ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : Sergey Lentsov                       2:4615/71.10   16 May 2002  22:36:40
 To : All
 Subject : URL: http://www.lwn.net/2002/0516/security.php3
 -------------------------------------------------------------------------------- 
 

    [1][LWN Logo] 
    [LWN.net]
 
    Sections:
     [2]Main page
     Security
     [3]Kernel
     [4]Distributions
     [5]Development
     [6]Commerce
     [7]Linux in the news
     [8]Announcements
     [9]Letters
    [10]All in one big page
 
    See also: [11]last week's Security page.
 
 Security
 
 News and Editorials
 
    How Can You Defend Against a Superworm? (Linux Journal). Don Marti
    [12]speaks with Brandon Wiley, coordinator of the Tristero project,
    about the threat of "superworms" and what might be done to defend
    against it. "Linux administrators see log files full of failed attack
    attempts when some other platform is subject to a worm attack. Dumb
    worms might be a nuisance and a waste of bandwidth. But what if worms
    were a little smarter about which hosts to attack, when to attack and
    with what exploit? What if a worm developer could update all the
    running worms, on the fly, with a new exploit?"
 
    Lock in the Nessus monster (ARNnet). Con Zymaris [13]writes about
    selling security scanning using [14]nessus as a service. " Here's the
    crux of the analysis, however: no matter how good these [proprietary]
    tools are, all pale by comparison to Nessus. In all the security
    expert reports I have read in the past 18 months, Nessus is considered
    the best-of-breed security vulnerability scanning product, by a long
    margin. That it is open source, has long-term viability and is totally
    free of any licensing or use costs are mere bonuses, and great for
    reducing our cost of establishing this business service."
 
    Nessus does not call home. Despite some rumors to the contrary at the
    recent [15]CanSecWest conference, Renaud Deraison [16]reassures us
    that "Nessus does not call home. It never does, never did and never
    will. However, the checks [it performs] have a side effect that may
    have the naughty side effect to sending some packets to nessus.org,
    which can make people think I have the ability to monitor their
    scans."
 
    Sending a wake-up call to the W3C (News.com). Rich DeMillo
    Hewlett-Packard's vice president of technology strategy [17]tells us
    why "Linux will be the first operating system" HP will port to their
    [18]Secure Platform Architecture (SPA). " We think it makes great
    sense to do this in the town square by calling on the trust-enhancing
    ability of the open-source community with its rigorous peer review,
    open publishing and testing methodologies."
 
 Security Reports
 
    DHCP remotely exploitable format string vulnerability. The May 8, 2000
    release of [19]ISC DHCP 3.0p1 fixes this [20]serious vulnerability in
    ISC DHCPD 3.0 to 3.0.1rc8 inclusive. So far, the only distributor
    update we have seen for this vulnerability is this one from
    [21]Conectiva.
 
    We encourage dhcp users to upgrade, disable dhcp or, at a minimum,
    consider using ingress filtering as described in the [22]CERT
    advisory.
 
    Netfilter NAT/ICMP information leak. "Netfilter ("iptables") can leak
    information about how port forwarding is done in unfiltered ICMP
    packets. The older "ipchains" code is not affected." The [23]bug
    exists in the iptables package in all versions of the 2.4.4 kernel up
    to "(at least) 2.4.19-pre6".
 
    A sufficient workaround is to filter out untracked local icmp packets
    using the following command:
   iptables -A OUTPUT -m state -p icmp --state INVALID -j DROP
 
    Updates which fix the problem were released this week by:
      * [24]Mandrake (May 9, 2002)
      * [25]Red Hat (May 9, 2002) (Red Hat's firewall configuration tools
        use "ipchains"; such configurations are not vulnerable)
 
    Red Hat advisory for sharutils. Updated packages for [26]sharutils are
    available which fix potential privilege escalation using the uudecode
    utility.
 
    Red Hat Security Advisory. Updated [27]perl-Digest-MD5 packages are
    available which work around a bug in the utf8 interaction between
    perl-Digest-MD5 and Perl.
 
    Gaim arbitary email reading vulnerability. [28]Gaim 0.57 has a [29]bug
    which allows a local attacker to gain full access to other gaim users
    hotmail accounts. A [30]fix is available. The problem has been fixed
    in the nightly CVS, and will be fixed in version 0.58. "Gaim is an
    all-in-one IM client that resembles AIM. Gaim lets you use AIM, ICQ,
    Yahoo, MSN, IRC, Jabber, Napster, Zephyr, and Gadu-Gadu, all at once.
    Gaim is NOT endorsed by or affiliated with AOL, Yahoo, MSN or
    Napster."
 
    Quake II 3.2x server cvar leak. A [31]problem in the Quake II server
    for Linux allows an attacker to reveal the servers rcon password.
    Details of the affected source code and patched binaries are
    [32]available.
 
    web scripts.
    The following web scripts were reported to contain vulnerabilities:
      * [33]NOCC 0.9.5, and possibly earlier versions, have a cross-site
        scripting [34]vulnerability. The NOCC team is working on a fix.
        "NOCC is a webmail client written in PHP. It provides webmail
        access to IMAP and POP3 accounts."
 
 Updates
 
    GNU fileutils race condition. A [35]race condition in rm may cause the
    root user to delete the whole filesystem. The problem exists in the
    version of rm in fileutils 4.1 stable and 4.1.6 development version. A
    [36]patch is available. (First LWN report: [37]May 2).
 
    This week's updates:
      * [38]Caldera (May 13, 2002) (revision to the April 26th advisory)
 
    Previous updates:
      * [39]Caldera (April 26, 2002)
 
    Multiple vulnerabilities in icecast. [40]Icecast is a streaming audio
    broadcasting system. Version 1.3.12 was [41]released on April 10th.
    "This release is a security update and all users are highly encouraged
    to upgrade immediately or apply the relevant patches to their own
    versions. Remember, never run icecast as a privileged user, especially
    not as root." (First LWN report: [42]May 2).
 
    This week's updates:
      * [43]Caldera (May 10, 2002)
 
    Previous updates:
      * [44]Gentoo (April 26, 2002)
      * [45]Red Hat (April 24, 2002) (Red Hat Powertools)
 
    Multiple vulnerabilities in tcpdump. Version 3.5.2 fixed a buffer
    overflow vulnerability in all prior versions. However, newer versions,
    including 3.6.2, are vulnerable to another buffer overflow in the AFS
    RPC functions that was reported by Nick Cleaton. (First LWN report:
    [46]May 9).
 
    Both problems appear to have been reported and fixed in FreeBSD some
    months ago. The [47]CIAC report on the vulnerability in versions prior
    to 3.5.2 is dated October 31, 2000. Nick Cleaton's [48]FreeBSD
    security advisory on the AFS RPC bug, and reference to a fix for
    FreeBSD, is dated July, 17, 2001. [49]Tcpdump 3.7 was released on
    January 21, 2002.
 
    Correction: Our [50]earlier report omitted the Debian update which is
    now listed below. Debian apears to have picked up the work done by the
    FreeBSD group well before other Linux distributions. (Thanks to Matt
    Zimmerman).
 
    Previous updates:
      * [51]Debian (November 20, 2000) (fixed in tcpdump 3.4)
      * [52]Red Hat (February 12, 2002) (tcpdump 3.5.2)
      * [53]Conectiva (May 7, 2002) (tcpdump 3.6.2)
 
 Resources
 
    Linux security week. The [54]Linux Security Week and [55]Linux
    Advisory Watch publications from LinuxSecurity.com are available.
 
    [56]Fenris 0.02 has been [57]released by Michal Zalewski. "Fenris is a
    multipurpose tracer, stateful analyzer and partial decompiler intended
    to simplify bug tracking, security audits, code, algorithm, protocol
    analysis and computer forensics." Michal has also written [58]these
    hints for those using Fenris for [59]The Reverse Challenge contest
    from the folks at [60]Honeynet. His "quick write-up is not intended to
    spoil the fun, so it is safe to have a look."
 
 Events
 
    Upcoming Security Events.
 
    The 2002 Edinburgh Financial Cryptography Engineering has issued a
    [61]call for papers. On June 28th and 29th 2002 Edinburgh, Scotland
    "is again host to the international engineering conference on
    Financial Cryptography. Individuals and companies active in the field
    are invited to present and especially to demonstrate Running Code that
    pushes forward the "state of the art"."
 
    Date Event Location
    May 16 - 17, 2002 [62]14th Annual Canadian Information Technology
    Security Symposium(CITSS) (Ottawa Congress Centre)Ottawa, Ontario,
    Canada
    May 27 - 31, 2002 [63]3rd International SANE Conference(SANE 2002)
    Maastricht, The Netherlands
    May 29 - 30, 2002 [64]RSA Conference 2002 Japan (Akasaka Prince
    Hotel)Tokyo, Japan
    May 31 - June 1, 2002 [65]SummerCon 2002 (Renaissance Hotel)Washington
    D.C., USA
    June 17 - 19, 2002 [66]NetSec 2002 San Fransisco, California, USA
    June 24 - 28, 2002 [67]14th Annual Computer Security Incident Handling
    Conference (Hilton Waikoloa Village)Hawaii
    June 24 - 26, 2002 [68]15th IEEE Computer Security Foundations
    Workshop (Keltic Lodge, Cape Breton)Nova Scotia, Canada
    June 28 - 29, 2002 [69]Edinburgh Financial Cryptography Engineering
    2002 Edinburgh, Scotland
 
    For additional security-related events, included training courses
    (which we don't list above) and events further in the future, check
    out Security Focus' [70]calendar, one of the primary resources we use
    for building the above list. To submit an event directly to us, please
    send a plain-text message to [71]lwn@lwn.net.
 
    Section Editor: [72]Dennis Tenney
    May 16, 2002
 
                                Sponsored Link
 
    [73]Cheap and Effective
 
    LWN's text ads are a cheap and effective marketing tool for your
    organization. You can now purchase text ads automatically through our
    own credit card gateway. (No more PayPal).
 
    LWN Resources
    [74]Security alerts archive
    Secured Distributions:
    [75]Astaro Security
    [76]Castle
    [77]Engarde Secure Linux
    [78]Immunix
    [79]Kaladix Linux
    [80]NSA Security Enhanced
    [81]Openwall GNU/Linux
    [82]Trustix
    Security Projects
    [83]Bastille
    [84]Linux Security Audit Project
    [85]Linux Security Module
    [86]OpenSSH
    Security List Archives
    [87]Bugtraq Archive
    [88]Firewall Wizards Archive
    [89]ISN Archive
    Distribution-specific links
    [90]Caldera Advisories
    [91]Conectiva Updates
    [92]Debian Alerts
    [93]Kondara Advisories
    [94]Esware Alerts
    [95]LinuxPPC Security Updates
    [96]Mandrake Updates
    [97]Red Hat Errata
    [98]SuSE Announcements
    [99]Turbolinux
    [100]Yellow Dog Errata
    BSD-specific links
    [101]BSDi
    [102]FreeBSD
    [103]NetBSD
    [104]OpenBSD
    Security mailing lists
    [105]Caldera
    [106]Cobalt
    [107]Conectiva
    [108]Debian
    [109]Esware
    [110]FreeBSD
    [111]Kondara
    [112]LASER5
    [113]Linux From Scratch
    [114]Linux-Mandrake
    [115]NetBSD
    [116]OpenBSD
    [117]Red Hat
    [118]Slackware
    [119]Stampede
    [120]SuSE
    [121]Trustix
    [122]turboLinux
    [123]Yellow Dog
    Security Software Archives
    [124]munitions
    [125]ZedZ.net (formerly replay.com)
    Miscellaneous Resources
    [126]CERT
    [127]CIAC
    [128]Comp Sec News Daily
    [129]Crypto-GRAM
    [130]LinuxLock.org
    [131]LinuxSecurity.com
    [132]Security Focus
    [133]SecurityPortal
                                                         [134]Next: Kernel
 
    [135]Eklektix, Inc. Linux powered! Copyright Л 2002 [136]Eklektix,
    Inc., all rights reserved
    Linux (R) is a registered trademark of Linus Torvalds
 
 References
 
    1. http://lwn.net/
    2. http://lwn.net/2002/0516/
    3. http://lwn.net/2002/0516/kernel.php3
    4. http://lwn.net/2002/0516/dists.php3
    5. http://lwn.net/2002/0516/devel.php3
    6. http://lwn.net/2002/0516/commerce.php3
    7. http://lwn.net/2002/0516/press.php3
    8. http://lwn.net/2002/0516/announce.php3
    9. http://lwn.net/2002/0516/letters.php3
   10. http://lwn.net/2002/0516/bigpage.php3
   11. http://lwn.net/2002/0509/security.php3
   12. http://www.linuxjournal.com//article.php?sid=6069
   13.
 http://www.arnnet.com.au/IDG2.NSF/AllARN/0B8DDEBF4DC68B4BCA256BAA0005BEC9?OpenDo
 cument
   14. http://www.nessus.org/
   15. http://cansecwest.com/
   16. http://lwn.net/2002/0516/a/nessuscallhome.php3
   17. http://news.com.com/2010-1078-913834.html
   18. http://www.hpl.hp.com/techreports/2001/HPL-2001-324.html
   19. http://www.isc.org/
   20. http://www.cert.org/advisories/CA-2002-12.html
   21. http://lwn.net/alerts/Conectiva/CLA-2002:483.php3
   22. http://www.cert.org/advisories/CA-2002-12.html
   23. http://online.securityfocus.com/archive/1/271530/2002-05-06/2002-05-12/0
   24. http://lwn.net/alerts/Mandrake/MDKSA-2002:030.php3
   25. http://lwn.net/alerts/RedHat/RHSA-2002:086-05.php3
   26. http://lwn.net/alerts/RedHat/RHSA-2002:065-13.php3
   27. http://lwn.net/alerts/RedHat/RHSA-2002:081-06.php3
   28. http://gaim.sourceforge.net/
   29. http://lwn.net/2002/0516/a/gaim.php3
   30. http://gaim.sourceforge.net/downloads.php
   31. http://lwn.net/2002/0516/a/quakeii.php3
   32. http://www.aq2tng.barrysworld.net/
   33. http://nocc.sourceforge.net/
   34. http://lwn.net/2002/0516/a/nocc.php3
   35. http://mail.gnu.org/pipermail/bug-fileutils/2002-March/002433.html
   36. http://mail.gnu.org/pipermail/bug-fileutils/2002-March/002440.html
   37. http://lwn.net/2002/0502/security.php3#fileutils
   38. http://lwn.net/alerts/Caldera/CSSA-2002-018.1.php3
   39. http://lwn.net/alerts/Caldera/CSSA-2002-018.0.php3
   40. http://www.icecast.org/
   41. http://www.icecast.org/download.html
   42. http://lwn.net/2002/0502/security.php3#icecast
   43. http://lwn.net/alerts/Caldera/CSSA-2002-020.0.php3
   44. http://lwn.net/alerts/Gentoo/icecast-20020426.php3
   45. http://lwn.net/alerts/RedHat/RHSA-2002:063-05.php3
   46. http://lwn.net/2002/0509/security.php3#tcpdump
   47. http://www.ciac.org/ciac/bulletins/l-015.shtml
   48.
 ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:48.tcpdump.asc
   49. http://www.tcpdump.org/
   50. http://lwn.net/2002/0509/security.php3#tcpdump
   51. http://www.debian.org/security/2000/20001120a
   52. http://lwn.net/alerts/RedHat/RHSA-2001:089-08.php3
   53. http://lwn.net/alerts/Conectiva/CLA-2002:480.php3
   54. http://lwn.net/2002/0516/a/security-week.php3
   55. http://lwn.net/2002/0516/a/advisory-watch.php3
   56. http://razor.bindview.com/tools/fenris/
   57. http://lwn.net/2002/0516/a/fenris002.php3
   58. http://lcamtuf.coredump.cx/fenris/reverse.txt
   59. http://project.honeynet.org/reverse
   60. http://project.honeynet.org/
   61. http://lwn.net/2002/0516/a/edinburghcrypto.php3
   62. http://www.cse-cst.gc.ca/en/symposium/symposium.html
   63. http://www.nluug.nl/sane/
   64. http://www.rsaconference.net/
   65. http://www.summercon.org/
   66. http://www.gocsi.com/#netsec
   67. http://www.first.org/conference/2002
   68. http://www.csl.sri.com/programs/security/csfw/csfw15/csfw15.html
   69. http://www.efce.net/
   70. http://securityfocus.com/calendar
   71. mailto:lwn@lwn.net
   72. mailto:lwn@lwn.net
   73.
 http://oasis.lwn.net/oasisc.php?s=4&c=5&cb=957238404&url=http%3A%2F%2Flwn.net%2F
 corp%2Fadvertise%2Ftext%2F
   74. http://lwn.net/alerts/
   75. http://www.astaro.com/products/index.html
   76. http://castle.altlinux.ru/
   77. http://www.engardelinux.org/
   78. http://www.immunix.org/
   79. http://www.kaladix.org/
   80. http://www.nsa.gov/selinux/
   81. http://www.openwall.com/Owl/
   82. http://www.trustix.com/
   83. http://www.bastille-linux.org/
   84. http://lsap.org/
   85. http://lsm.immunix.org/
   86. http://www.openssh.com/
   87. http://www.securityfocus.com/archive/1
   88. http://www.nfr.net/firewall-wizards/
   89. http://www.jammed.com/Lists/ISN/
   90. http://www.calderasystems.com/support/security/
   91. http://www.conectiva.com.br/atualizacoes/
   92. http://www.debian.org/security/
   93. http://www.kondara.org/errata/k12-security.html
   94. http://www.esware.com/actualizaciones.html
   95. http://linuxppc.org/security/advisories/
   96. http://www.linux-mandrake.com/en/fupdates.php3
   97. http://www.redhat.com/support/errata/index.html
   98. http://www.suse.de/security/index.html
   99. http://www.turbolinux.com/security/
  100. http://www.yellowdoglinux.com/resources/
  101. http://www.BSDI.COM/services/support/patches/
  102. http://www.freebsd.org/security/security.html
  103. http://www.NetBSD.ORG/Security/
  104. http://www.openbsd.org/security.html
  105. http://www.calderasystems.com/support/forums/announce.html
  106. http://www.cobalt.com/support/resources/usergroups.html
  107. http://distro.conectiva.com.br/atualizacoes/
  108. http://www.debian.org/MailingLists/subscribe
  109. http://www.esware.com/lista_correo.html
  110. http://www.freebsd.org/handbook/eresources.html#ERESOURCES-MAIL
  111. http://www.kondara.org/mailinglist.html.en
  112. http://l5web.laser5.co.jp/ml/ml.html
  113. http://www.linuxfromscratch.org/services/mailinglistinfo.php
  114. http://www.linux-mandrake.com/en/flists.php3
  115. http://www.netbsd.org/MailingLists/
  116. http://www.openbsd.org/mail.html
  117. http://www.redhat.com/mailing-lists/
  118. http://www.slackware.com/lists/
  119. http://www.stampede.org/mailinglists.php3
  120. http://www.suse.com/en/support/mailinglists/index.html
  121. http://www.trustix.net/support/
  122. http://www.turbolinux.com/mailman/listinfo/tl-security-announce
  123. http://lists.yellowdoglinux.com/ydl_updates.shtml
  124. http://munitions.vipul.net/
  125. http://www.zedz.net/
  126. http://www.cert.org/nav/alerts.html
  127. http://ciac.llnl.gov/ciac/
  128. http://www.MountainWave.com/
  129. http://www.counterpane.com/crypto-gram.html
  130. http://linuxlock.org/
  131. http://linuxsecurity.com/
  132. http://www.securityfocus.com/
  133. http://www.securityportal.com/
  134. http://lwn.net/2002/0516/kernel.php3
  135. http://www.eklektix.com/
  136. http://www.eklektix.com/
 
 --- ifmail v.2.14.os7-aks1
  * Origin: Unknown (2:4615/71.10@fidonet)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор