See also: last week's Security page.

Security

Frank Cusack posted a note to comp.security.ssh pointing out bugs in the way that ssh (and ssh2) handle shadow passwords. His note includes a patch for ssh.

Buffer overflow problems in tcsh have been found, similar to those recently fixed in bash. Wichert Akkerman posted a patch, but it is not a final version. No word on fixes from vendors as of yet. tcsh is a less likely candidate for shell scripts so the problems caused by the overflows are less likely to be exploitable.

The security audit program reported some problems with jidentd, an identd daemon which is not used or shipped by default by any of the distributions, but is apparently popular among IRC fans. The problems are basic poor programming problems; bug fixes are included in the link.

For people who have been following the reports and discussion of potential problems or exploits for identd programs, you might want to take a look at two different programs called secure identd. The first is a brand-new perl identd and the second requires kerberosIV.

Cisco has released yet another statement on the problems with Cisco PIX firewalls. It details what they plan on fixing and what they don't. Specifically, PIX Firewall 4.2(2) was scheduled to be available by Monday, September 14th. The PIX firewall problems involve denial-of-service attacks against the firewall and do not permit actual network intrusion.

A buffer overflow problem with Xylogics/Bay/Nortel terminal servers has been reported to be fixed in Version X6.0.1 of the Remote Access Concentrator software. If you have one of these servers, contact your local technical services group for more information.

Wietse Venema reported that VMailer should be coming out soon, within a matter of days or weeks, once the source code had been reviewed by his employers "Intelletual Property" people.

Rootshell issued their Security Bulletin #23, which outlined some flaws found in the TCP/IP stack of the Osicom Technologies remote access router products for 56K-T1 users.

Bay Networks has responded to Bugtraq messages from July, 1998, which reported the PING and LAND Denial of Services attacks against Annex terminal servers. They have an "X Release" patch available to address these problems, which is available free of charge.

Next: Kernel