![[LWN Logo]](http://old.lwn.net/images/lcorner.png)
![[LWN.net]](http://old.lwn.net/images/security.png)
|
|
|
 Sections: Main page Security Kernel Distributions Development Commerce Linux in the news Announcements Back page All in one big page See also: last week's Security page. |
SecurityNews and EditorialsWhy Cover BSD?. One question that has been asked of us a few times is why we cover BSD security reports in LWN, including FreeBSD, NetBSD and OpenBSD. After all, LWN is dedicated to the Linux community, right? Well, in many ways, our community is the Free Software and Open Source community, to which the BSD operating systems definitely belong. So reporting on BSD is not totally outside our mandate. On the other hand, it could be quickly pointed out that other Free Software operating systems exist that we don't cover. So why BSD? Well, aside from the kernel of the operating system, there is a tremendous overlap in applications between BSD and Linux. The shared Unix legacy guarantees that will continue. That means that a reported problem under OpenBSD or FreeBSD may very well impact one or more Linux distributions, if not all of them. So reporting BSD problems can give a heads-up of potential Linux problems. Of course, there are Free Software applications that overlap with other operating systems, both Free and commercial. Yet we don't cover those. So why BSD? We've made no secret of our respect for the security work done by the OpenBSD team and their aggressive, pro-active stance on fixing bugs. We've encouraged Linux developers to review and learn from that work. We like the work that FreeBSD has done to improve its own security, including producing good quality advisories, with well-organized information. Yet that alone would not necessarily justify covering all BSD alerts. In the end, it is the sum of those qualities above that has inspired our choice to include BSD. It is part of our goal to encourage cooperation and collaboration between Free operating systems based on the Unix model. BSD reports are sometimes the first report of a problem that we see, which may well impact Linux systems. Once we've covered some BSD reports, it seems best to provide consistent coverage, to allow people in the BSD community to benefit from the synthesis as well and to encourage free sharing of information between Linux and BSD security experts. Most importantly, we don't want Linux to fall behind (or stay behind, depending on your perspective) the BSD operating systems when it comes to security. A healthy competition will hopefully inspire and produce better security for both Linux and BSD. So for now, we'll continue to intermix BSD reports with the Linux reports. Whether you agree or disagree, you're always welcome to drop us a note to let us know what you think. Forget your password -- fingerprint scans more and more common (Techserver.com). Biometric scanners are the subject of this Techserver.com article, which speaks of their growing use. "I think people are a little bit suspicious that there will be some national database that will be put together and people will be tracked. I think that's a false fear," said James L. Wayman, an engineering professor at San Jose State University and former director of the U.S. National Biometric Test Center.
November CRYPTO-GRAM newsletter. Bruce Schneier's Crypto-Gram for November is out. It covers digital signatures, the cracking of Microsoft, and various other security-related topics. Wietse Venema receives NLUUG award. The board of the Netherlands Unix User Group NLUUG has chosen Wietse Venema as the recipient of their NLUUG 2000 award. "Wietse Venema receives this award as a token of appreciation for his many contributions to the community of Unix and open systems. Wietse's best known work has been targeted at improving the security of Unix systems in an internet environment. Amongst other things, he is the co-author of the security analysis tool "Satan". He is also the main author of "Postfix", a replacement for the notorious (security-wise) "Sendmail" program. His most recent work encompasses a toolkit for analyzing system status after an intrusion." New Zealand Anti-Hacking Bill Faces Select Committee (Newsbytes). Those of you interested in security-related legislation outside of the U.S. or Europe may want to check out this Newsbytes article on proposed legislation in New Zealand. "A planned amendment to New Zealand's crime bill that would outlaw malicious hacking for the first time - while also controversially allowing security services the freedom to hack into citizens' computers and intercept e-mail and faxes - has passed through to the Government's Law and Order Select Committee". Security Reportscups. Two problems were reported with CUPS, the Common Unix Printing System. The first problem allowed printers served by CUPS to be accessible from anywhere on the Internet. A second bug caused CUPS to broadcast to everywhere, keeping open dial-on-demand lines. The Linux-Mandrake advisory below was our first sighting of the problem, but does not indicate whether or not this was discovered internally or reported externally.This week's updates: Vixie cron problems. Systems using vixie cron where the /var/spool/cron directory is given permissions 755 are vulnerable to a symlink attack that can be exploited to allow the execution of arbitrary commands. Check Michal Zalewski's original post or BugTraq ID 1960 for more details.Debian systems and systems where vixie cron has been installed manually appear to be the most likely to be vulnerable. A workaround is to reset the permissions on /var/spool/cron to 700. This week's updates:
joe symlink vulnerability. A symlink vulnerability in the joe editor was reported this week (and a slight correction to the original report as well).This week's updates: ethereal buffer overflow. A buffer overflow in the ethereal network protocol analyzer was reported this week. The buffer overflow is very similar to the recently reported buffer overflow in tcpdump. ethereal 0.8.14 was released this week with a fix for the problem.This week's updates: gnomehack buffer overflow. An exploit for gnomehack was published this week. It uses a buffer overflow in gnomehack to gain egid games (presuming gnomehack is setgid games). It was commented that this same vulnerability likely exists in nethack as well. Check the SecurityPortal Linux Security List for the published exploit.FreeBSD deny_incoming problem. FreeBSD reported a problem with ppp under FreeBSD only, where the behavior of the ppp code is inconsistent with its documentation. In particular, the use of deny_incoming is likely to produce unexpected, and potentially unfortunate, results. A patch to correct the problem is provided, though it is also recommended that a true packet filter be used instead.cgi-bin scripts. The following cgi-bin scripts were reported to contain vulnerabilities:
Commercial products. The following commercial products were reported to contain vulnerabilities:
UpdatesLocal root exploit problem in modutils. Check last week's Security Summary and Kernel Page for the original report and details.Modutils 2.3.20 was released this week. This version fixes the various local root compromise vulnerabilities found in all recent versions of modutils; an upgrade is recommended - even if you just upgraded to 2.3.19, which only fixed some of the problems. Expect the distributors to come out with packaged versions shortly. This week's updates:
Hostile server vulnerability in OpenSSH. Check the November 16th LWN Security Summary for details. Upgrading to 2.3.0 is recommended.This week's updates: Previous updates:
BIND 8.2.2-P5 denial-of-service. A denial-of-service vulnerability was reported in BIND 8.2.2-P5. Check the November 9th LWN Security Summary for the initial report. BIND 8.2.2-P7 was released last week with a fix for the problem.This week's updates: Previous updates:
Netscape 4.75 buffer overflow. First spotted via this FreeBSD advisory and reported on November 9th, a buffer overflow in Netscape 4.75 enables a client-side exploit. Check the November 9th LWN Security Summary for our original report. Netscape 4.76, which was released on October 24th, fixes the problem.This week's updates: Previous updates:
vlock vulnerability. Originally reported in the November 9th LWN Security Summary, vlock, a virtual console locking problem, was reportedly unlockable by an unprivileged user. Wichert Akkerman dropped us a note this week to confirm the problem, but only when pam_pwdb was used. Debian, for example, uses pam_unix and is therefore not vulnerable.This week's updates:
quake server denial-of-service. Check the November 9th LWN Security Summary for the original report (or BugTraq ID 1900). This week, ProQuake 1.02 was released with a fix for this problem.Multiple buffer overflows in tcpdump. Multiple buffer overflows in tcpdump were reported in our November 2nd edition.This week's updates: Previous updates:tcsh symlink vulnerability. A /tmp symbolic link vulnerability was reported in tcsh on October 29th. Check BugTraq ID 1926 for more details.This week's updates: Previous updates:
curl buffer overflow. A buffer overflow in curl, a command-line tool for getting data from a URL, was reported in October.This week's updates: Previous updates:
Format string vulnerabilities in PHP. Check the October 19th LWN Security Summary for the original report. PHP 3.0.17 and 4.0.3 contain the fixes for these problems.This week's updates: Previous updates:
Pine/IMAP buffer overflow vulnerability. Check the October 5th LWN Security Summary for the initial report. Pine 4.30 contains a fix for the problem. Note, some of the updates below contain only pine updates, while others include both pine and imapd updates.This week's updates: Previous updates:
thttpd exposes world readable files. Check the October 5th LWN Security Summary for the original report. This week's updates: mgetty temporary link vulnerability. Check the August 31st Security Summary for details. An upgrade to mgetty 1.2.22 should fix the problem. This week's updates: Older updates:
man/makewhatis vulnerability. A /tmp file vulnerability was reported in makewhatis versions 1.5e and higher. Check the July 6th LWN Security Summary for the original report.This week's updates: Previous updates:
ResourcesCERT Summary. The November 20th CERT Summary has been published. rpc.statd and ftpd lead the list of problems which continue to be actively exploited, while the recent bind problems have been added to the list, even though no reports of their exploitation have been received yet. Weekly Security Tools Digest (SecurityPortal). For updated security tools, a good place to check would be SecurityPortal's Weekly Security Tools Digest. EventsUpcoming security events.
For additional security-related events, included training courses (which we don't list above) and events further in the future, check out Security Focus' calendar, one of the primary resources we use for building the above list. To submit an event directly to us, please send a plain-text message to lwn@lwn.net. Section Editor: Liz Coolbaugh |
November 23, 2000
LWN Resources | ||||||||||||||||||||||||
Copyright © 2000
Eklektix, Inc., all rights reserved
Next: Kernel