![[LWN Logo]](http://old.lwn.net/images/lcorner.png)
![[LWN.net]](http://old.lwn.net/images/security.png)
|
|
|
 Sections: Main page Security Kernel Distributions Development Commerce Linux in the news Announcements Linux History Letters All in one big page See also: last week's Security page. |
SecurityNews and EditorialsQualys Detects and Provides Analysis of Newly-Discovered Linux Trojan. Qualys has put out a press release on how its tools can detect and remove the "new and potentially dangerous Remote Shell Trojan, referenced as RST.b, with backdoor and self-replicating functionality." If anybody out there has actually encountered this beast, we would be interested in hearing about it. MS' highest priority must be security - Billg (Register). The Register has Bill Gates's memo stating that Microsoft will now focus on security. Plus, of course, some commentary of their own. "Hello? Earth to Bill -- it took years of grinding public humiliation for MS to make a simple modification preventing malicious executables from launching automatically in Outlook. If this is Gates' idea of a security job well done, then all we have here is another PR smokescreen." Security ReportsMozilla Cookie Exploit. According to this Bugtraq post from Marc Slemko a bug in versions prior to Netscape 6.2.1 or Mozilla 0.9.7 allows "...an attacker to, if he can convince the user's browser to load a given URL, steal their cookies for any given domain. It does not require that active scripting is enabled in the browser, and can be done with something as simple as an image tag." Since many sites use cookies for authentication, an attacker may be able to impersonate a user by using cookies stolen in this manner.Red Hat security update to uucp. Red Hat has updated its uucp package to fix a vulnerability in the uuxqt utility. It seems that uuxqt does not check its options very well, allowing an attacker to execute commands as the uucp user. If you have uucp installed on your system (even if you're not actually using it), you may want to apply this update. But, this subsequent Bugtraq posting states that the Red Hat update does not fix the whole problem. Security update to enscript. Enscript has a temporary file handling bug. Updates fixing the problem were released by Debian and Red Hat.Red Hat security update to OpenLDAP. Red Hat has issued a security update to OpenLDAP fixing an access control problem in that package.Conectiva security update to MySQL. Conectiva has issued a security update to MySQL. It seems that they set up MySQL to do some pretty thorough logging in a world-readable manner, which could expose sensitive information to unwanted parties. This problem is specific to Conectiva. Mandrake security update to jmcce. MandrakeSoft has issued a security update to jmcce (a Chinese text display tool) fixing a temporary file vulnerability in that program. web scripts. The following web scripts were reported to contain vulnerabilities:
UpdatesHeap corruption vulnerability in at. The at command has a potentially exploitable heap corruption bug. (First LWN report: January 17th).This week's updates:
Red Hat only offers exim in the Powertools package. It is not vulnerable in the default Powertools configuration. This week's updates: Previous updates:Format string vulnerability in groff. A format string problem exists in groff; apparently it could be remotely exploited when it is configured to be used with the lpd printing system. (First LWN report: August 16, 2001). The stable release of Debian is not vulnerable. New updates:
Previous updates:
This week's updates: Previous updates: Remotely exploitable vulnerability in pine. Pine has an unpleasant vulnerability in URL handling vulnerability which can lead to command execution by remote attackers. (First LWN report: January 17th).This vulnerability is remotely exploitable; updating is a good idea. Note: If an update isn't yet available for your distribution, setting enable-msg-view-urls to "off" in pine's setup will avoid the vulnerability. (Thanks to Greg Herlein). This week's updates: Previous updates:
This week's updates: Previous updates: Nasty security hole in sudo. The sudo package, used to provide limited administrator access to systems, has an unpleasant vulnerability which makes it relatively easy for a local attacker to obtain root access. If you have sudo on a system with untrusted users, you probably want to disable it until you can get a fix installed. (First LWN report: January 17th).This week's updates: Previous updates:
This week's updates: Previous updates:
ResourcesSecurity-Enhanced Linux update. The SELinux web site was updated with new stable (2.4) and development (2.5) SELinux prototypes. "The stable (2.4) LSM-based SELinux prototype was updated to kernel 2.4.17 and was updated to include a number of bug fixes and minor enhancements made since the previous release. A new development (2.5) LSM-based SELinux prototype based on kernel 2.5.2 was also added to the site."William Stearns and Michal Zalewski released p0f version 1.8. "p0f is the passive OS fingerprinting utility that can identify a remote machine from just the syn packet of an incoming connection." EventsUpcoming Security Events. Register for CodeCon 2002 by February 1st and get a ten dollar discount. "CodeCon is the premier event in 2002 for the P2P, cypherpunk, and network/security application developer community." CodeCon 2002 will be held at DNA lounge in San Francisco, February 15th to 17th.
For additional security-related events, included training courses (which we don't list above) and events further in the future, check out Security Focus' calendar, one of the primary resources we use for building the above list. To submit an event directly to us, please send a plain-text message to lwn@lwn.net. Section Editor: Dennis Tenney |
January 24, 2002
LWN Resources | ||||||||||||||||||
Copyright © 2002
Eklektix, Inc., all rights reserved
Next: Kernel