ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : Sergey Lentsov                       2:4615/71.10   03 Jan 2002  18:21:02
 To : All
 Subject : URL: http://www.lwn.net/2002/0103/security.php3
 -------------------------------------------------------------------------------- 
 

    [1][LWN Logo] 
    
                                [2]Click Here 
    [LWN.net]
    
    Sections:
     [3]Main page
     Security
     [4]Kernel
     [5]Distributions
     [6]Development
     [7]Commerce
     [8]Linux in the news
     [9]Announcements
     [10]Linux History
     [11]Letters
    [12]All in one big page
    
    See also: [13]last week's Security page.
    
 Security
 
 News and Editorials
 
    Microsoft's security bugs. Perhaps some of you run networks where you
    have to deal with these things... Certainly the current [14]bug in
    Windows XP is getting a lot of attention, since it exposes most
    network-connected systems to a remote exploit. The thing that stands
    out to some of us is that it took Microsoft five weeks to get a fix
    out. Not all Linux security problems get fixed immediately, but a
    vulnerability that exposed almost every network-connected Linux system
    would see a very quick response.
    
    Fewer people have been concerned about [15]this Internet Explorer bug,
    but it's really just as bad. Write a web page that feeds IE a .exe
    file with an image/jpeg MIME header, and IE will happily execute it.
    You don't even have to be a script kiddie to exploit this one. Be
    careful out there...
    
 Security Reports
 
    Remotely exploitable security problem in mutt. A [16]couple of new
    mutt releases (1.2.5.1 and 1.3.25) were announced this week. These
    releases include a fix for a security problem which, apparently, can
    be exploited remotely. The nature of the vulnerability is still being
    kept under wraps.
    
    The Debian Project came out with [17]the first mutt update for this
    vulnerability that we have seen. Expect to see updates to a number of
    other distributons shortly.
    
    Problems with libgtop_daemon
    . The libgtop_daemon package is a GNOME program which makes system
    information available remotely. LWN reported the remotely exploitable
    format string and buffer overflow vulnerabilities in that package on
    [18]December 6th. On November 28th [19]SuSE recommended disabling the
    libgtop_daemon on systems where it is running until an update is
    available.
    
    MandrakeSoft has issued what appears to be the first [20]security
    update to libgtop that fixes the problems. Mandrake Linux systems do
    not run libgtop by default, but applying the update is a good idea
    anyway.
    
    Debian security update to gpm. The Debian Project has issued [21]a
    security update to gpm fixing a format string vulnerability in that
    package.
    
    EnGarde security update to stunnel. Stunnel has a format string bug
    described in detail [22]here. EnGarde Secure Linux has already put out
    a [23]security update addressing the problem.
    
    Red Hat security update to namazu. Red Hat has released [24]a security
    update to namazu fixing a cross-site scripting problem in that
    package.
    
    HP security updates to sendmail, ghostscript, and glibc. HP has sent
    out [25]a bulk security update notice for users of its "HP Secure OS
    Software for Linux." Updated packages include sendmail (local root
    exploit), ghostscript (read access to protected files) and glibc (file
    globbing buffer overflow).
    
    Proprietary products.
    The following proprietary products were reported to contain
    vulnerabilities:
      * Magic Enterprise Edition, from Magic Software, has multiple
        vulnerabilities which are detailed in [26]this post to bugtrak
        from immutec.
      * The Aktivate Shopping System for Linux (and other Unices) had a
        [27]cross site scripting vulnerability reported on bugtrak.
    
 Updates
 
    Buffer overflow problem in glibc. The glibc filename globbing code has
    a buffer overflow problem. For those who are interested, Global
    InterSec LLC has provided [28]a detailed description of this
    vulnerability. This problem was first reported by LWN
    on[29] December 20th.
    
    This week's updates:
      * [30]SuSE (December 24, 2001)
      * [31]Immunix (December 19, 2001)
      * [32]Mandrake (December 19, 2001)
      * [33]Trustix (December 19, 2001)
        
    Previous updates:
      * [34]EnGarde (December 17, 2001)
      * [35]Red Hat (December 14, 2001)
        
    Mailman cross-site scripting vulnerability. This vulnerability was
    first reported by LWN on [36] December 13th.
    
    This week's updates:
      * [37]Red Hat (December 19, 2001) ( Red Hat 7.2 )
      * [38]Red Hat (December 20, 2001) ( PowerTools 7 and 7.1 )
        
    Previous updates:
      * [39]Debian (December 16, 2001)
      * [40]Conectiva (December 11, 2001)
        
    OpenSSH UseLogin vulnerability. This obscure vulnerability is not of
    concern to most sites. This problem first appeared in [41] the
    December 6th LWN security page.
    
    This week's updates:
      * [42]Trustix (December 19, 2001)
        
    Previous updates:
      * [43]Caldera (December 14, 2001) (correct December 11th update)
      * [44]Conectiva (December 13, 2001)
      * [45]Mandrake (December 13, 2001)
      * [46]Caldera (December 11, 2001)
      * [47]Debian (December 5, 2001) (backport from OpenSSH 3.0.2)
      * [48]Red Hat (December 4, 2001) (backport from OpenSSH 3.0.2)
        
 Resources
 
    KDE frontend to iptables. Version 2.2.3 of knetfilter was
    [49]released. Knetfilter may be used with Linux 2.4 to manage the
    functionality of netfilter. Knetfilter "lets you set up most common
    firewall configurations, as well as perform more sophisticated
    management of a complex firewall."
    
    The Linux Intrusion Detection System 1.1.0 for the 2.4.16 (2.4.x)
    kernel [50]is available. The Linux Intrusion Detection System (LIDS)
    is a" a patch which enhances the kernel's security by implementing a
    reference monitor and Mandatory Access Control (MAC). When it is in
    effect, chosen file access, all system/network administration
    operations, any capability use, raw device, memory, and I/O access can
    be made impossible even for root."
    
 Events
 
    Upcoming Security Events.
    
    Date Event Location
    January 7 - 9, 2002 [51]2002 Federal Convention on Emerging
    Technologies: a Homeland Security Forum Las Vegas, Nevada, USA
    January 30 - February 2, 2002 [52]Second Annual Privacy and Data
    Protection Summit Washington D.C., USA
    February 15 - 17, 2002 [53]CODECON 2002 San Francisco, California, USA
    February 18 - 22, 2002 [54]RSA Conference 2002 San Jose, CA., USA
    
    For additional security-related events, included training courses
    (which we don't list above) and events further in the future, check
    out Security Focus' [55]calendar, one of the primary resources we use
    for building the above list. To submit an event directly to us, please
    send a plain-text message to [56]lwn@lwn.net.
    
    Section Editor: [57]Dennis Tenney
    January 3, 2002
    
                               [58]Click Here 
    LWN Resources
    [59]Security alerts archive
    Secured Distributions:
    [60]Astaro Security
    [61]Blue Linux
    [62]Castle
    [63]Engarde Secure Linux
    [64]Immunix
    [65]Kaladix Linux
    [66]NSA Security Enhanced
    [67]Openwall GNU/Linux
    [68]Trustix
    Security Projects
    [69]Bastille
    [70]Linux Security Audit Project
    [71]Linux Security Module
    [72]OpenSSH
    Security List Archives
    [73]Bugtraq Archive
    [74]Firewall Wizards Archive
    [75]ISN Archive
    Distribution-specific links
    [76]Caldera Advisories
    [77]Conectiva Updates
    [78]Debian Alerts
    [79]Kondara Advisories
    [80]Esware Alerts
    [81]LinuxPPC Security Updates
    [82]Mandrake Updates
    [83]Red Hat Errata
    [84]SuSE Announcements
    [85]Yellow Dog Errata
    BSD-specific links
    [86]BSDi
    [87]FreeBSD
    [88]NetBSD
    [89]OpenBSD
    Security mailing lists [90]Caldera
    [91]Cobalt
    [92]Conectiva
    [93]Debian
    [94]Esware
    [95]FreeBSD
    [96]Kondara
    [97]LASER5
    [98]Linux From Scratch
    [99]Linux-Mandrake
    [100]NetBSD
    [101]OpenBSD
    [102]Red Hat
    [103]Slackware
    [104]Stampede
    [105]SuSE
    [106]Trustix
    [107]turboLinux
    [108]Yellow Dog
    Security Software Archives
    [109]munitions
    [110]ZedZ.net (formerly replay.com)
    Miscellaneous Resources
    [111]CERT
    [112]CIAC
    [113]Comp Sec News Daily
    [114]Crypto-GRAM
    [115]LinuxLock.org
    [116]LinuxSecurity.com
    [117]Security Focus
    [118]SecurityPortal
    
    
                                                         [119]Next: Kernel
    
    [120]Eklektix, Inc. Linux powered! Copyright Л 2002 [121]Eklektix,
    Inc., all rights reserved
    Linux (R) is a registered trademark of Linus Torvalds
 
 References
 
    1. http://lwn.net/
    2. http://ads.tucows.com/click.ng/pageid=001-012-132-000-000-002-000-000-012
    3. http://lwn.net/2002/0103/
    4. http://lwn.net/2002/0103/kernel.php3
    5. http://lwn.net/2002/0103/dists.php3
    6. http://lwn.net/2002/0103/devel.php3
    7. http://lwn.net/2002/0103/commerce.php3
    8. http://lwn.net/2002/0103/press.php3
    9. http://lwn.net/2002/0103/announce.php3
   10. http://lwn.net/2002/0103/history.php3
   11. http://lwn.net/2002/0103/letters.php3
   12. http://lwn.net/2002/0103/bigpage.php3
   13. http://lwn.net/2001/1220/security.php3
   14. http://lwn.net/2002/0103/a/xp-bug.php3
   15. http://lwn.net/2002/0103/a/ie-bug.php3
   16. http://lwn.net/2002/0103/a/mutt.php3
   17. http://lwn.net/alerts/Debian/DSA-096-1.php3
   18. http://lwn.net/2001/1206/security.php3#libgtop
   19. http://lwn.net/alerts/SuSE/SuSE-SA:2001:043.php3
   20. http://lwn.net/alerts/Mandrake/MDKSA-2001:094.php3
   21. http://lwn.net/alerts/Debian/DSA-095-1.php3
   22. http://lwn.net/2002/0103/a/stunnelformatstringbug.php3
   23. http://lwn.net/alerts/EnGarde/ESA-20011227-01.php3
   24. http://lwn.net/alerts/RedHat/RHSA-2001:162-04.php3
   25. http://lwn.net/2002/0103/a/hp-security.php3
   26. http://lwn.net/2002/0103/a/MagicEnterprise.php3
   27. http://lwn.net/2002/0103/a/AktivateScripting.php3
   28. http://lwn.net/2001/1220/a/glibc-vulnerability.php3
   29. http://lwn.net/2001/1220/security.php3#glibc
   30. http://lwn.net/alerts/SuSE/SuSE-SA:2001:046.php3
   31. http://lwn.net/alerts/Immunix/IMNX-2001-70-037-01.php3
   32. http://lwn.net/alerts/Mandrake/MDKSA-2001:095.php3
   33. http://lwn.net/alerts/Trustix/2001-0029.php3
   34. http://lwn.net/alerts/EnGarde/ESA-20011217-01.php3
   35. http://lwn.net/alerts/RedHat/RHSA-2001:160-09.php3
   36. http://lwn.net/2001/1213/security.php3#mailman
   37. http://lwn.net/alerts/RedHat/RHSA-2001:168-05.php3
   38. http://lwn.net/alerts/RedHat/RHSA-2001:169-10.php3
   39. http://lwn.net/alerts/Debian/DSA-094-1.php3
   40. http://lwn.net/alerts/Conectiva/CLA-2001:445.php3
   41. http://lwn.net/2001/1206/security.php3#openssh
   42. http://lwn.net/alerts/Trustix/2001-0030.php3
   43. http://lwn.net/alerts/Caldera/CSSA-2001-042.1.php3
   44. http://lwn.net/alerts/Conectiva/CLA-2001:446.php3
   45. http://lwn.net/alerts/Mandrake/MDKSA-2001:092.php3
   46. http://lwn.net/alerts/Caldera/CSSA-2001-042.0.php3
   47. http://lwn.net/alerts/Debian/DSA-091-1.php3
   48. http://lwn.net/alerts/RedHat/RHSA-2001:161-08.php3
   49. http://lwn.net/2002/0103/a/knetfilter.php3
   50. http://lwn.net/2002/0103/a/intrusiondetection.php3
   51. http://www.federalevents.com/fc_main.html
   52. http://www.privacyassociation.org/html/conferences.html
   53. http://www.codecon.org/
   54. http://www.rsaconference.com/
   55. http://securityfocus.com/calendar
   56. mailto:lwn@lwn.net
   57. mailto:lwn@lwn.net
   58. http://ads.tucows.com/click.ng/buttonpos=lwnbuttonsecurity
   59. http://lwn.net/alerts/
   60. http://www.astaro.com/products/index.html
   61. http://bluelinux.sourceforge.net/
   62. http://castle.altlinux.ru/
   63. http://www.engardelinux.org/
   64. http://www.immunix.org/
   65. http://www.kaladix.org/
   66. http://www.nsa.gov/selinux/
   67. http://www.openwall.com/Owl/
   68. http://www.trustix.com/
   69. http://www.bastille-linux.org/
   70. http://lsap.org/
   71. http://lsm.immunix.org/
   72. http://www.openssh.com/
   73. http://www.securityfocus.com/archive/1
   74. http://www.nfr.net/firewall-wizards/
   75. http://www.jammed.com/Lists/ISN/
   76. http://www.calderasystems.com/support/security/
   77. http://www.conectiva.com.br/atualizacoes/
   78. http://www.debian.org/security/
   79. http://www.kondara.org/errata/k12-security.html
   80. http://www.esware.com/actualizaciones.html
   81. http://linuxppc.org/security/advisories/
   82. http://www.linux-mandrake.com/en/fupdates.php3
   83. http://www.redhat.com/support/errata/index.html
   84. http://www.suse.de/security/index.html
   85. http://www.yellowdoglinux.com/resources/
   86. http://www.BSDI.COM/services/support/patches/
   87. http://www.freebsd.org/security/security.html
   88. http://www.NetBSD.ORG/Security/
   89. http://www.openbsd.org/security.html
   90. http://www.calderasystems.com/support/forums/announce.html
   91. http://www.cobalt.com/support/resources/usergroups.html
   92. http://distro.conectiva.com.br/atualizacoes/
   93. http://www.debian.org/MailingLists/subscribe
   94. http://www.esware.com/lista_correo.html
   95. http://www.freebsd.org/handbook/eresources.html#ERESOURCES-MAIL
   96. http://www.kondara.org/mailinglist.html.en
   97. http://l5web.laser5.co.jp/ml/ml.html
   98. http://www.linuxfromscratch.org/services/mailinglistinfo.php
   99. http://www.linux-mandrake.com/en/flists.php3
  100. http://www.netbsd.org/MailingLists/
  101. http://www.openbsd.org/mail.html
  102. http://www.redhat.com/mailing-lists/
  103. http://www.slackware.com/lists/
  104. http://www.stampede.org/mailinglists.php3
  105. http://www.suse.com/en/support/mailinglists/index.html
  106. http://www.trustix.net/support/
  107. http://www.turbolinux.com/mailman/listinfo/tl-security-announce
  108. http://lists.yellowdoglinux.com/ydl_updates.shtml
  109. http://munitions.vipul.net/
  110. http://www.zedz.net/
  111. http://www.cert.org/nav/alerts.html
  112. http://ciac.llnl.gov/ciac/
  113. http://www.MountainWave.com/
  114. http://www.counterpane.com/crypto-gram.html
  115. http://linuxlock.org/
  116. http://linuxsecurity.com/
  117. http://www.securityfocus.com/
  118. http://www.securityportal.com/
  119. http://lwn.net/2002/0103/kernel.php3
  120. http://www.eklektix.com/
  121. http://www.eklektix.com/
 
 --- ifmail v.2.14.os7-aks1
  * Origin: Unknown (2:4615/71.10@fidonet)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор