ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : Sergey Lentsov                       2:4615/71.10   12 Jul 2001  16:16:14
 To : All
 Subject : URL: http://www.lwn.net/2001/0712/security.php3
 -------------------------------------------------------------------------------- 
 

    [1][LWN Logo] 
    
                                [2]Click Here 
    [LWN.net]
    
    Sections:
     [3]Main page
     Security
     [4]Kernel
     [5]Distributions
     [6]On the Desktop
     [7]Development
     [8]Commerce
     [9]Linux in the news
     [10]Announcements
     [11]Linux History
     [12]Letters
    [13]All in one big page
    
    See also: [14]last week's Security page.
    
 Security
 
 News and Editorials
 
    NAI Labs Announces DARPA-Funded FreeBSD Security Initiative. NAI Labs
    [15]has received a $1.2 Million contract from the DARPA to develop
    security extension to FreeBSD. The military, it seems, has decided
    that it is dependent enough on free software to put some effort into
    improving its security. This particular effort, which is expected to
    take 18 months, should bring a number of improvements to FreeBSD.
    Linux security developers may want to have a look at what is going on
    as well.
    
    The [16]Community-Based Open Source Security project is the recipient
    of this grant. It's made up of a number of high-profile names,
    including Robert Watson, Kirk McKusick, and Eivind Eklund. The aim of
    the project is to target some of the "low-hanging fruit" in the
    security area, including:
      * "Transfer of existing security knowledge." The purpose here is to
        develop a FreeBSD security architecture document and to enhance
        the FreeBSD man pages with security information.
      * Incorporation of existing security technology into FreeBSD. This
        includes extended filesystem attributes, mandatory access control,
        hardening of the network stack, incorporation of pluggable
        authentication modules (PAM), filesystem and swap encryption, and,
        someday, transfer of some goodies from the NSA's Security-Enhanced
        Linux project.
      * The development of a framework for the incorporation of new
        security mechanisms into the FreeBSD kernel, much like the Linux
        security module work that is happening now.
      * The hardening of security-critical applications through the use of
        a "privilege management toolkit."
        
    Some of the work is simply trying to catch up with capabilities Linux
    has had for years (i.e. PAM, TCP SYN cookies), but some of it is
    interesting and new. The results bear watching.
    
    Linux advocates should also, perhaps, be paying more attention to the
    possibility of government funding for some development work. The money
    is out there, and, often, it's looking for something interesting to
    do. Given the difficulty of finding venture capital these days, sharp
    people with good ideas might just want to consider taking the grant
    approach instead.
    
    Snort 1.8 is released. [17]Version 1.8 of the Snort intrusion
    detection system is out. New features include a "stateful inspection
    and TCP stream reassembly module," host tagging, detection of ARP
    spoofing, defeats for a number of evasion techniques, and much more.
    This may be the last big release for a little bit, since the author,
    Martin Roesch, is about to become a father.
    
 Security Reports
 
    dip 3.3.7p overflow. An overflow condition [18]has been discovered in
    dip on SuSE 7.0 X86 and Slackware. This is an old bug that has
    resurfaced.
    
    lmail local root exploit. Lmail is susceptible to a [19]local root
    exploit that can allow attackers to overwrite and create files.
    
    OpenSSL Pseudo-random number generator weakness. A weakness has been
    discovered in the OpenSSL Pseudo random number generator that can
    allow an attacker to discover the PNRG's state and predict future
    values.
    
    This week's updates:
      * [20]Engarde
      * [21]Trustix
    
    Caldera security update to OpenSSH. Caldera International has released
    [22]a security update to OpenSSH fixing an interesting problem: an
    attacker can remove any file on the system, as long as it's called
    "cookies"...
    
    Immunix update for tetex. Immunix has posted a security update for
    [23]tetex to address temporary file handling problems that can lead to
    privilege elevation.
    
    Tripwire temporary files. A [24]temporary file insecurity problem has
    been discovered in Tripwire which make it possible for a local user to
    overwrite files with root permissions.
    
    Xdm cookies advisory. If xdm is compiled with the wrong options
    [25]the cookie file can be guessed and a denial of service attack can
    be performed using the X server.
    
    Red Hat advisory for xloadimage. Red Hat has issued an advisory for
    the [26]xloadimage package to address buffer overflow issues. The
    problem is mostly limited to remote exploits if xloadimage is called
    by Netscape (by 'plugger', for example).
    
    Proprietary products.
    The following proprietary products were reported to contain
    vulnerabilities:
      * Systems running Oracle 8i [27]are vulnerable to remote attacks
        that can allow intruders to control the database server.
        
 Updates
 
    fetchmail buffer overflow.
    Check the [28]June 21st LWN Security Summary for the original report.
    This is remotely exploitable and could lead to root access if
    fetchmail is run by root. An upgrade to fetchmail 5.8.6 will resolve
    the problem.
    
    This week's updates:
      * [29]Mandrakesoft
        
    Previous updates:
      * [30]Caldera (June 28th)
      * [31]Engarde (June 28th)
      * [32]Immunix (June 21st)
      * [33]Debian (June 21st)
      * [34]Conectiva (June 21st)
      * [35]Slackware, June 18th Changelog
        
    Webmin environment variable inheritance vulnerability. Check the
    [36]May 31st LWN Security Summary for the original report.
    
    This week's updates:
      * [37]Caldera (update now available for OpenLinux 3.1).
        
    Previous updates:
      * [38]Linux-Mandrake.
      * [39]Caldera, disabling Webmin recommended, no updated packages
        available yet. (May 31st)
      * [40]Caldera, updated packages now available (June 7th)
        
    xinetd buffer overflow.
    Check the [41]June 14th LWN Security Summary for the initial report.
    The buffer overflow is in the ident logging portion of xinetd, so one
    workaround to the problem is to disable ident logging. Since then,
    more extensive problems have been found in string handling in xinetd,
    and the current round of updates addresses them.
    
    This week's updates:
      * [42]Mandrakesoft
      * [43]RedHat
        
    Previous updates:
      * [44]Conectiva.
      * [45]EnGarde Secure Linux. (No mention in advisory of string
        handling problems).
      * [46]Immunix (StackGuard is not fully effective against this
        vulnerability).
      * [47]SuSE.
      * [48]Debian (June 14).
      * [49]Conectiva (June 14).
        
 Resources
 
    Security BOF report updated. Emily Ratliff's report from the USENIX
    security module BOF has seen some minor updates from the author; an
    [50]updated version is now available.
    
    Security Alerts: PHP Weaknesses? (O'Reilly). Noel Davis [51]looks at
    some security vulnerabilities in PHP and discusses other current
    security issues in an O'Reilly article.
    
    A rogue's gallery of denial of service attacks (ZDNet). ZDNet
    [52]looks at a few tools that can be used to thwart denial of service
    (DOS) attacks.
    
    Small TCP packets == very large overhead. Darren Reed [53]discusses
    how small TCP packets can be used maliciously to bog down a server.
    The minimum size for the maximum segment size field is too small for
    many operating systems and the value is defined by the caller.
    
    LinuxSecurity.com newsletter. The weekly [54]LinuxSecurity.com
    newsletter has been published. Advisories for Samba, xinetd, Zope,
    Scotty, and webmin are presented.
    
 Events
 
    Upcoming Security Events.
    
    Date Event Location
    July 12, 2001 [55]Black Hat Briefings USA '01 Las Vegas, Nevada, USA.
    July 17, 2001 [56]The Open Group Security Forum briefing Austin, Texas
    August 6 - 10, 2001 [57]CERT Conference 2001 Omaha, NE, USA.
    August 7, 2001 [58]CIBC World Markets First Annual Security & Privacy
    Conference New York, NY, USA.
    August 13 - 17, 2001 [59]10th USENIX Security Symposium 2001
    Conference Washington, D.C.
    August 13 - 17, 2001 [60]HAL2001 Enschede, The Netherlands
    September 11 - 13, 2001 [61]New Security Paradigms Workshop 2001(NSPW)
    Cloudcroft, New Mexico, USA
    
    For additional security-related events, included training courses
    (which we don't list above) and events further in the future, check
    out Security Focus' [62]calendar, one of the primary resources we use
    for building the above list. To submit an event directly to us, please
    send a plain-text message to [63]lwn@lwn.net.
    
    Section Editor: [64]Forrest Cook
    July 12, 2001
    
                               [65]Click Here 
    Secured Distributions:
    [66]Blue Linux
    [67]Engarde Secure Linux
    [68]Immunix
    [69]Kaladix
    [70]Nexus
    [71]NSA Security Enhanced
    [72]Openwall GNU/Linux
    [73]SLinux
    [74]Trustix
    Security Projects
    [75]Bastille
    [76]Linux Security Audit Project
    [77]Linux Security Module
    [78]OpenSSH
    Security List Archives
    [79]Bugtraq Archive
    [80]Firewall Wizards Archive
    [81]ISN Archive
    Distribution-specific links
    [82]Caldera Advisories
    [83]Conectiva Updates
    [84]Debian Alerts
    [85]Kondara Advisories
    [86]Esware Alerts
    [87]LinuxPPC Security Updates
    [88]Mandrake Updates
    [89]Red Hat Errata
    [90]SuSE Announcements
    [91]Yellow Dog Errata
    BSD-specific links
    [92]BSDi
    [93]FreeBSD
    [94]NetBSD
    [95]OpenBSD
    Security mailing lists [96]Caldera
    [97]Cobalt
    [98]Conectiva
    [99]Debian
    [100]Esware
    [101]FreeBSD
    [102]Kondara
    [103]LASER5
    [104]Linux From Scratch
    [105]Linux-Mandrake
    [106]NetBSD
    [107]OpenBSD
    [108]Red Hat
    [109]Slackware
    [110]Stampede
    [111]SuSE
    [112]Trustix
    [113]turboLinux
    [114]Yellow Dog
    Security Software Archives
    [115]munitions
    [116]ZedZ.net (formerly replay.com)
    Miscellaneous Resources
    [117]CERT
    [118]CIAC
    [119]Comp Sec News Daily
    [120]Crypto-GRAM
    [121]LinuxLock.org
    [122]LinuxSecurity.com
    [123]OpenSEC
    [124]Security Focus
    [125]SecurityPortal
    
    
                                                         [126]Next: Kernel
    
    [127]Eklektix, Inc. Linux powered! Copyright Л 2001 [128]Eklektix,
    Inc., all rights reserved
    Linux (R) is a registered trademark of Linus Torvalds
 
 References
 
    1. http://lwn.net/
    2. http://ads.tucows.com/click.ng/pageid=001-012-132-000-000-002-000-000-012
    3. http://lwn.net/2001/0712/
    4. http://lwn.net/2001/0712/kernel.php3
    5. http://lwn.net/2001/0712/dists.php3
    6. http://lwn.net/2001/0712/desktop.php3
    7. http://lwn.net/2001/0712/devel.php3
    8. http://lwn.net/2001/0712/commerce.php3
    9. http://lwn.net/2001/0712/press.php3
   10. http://lwn.net/2001/0712/announce.php3
   11. http://lwn.net/2001/0712/history.php3
   12. http://lwn.net/2001/0712/letters.php3
   13. http://lwn.net/2001/0712/bigpage.php3
   14. http://lwn.net/2001/0704/security.php3
   15. http://opensource.nailabs.com/news/20010709-cboss.html
   16. http://opensource.nailabs.com/initiatives/cboss/
   17. http://lwn.net/2001/0712/a/snort-1.8.php3
   18. http://lwn.net/2001/0712/a/dip337p.php3
   19. http://lwn.net/2001/0712/a/lmail.php3
   20. http://lwn.net/2001/0712/a/eng-openssl.php3
   21. http://lwn.net/2001/0712/a/trustix-openssl.php3
   22. http://lwn.net/2001/0712/a/cald-openssh.php3
   23. http://lwn.net/2001/0712/a/imm-tetex.php3
   24. http://lwn.net/2001/0712/a/tripwiretemp.php3
   25. http://lwn.net/2001/0712/a/xdmcookies.php3
   26. http://lwn.net/2001/0712/a/rh-xloadimage.php3
   27. http://lwn.net/2001/0712/a/oracle8i.php3
   28. http://lwn.net/2001/0621/security.php3#fetchmail
   29. http://lwn.net/2001/0712/a/mandfetchmail.php3
   30. http://lwn.net/2001/0628/a/caldera-fetchmail.php3
   31. http://lwn.net/2001/0628/a/engarde-fetchmail.php3
   32. http://lwn.net/2001/0621/a/im-fetchmail.php3
   33. http://lwn.net/2001/0621/a/deb-fetchmail.php3
   34. http://lwn.net/2001/0621/a/con-fetchmail.php3
   35. http://www.slackware.com/changelog/current.php?cpu=i386
   36. http://lwn.net/2001/0531/security.php3#webmin
   37. http://lwn.net/2001/0712/a/webmin1.php3
   38. http://lwn.net/2001/0621/a/lm-webmin.php3
   39. http://lwn.net/2001/0531/a/caldera-webmin.php3
   40. http://lwn.net/2001/0607/a/caldera-webmin.php3
   41. http://lwn.net/2001/0614/security.php3#xinetdbo
   42. http://lwn.net/2001/0712/a/mandxinetd.php3
   43. http://lwn.net/2001/0712/a/rhxinetd.php3
   44. http://lwn.net/2001/0704/a/con-xinetd.php3
   45. http://lwn.net/2001/0704/a/esl-xinetd.php3
   46. http://lwn.net/2001/0704/a/imm-xinetd.php3
   47. http://lwn.net/2001/0704/a/suse-xinetd.php3
   48. http://lwn.net/2001/0621/a/deb-xinetd.php3
   49. http://lwn.net/2001/0621/a/con-xinetd.php3
   50. http://lwn.net/2001/0704/a/security-module-BOF.php3
   51. http://linux.oreillynet.com/pub/a/linux/2001/07/09/insecurities.html
   52. http://www.zdnet.com/enterprise/stories/main/0,10228,2784023,00.html
   53. http://lwn.net/2001/0712/a/smalltcp.php3
   54. http://lwn.net/2001/0712/a/infosecnews.php3
   55. http://www.blackhat.com/
   56. http://www.opengroup.org/austin2001/security_outline.htm
   57. http://www.certconf.org/
   58. http://www.cibcwm.com/eq/conference/security/
   59. http://www.usenix.org/events/sec2001
   60. http://www.hal2001.org/hal/01Home/index.html
   61. http://www.nspw.org/
   62. http://securityfocus.com/calendar
   63. mailto:lwn@lwn.net
   64. mailto:lwn@lwn.net
   65. http://ads.tucows.com/click.ng/buttonpos=lwnbuttonsecurity
   66. http://bluelinux.sourceforge.net/
   67. http://www.engardelinux.org/
   68. http://www.immunix.org/
   69. http://www.maganation.com/~kaladix/
   70. http://Nexus-Project.net/
   71. http://www.nsa.gov/selinux/
   72. http://www.openwall.com/Owl/
   73. http://www.slinux.org/
   74. http://www.trustix.com/
   75. http://www.bastille-linux.org/
   76. http://lsap.org/
   77. http://lsm.immunix.org/
   78. http://www.openssh.com/
   79. http://www.securityfocus.com/bugtraq/archive/
   80. http://www.nfr.net/firewall-wizards/
   81. http://www.jammed.com/Lists/ISN/
   82. http://www.calderasystems.com/support/security/
   83. http://www.conectiva.com.br/atualizacoes/
   84. http://www.debian.org/security/
   85. http://www.kondara.org/errata/k12-security.html
   86. http://www.esware.com/actualizaciones.html
   87. http://linuxppc.org/security/advisories/
   88. http://www.linux-mandrake.com/en/fupdates.php3
   89. http://www.redhat.com/support/errata/index.html
   90. http://www.suse.de/security/index.html
   91. http://www.yellowdoglinux.com/resources/errata.shtml
   92. http://www.BSDI.COM/services/support/patches/
   93. http://www.freebsd.org/security/security.html
   94. http://www.NetBSD.ORG/Security/
   95. http://www.openbsd.org/security.html
   96. http://www.calderasystems.com/support/forums/announce.html
   97. http://www.cobalt.com/support/resources/usergroups.html
   98. http://distro.conectiva.com.br/atualizacoes/
   99. http://www.debian.org/MailingLists/subscribe
  100. http://www.esware.com/lista_correo.html
  101. http://www.freebsd.org/handbook/eresources.html#ERESOURCES-MAIL
  102. http://www.kondara.org/mailinglist.html.en
  103. http://l5web.laser5.co.jp/ml/ml.html
  104. http://www.linuxfromscratch.org/services/mailinglistinfo.php
  105. http://www.linux-mandrake.com/en/flists.php3
  106. http://www.netbsd.org/MailingLists/
  107. http://www.openbsd.org/mail.html
  108. http://www.redhat.com/mailing-lists/
  109. http://www.slackware.com/lists/
  110. http://www.stampede.org/mailinglists.php3
  111. http://www.suse.com/en/support/mailinglists/index.html
  112. http://www.trustix.net/support/
  113. http://www.turbolinux.com/mailman/listinfo/tl-security-announce
  114. http://lists.yellowdoglinux.com/ydl_updates.shtml
  115. http://munitions.vipul.net/
  116. http://www.zedz.net/
  117. http://www.cert.org/nav/alerts.html
  118. http://ciac.llnl.gov/ciac/
  119. http://www.MountainWave.com/
  120. http://www.counterpane.com/crypto-gram.html
  121. http://linuxlock.org/
  122. http://linuxsecurity.com/
  123. http://www.opensec.net/
  124. http://www.securityfocus.com/
  125. http://www.securityportal.com/
  126. http://lwn.net/2001/0712/kernel.php3
  127. http://www.eklektix.com/
  128. http://www.eklektix.com/
 
 --- ifmail v.2.14.os7-aks1
  * Origin: Unknown (2:4615/71.10@fidonet)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор