sshd
    if AFS has been configured on the system or if KerberosTgtPassing or
    AFSTokenPassing has been enabled in the sshd_config file. Ticket and
    token passing is not enabled by default."
 
    Trustix issued what appears to be the first [30]openssh update from a
    distributor that fixes the problem.
 
    Squid DNS answer message vulnerabilty. Squid-2.X releases up to and
    including 2.4.STABLE4 do not check some error and boundary conditions
    when handling compressed DNS answer messages in the internal DNS. A
    malicous DNS server could craft a DNS reply that causes Squid to exit
    with a SIGSEGV.
 
    Updates which fix the problem were released this week by:
      * [31]Caldera (April 25, 2002)
      * [32]Trustix (January 2, 2002)
 
    Ethereal packet handling vulnerabilities. [33]Ethereal 0.9.3 fixed
    three packet handling vulnerabilities present in 0.9.2 when it was
    released by the ethereal team on March 30th. The [34]PROTOS test suite
    found some flaws in SNMP and LDAP protocols support. Malformed packets
    could also crash ethereal 0.9.2 due to a ASN.1 zero-length g_malloc
    problem. The zlib "double free" vulnerability was addressed by the
    updates for that bug from many distributors.
 
    Conectiva has issued a [35]ethereal security update that addresses the
    ASN.1 zero_length g_malloc and SNMP and LDAP protocols support
    vulnerabilities. The zlib "double free" vulnerability was addressed by
    an earlier [36]zlib update from Connectiva.
 
    Multiple vulnerabilities in icecast. [37]Icecast is a streaming audio
    broadcasting system. Version 1.3.12 was [38]released on April 10th.
    "This release is a security update and all users are highly encouraged
    to upgrade immediately or apply the relevant patches to their own
    versions. Remember, never run icecast as a priveledged user,
    especially not as root."
 
    Security updates to icecast 1.3.12 have been released by:
      * [39]Gentoo (April 26, 2002)
      * [40]Red Hat (April 24, 2002) (Red Hat Powertools)
 
    Red Hat advisory for docbook. Here is a Red Hat security update for
    the [41]docbook package.
 
    Caldera Security advisory - fileutils. A race condition in various
    utilities from the GNU [42]fileutils package may cause a root user to
    delete the whole filesystem.
 
    PHProjekt multiple vulnerabilities. [43]PHProjekt is an open source
    groupware suite. Ulf Harnhammar has [44]reported multiple
    vulnerabilities in PHProjekt organized into five categories.
 
    web scripts.
    The following web scripts were reported to contain vulnerabilities:
      * A new version of [45]Blahz-DNS is available which fixes an
        [46]authentication bypass vulnerability in Blahz-DNS 0.2 and
        "maybe all versions before."
 
    Proprietary products.
    The following proprietary products were reported to contain
    vulnerabilities:
      * [47]Dnstools has a [48]reported authentication bypass
        vulnerability.
 
 Updates
 
    Two denial of service vulnerabilities in Cistron RADIUS versions 1.6.5
    and prior are described in this [49]CERT advisory for RADIUS. "They
    are remotely exploitable, and on most systems result in a denial of
    service." (First LWN report: [50] March 7th, 2002).
 
    This week's updates:
      * [51]SuSE (April 29, 2002)
 
    Previous updates:
      * [52]Conectiva (March 6, 2002)
      * [53]Red Hat (March 4, 2002) (Red Hat Powertools 7.0 or 7.1)
 
    Problem loading untrusted images in imlib. Versions of imlib prior to
    1.9.13 used the NetPBM package in ways which "make it possible for
    attackers to create image files such that when loaded via software
    which uses Imlib, could crash the program or potentially allow
    arbitrary code to be executed." (First LWN report: [54]March 28).
 
    This week's updates:
      * [55]SuSE (May 7, 2002)
 
    Previous updates:
      * [56]Caldera (April 29, 2002)
      * [57]Conectiva (March 28, 2002)
      * [58]Eridani (March 27, 2002)
      * [59]Mandrake (April 25, 2002)
      * [60]Red Hat (March 20, 2002)
 
    Both PHP3 and PHP4 [61]have vulnerabilities in their file upload code
    which can lead to remote command execution. This one could be ugly;
    sites using PHP should apply updates at the first opportunity. If an
    update isn't available for your distribution, users of PHP 4.0.3 and
    later are encouraged to consider disabling file upload support by
    adding this directive to php.ini:
 
         file_uploads = Off
 
    CERT has [62]issued this advisory on the problem. [63]This article in
    the Register also talks about the vulnerability. (First LWN report:
    [64]March 7).
 
    Developers using the 4.2.0 branch, are not vulnerable because because
    file upload support was completely rewritten for that branch.
 
    This week's updates:
      * [65]Trustix (April 29, 2002) (The [66]February 28th update "did
        not quite do the trick")
 
    Previous updates:
      * [67]Conectiva (March 8, 2002)
      * [68]Debian (March 2, 2002)
      * [69]EnGarde (March 1, 2002)
      * [70]Eridani (March 5, 2002)
      * [71]Mandrake (February 28, 2002)
      * [72]Mitel Networks (March 7, 2002) (SME Server)
      * [73]OpenPKG (February 28, 2002)
      * [74]Red Hat (March 21, 2002)
      * [75]Slackware (March 5, 2002)
      * [76]SuSE (February 28, 2002)
      * [77]Trustix (February 28, 2002)
      * [78]Yellow Dog (March 5, 2002)
 
    Update: Despite [79]some concern expressed in an earlier report by
    LWN, these updates do, in fact, fix the problem. The original update
    from the php team fixes the security hole but introduces a "rare
    segfault condition" that is not a security problem.
 
    Webalizer DNS server based attach vulnerability. The cause is a
    [80]buffer overflow bug. This one sounds nasty. If reverse DNS lookups
    are enabled in webalizer, "
    an attacker with control over the victims DNS may spoof responses thus
    triggering a buffer overflow, potentially leading to a root
    compromise." [81]Webalizer 2.01-10 "fixes this and a few other buglets
    that have been discovered in the last month or so". (First LWN report:
    [82] April 18th, 2002).
 
    This week's updates:
      * [83]Conectiva (April 26, 2002)
 
    Previous updates:
      * [84]EnGarde (April 23, 2002)
 
 Resources
 
    Building a secure kiosk with Embedded Linux. LinuxDevices features
    [85]an article on building a Linux based information kiosk. "In this
    informative and entertaining technical article, embedded developer
    Patrick Glennon relates his experiences in creating a small
    Linux-based system for a client that required robust, easy-to-use,
    low-cost kiosks for conducting surveys at hotels."
 
    Linux security week. The [86]Linux Security Week publication from
    LinuxSecurity.com is available.
 
 Events
 
    Upcoming Security Events.
 
    Date Event Location
    May 2 - 3, 2002 [87]cansecwest/core02 Vancouver, Canada
    May 4 - 5, 2002 [88]DallasCon Dallas, TX., USA
    May 9, 2002 [89]Stanford's Center for Internet and Society Conference
    on Computer Security Vulnerability Disclosure (Stanford Law
    School)Stanford, CA, USA
    May 12 - 15, 2002 [90]2002 IEEE Symposium on Security and Privacy (The
    Claremont Resort)Oakland, California, USA
    May 13 - 14, 2002 [91]3rd International Common Criteria
    Conference(ICCC) Ottawa, Ont., Canada
    May 13 - 17, 2002 [92]14th Annual Canadian Information Technology
    Security Symposium(CITSS) (Ottawa Congress Centre)Ottawa, Ontario,
    Canada
    May 27 - 31, 2002 [93]3rd International SANE Conference(SANE 2002)
    Maastricht, The Netherlands
    May 29 - 30, 2002 [94]RSA Conference 2002 Japan (Akasaka Prince
    Hotel)Tokyo, Japan
    May 31 - June 1, 2002 [95]SummerCon 2002 (Renaissance Hotel)Washington
    D.C., USA
    June 17 - 19, 2002 [96]NetSec 2002 San Fransisco, California, USA
    June 24 - 28, 2002 [97]14th Annual Computer Security Incident Handling
    Conference (Hilton Waikoloa Village)Hawaii
    June 24 - 26, 2002 [98]15th IEEE Computer Security Foundations
    Workshop (Keltic Lodge, Cape Breton)Nova Scotia, Canada
 
    For additional security-related events, included training courses
    (which we don't list above) and events further in the future, check
    out Security Focus' [99]calendar, one of the primary resources we use
    for building the above list. To submit an event directly to us, please
    send a plain-text message to [100]lwn@lwn.net.
 
    Section Editor: [101]Dennis Tenney
    May 2, 2002
 
                                Sponsored Link
 
    [102]Cheap and Effective
 
    LWN's text ads are a cheap and effective marketing tool for your
    organization. You can now purchase text ads automatically through our
    own credit card gateway. (No more PayPal).
 
    LWN Resources
    [103]Security alerts archive
    Secured Distributions:
    [104]Astaro Security
    [105]Castle
    [106]Engarde Secure Linux
    [107]Immunix
    [108]Kaladix Linux
    [109]NSA Security Enhanced
    [110]Openwall GNU/Linux
    [111]Trustix
    Security Projects
    [112]Bastille
    [113]Linux Security Audit Project
    [114]Linux Security Module
    [115]OpenSSH
    Security List Archives
    [116]Bugtraq Archive
    [117]Firewall Wizards Archive
    [118]ISN Archive
    Distribution-specific links
    [119]Caldera Advisories
    [120]Conectiva Updates
    [121]Debian Alerts
    [122]Kondara Advisories
    [123]Esware Alerts
    [124]LinuxPPC Security Updates
    [125]Mandrake Updates
    [126]Red Hat Errata
    [127]SuSE Announcements
    [128]Turbolinux
    [129]Yellow Dog Errata
    BSD-specific links
    [130]BSDi
    [131]FreeBSD
    [132]NetBSD
    [133]OpenBSD
    Security mailing lists
    [134]Caldera
    [135]Cobalt
    [136]Conectiva
    [137]Debian
    [138]Esware
    [139]FreeBSD
    [140]Kondara
    [141]LASER5
    [142]Linux From Scratch
    [143]Linux-Mandrake
    [144]NetBSD
    [145]OpenBSD
    [146]Red Hat
    [147]Slackware
    [148]Stampede
    [149]SuSE
    [150]Trustix
    [151]turboLinux
    [152]Yellow Dog
    Security Software Archives
    [153]munitions
    [154]ZedZ.net (formerly replay.com)
    Miscellaneous Resources
    [155]CERT
    [156]CIAC
    [157]Comp Sec News Daily
    [158]Crypto-GRAM
    [159]LinuxLock.org
    [160]LinuxSecurity.com
    [161]Security Focus
    [162]SecurityPortal
                                                         [163]Next: Kernel
 
    [164]Eklektix, Inc. Linux powered! Copyright Л 2002 [165]Eklektix,
    Inc., all rights reserved
    Linux (R) is a registered trademark of Linus Torvalds
 
 References
 
    1. http://lwn.net/
    2. http://lwn.net/2002/0502/
    3. http://lwn.net/2002/0502/kernel.php3
    4. http://lwn.net/2002/0502/dists.php3
    5. http://lwn.net/2002/0502/devel.php3
    6. http://lwn.net/2002/0502/commerce.php3
    7. http://lwn.net/2002/0502/press.php3
    8. http://lwn.net/2002/0502/announce.php3
    9. http://lwn.net/2002/0502/letters.php3
   10. http://lwn.net/2002/0502/bigpage.php3
   11. http://lwn.net/2002/0425/security.php3
   12. http://zdnet.com.com/2100-1104-896099.html
   13. http://sec.greymagic.com/adv/gm001-ns/
   14. http://bugzilla.mozilla.org/show_bug.cgi?id=141061
   15. http://www.zdnet.com/techupdate/stories/main/0,14179,2863241,00.html
   16. http://lwn.net/2002/0502/a/sudo.php3
   17. http://lwn.net/2002/0502/a/sudo166.php3
   18. http://lwn.net/alerts/Conectiva/CLA-2002:475.php3
   19. http://lwn.net/alerts/Debian/DSA-128-1.php3
   20. http://lwn.net/alerts/EnGarde/ESA-20020429-010.php3
   21. http://lwn.net/alerts/Gentoo/sudo-20020426.php3
   22. http://lwn.net/alerts/Mandrake/MDKSA-2002:028.php3
   23. http://lwn.net/alerts/RedHat/RHSA-2002:071-07.php3
   24. http://lwn.net/alerts/RedHat/RHSA-2002:072-07.php3
   25. http://lwn.net/alerts/Slackware/sl-1019842188.php3
   26. http://lwn.net/alerts/SuSE/SuSE-SA:2002:014.php3
   27. http://lwn.net/alerts/Trustix/2002-0046.php3
   28. http://lwn.net/2002/0425/security.php3#openssh
   29. http://lwn.net/2002/0502/a/openssh-rev2.php3
   30. http://lwn.net/alerts/Trustix/2002-0047.php3
   31. http://lwn.net/alerts/Caldera/CSSA-2002-017.0.php3
   32. http://lwn.net/alerts/Trustix/2002-0041.php3
   33. http://www.ethereal.com/
   34. http://www.ee.oulu.fi/research/ouspg/protos
   35. http://lwn.net/alerts/Conectiva/CLA-2002:474.php3
   36. http://lwn.net/alerts/Conectiva/CLA-2002:469.php3
   37. http://www.icecast.org/
   38. http://www.icecast.org/download.html
   39. http://lwn.net/alerts/Gentoo/icecast-20020426.php3
   40. http://lwn.net/alerts/RedHat/RHSA-2002:063-05.php3
   41. http://lwn.net/alerts/RedHat/RHSA-2002:062-08.php3
   42. http://lwn.net/alerts/Caldera/CSSA-2002-018.0.php3
   43. http://www.phprojekt.com/
   44. http://lwn.net/2002/0502/a/phprojekt.php3
   45. http://blahzdns.sourceforge.net/
   46. http://lwn.net/2002/0502/a/blahzdns.php3
   47. http://www.dnstools.com/
   48. http://lwn.net/2002/0502/a/dnstools.php3
   49. http://lwn.net/2002/0307/a/0203-radius.php3
   50. http://lwn.net/2002/0307/security.php3#radiusd
   51. http://lwn.net/alerts/SuSE/SuSE-SA:2002:013.php3
   52. http://lwn.net/alerts/Conectiva/CLA-2002:466.php3
   53. http://lwn.net/alerts/RedHat/RHSA-2002:030-08.php3
   54. http://lwn.net/2002/0328/security.php3#imlib
   55. http://lwn.net/alerts/SuSE/SuSE-SA:2002:015.php3
   56. http://lwn.net/alerts/Caldera/CSSA-2002-019.0.php3
   57. http://lwn.net/alerts/Conectiva/CLA-2002:470.php3
   58. http://lwn.net/alerts/Eridani/ERISA-2002:011.php3
   59. http://lwn.net/alerts/Mandrake/MDKSA-2002:029.php3
   60. http://lwn.net/alerts/RedHat/RHSA-2002:048-06.php3
   61. http://lwn.net/2002/0307/a/php-upload.php3
   62. http://lwn.net/2002/0307/a/cert-php.php3
   63. http://www.theregister.co.uk/content/55/24248.html
   64. http://lwn.net/2002/0307/security.php3#php
   65. http://lwn.net/alerts/Trustix/2002-0042.php3
   66. http://lwn.net/alerts/Trustix/2002-0033.php3
   67. http://lwn.net/alerts/Conectiva/CLA-2002:468.php3
   68. http://lwn.net/alerts/Debian/DSA-115-1.php3
   69. http://lwn.net/alerts/EnGarde/ESA-20020301-006.php3
   70. http://lwn.net/2002/0307/a/el-squid-php.php3
   71. http://lwn.net/alerts/Mandrake/MDKSA-2002:017.php3
   72. http://www.e-smith.org/article.php3?sid=58&mode=threaded&order=0
   73. http://www.openpkg.org/security/OpenPKG-SA-2002.001-php.html
   74. http://lwn.net/alerts/RedHat/RHSA-2002:035-18.php3
   75. http://lwn.net/alerts/Slackware/sl-1015349340.php3
   76. http://lwn.net/alerts/SuSE/SuSE-SA:2002:007.php3
   77. http://lwn.net/alerts/Trustix/2002-0033.php3
   78. http://lwn.net/alerts/YellowDog/YDU-20020305-1.php3
   79. http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=60523
   80. http://lwn.net/2002/0418/a/webalizer.php3
   81. http://www.mrunix.net/webalizer/
   82. http://lwn.net/2002/0418/security.php3#webalizer
   83. http://lwn.net/alerts/Conectiva/CLA-2002:476.php3
   84. http://lwn.net/alerts/EnGarde/ESA-20020423-009.php3
   85. http://www.linuxdevices.com/articles/AT2869412121.html
   86. http://lwn.net/2002/0502/a/security-week.php3
   87. http://cansecwest.com/
   88. http://www.dallascon.com/
   89. http://cyberlaw.stanford.edu/
   90. http://www.ieee-security.org/TC/SP02/sp02index.html
   91. http://www.cse-cst.gc.ca/en/iccc/iccc.html
   92. http://www.cse-cst.gc.ca/en/iccc/iccc.html
   93. http://www.nluug.nl/sane/
   94. http://www.rsaconference.net/
   95. http://www.summercon.org/
   96. http://www.gocsi.com/#netsec
   97. http://www.first.org/conference/2002
   98. http://www.csl.sri.com/programs/security/csfw/csfw15/csfw15.html
   99. http://securityfocus.com/calendar
  100. mailto:lwn@lwn.net
  101. mailto:lwn@lwn.net
  102.
 http://oasis.lwn.net/oasisc.php?s=4&c=5&cb=1090906271&url=http%3A%2F%2Flwn.net%2
 Fcorp%2Fadvertise%2Ftext%2F
  103. http://lwn.net/alerts/
  104. http://www.astaro.com/products/index.html
  105. http://castle.altlinux.ru/
  106. http://www.engardelinux.org/
  107. http://www.immunix.org/
  108. http://www.kaladix.org/
  109. http://www.nsa.gov/selinux/
  110. http://www.openwall.com/Owl/
  111. http://www.trustix.com/
  112. http://www.bastille-linux.org/
  113. http://lsap.org/
  114. http://lsm.immunix.org/
  115. http://www.openssh.com/
  116. http://www.securityfocus.com/archive/1
  117. http://www.nfr.net/firewall-wizards/
  118. http://www.jammed.com/Lists/ISN/
  119. http://www.calderasystems.com/support/security/
  120. http://www.conectiva.com.br/atualizacoes/
  121. http://www.debian.org/security/
  122. http://www.kondara.org/errata/k12-security.html
  123. http://www.esware.com/actualizaciones.html
  124. http://linuxppc.org/security/advisories/
  125. http://www.linux-mandrake.com/en/fupdates.php3
  126. http://www.redhat.com/support/errata/index.html
  127. http://www.suse.de/security/index.html
  128. http://www.turbolinux.com/security/
  129. http://www.yellowdoglinux.com/resources/
  130. http://www.BSDI.COM/services/support/patches/
  131. http://www.freebsd.org/security/security.html
  132. http://www.NetBSD.ORG/Security/
  133. http://www.openbsd.org/security.html
  134. http://www.calderasystems.com/support/forums/announce.html
  135. http://www.cobalt.com/support/resources/usergroups.html
  136. http://distro.conectiva.com.br/atualizacoes/
  137. http://www.debian.org/MailingLists/subscribe
  138. http://www.esware.com/lista_correo.html
  139. http://www.freebsd.org/handbook/eresources.html#ERESOURCES-MAIL
  140. http://www.kondara.org/mailinglist.html.en
  141. http://l5web.laser5.co.jp/ml/ml.html
  142. http://www.linuxfromscratch.org/services/mailinglistinfo.php
  143. http://www.linux-mandrake.com/en/flists.php3
  144. http://www.netbsd.org/MailingLists/
  145. http://www.openbsd.org/mail.html
  146. http://www.redhat.com/mailing-lists/
  147. http://www.slackware.com/lists/
  148. http://www.stampede.org/mailinglists.php3
  149. http://www.suse.com/en/support/mailinglists/index.html
  150. http://www.trustix.net/support/
  151. http://www.turbolinux.com/mailman/listinfo/tl-security-announce
  152. http://lists.yellowdoglinux.com/ydl_updates.shtml
  153. http://munitions.vipul.net/
  154. http://www.zedz.net/
  155. http://www.cert.org/nav/alerts.html
  156. http://ciac.llnl.gov/ciac/
  157. http://www.MountainWave.com/
  158. http://www.counterpane.com/crypto-gram.html
  159. http://linuxlock.org/
  160. http://linuxsecurity.com/
  161. http://www.securityfocus.com/
  162. http://www.securityportal.com/
  163. http://lwn.net/2002/0502/kernel.php3
  164. http://www.eklektix.com/
  165. http://www.eklektix.com/
 
 --- ifmail v.2.14.os7-aks1
  * Origin: Unknown (2:4615/71.10@fidonet)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор