Linux in the news
All in one big page
See also: last week's Security page.
NewsThe folks from Bugtraq, the full-disclosure security mailing list which is widely recognized as one of the best resources for up-to-date security information currently available, are moving to their own website, SecurityFocus.com. Next Monday, July 5th, the Bugtraq list will actually move to the new site (subscriber information will not be impacted) and mail to bugtraq will need to be directed to firstname.lastname@example.org. The mailing list archives from Geek-Girl.com, which we have used as a resource for so long, will be moving to the new site, along with the Geek-Girl herself!
In fact, it seems that the staff at Security Focus are mostly built from long-time supporters of Bugtraq and members of that community. That promises much for the quality of the resources that they plan on providing. The SecurityFocus.com site is already up and running, with a newsfeed of security-related articles, recently published vulnerabilities, products and a library.
Aleph One's announcement also outlines additional planned resources. A mailing list just for incident reports (which are not currently allowed on Bugtraq) is being created, along with Bugtraq lists for non-English speakers, whose moderators will be responsible for translating postings as required to make sure that the same topics and information are accessible to all the mailing lists.
We wish them luck in their new venture. It is good news for the Linux community to see this community flourish and grow as well.
Meanwhile, here is a a SecurityPortal piece which says Linux needs to worry about viruses too. "As Linux is increasingly adopted in corporate environments, it must not act as 'Typhoid Mary' during a virus outbreak, obliviously storing and passing along a virus."
It also mentions one open source project that provides a solution for this problem. AMaViS - A Mail Virus Scanner is licensed under the GPL and sits on top of commercial virus scanners such as McAfee, Dr. Solomon, AntiVir/X and Sophos. It currently only supports sendmail.
Performance Computing looks at Linux security tools. "It's wise to view all open-source software downloaded from public domain sites with suspicion. It is important to ensure that the downloaded software is the intended product. After all, what good does it do to download tainted security software?"
Security ReportsA security problem with klock was found by 7-year old boy trying to get control of his father's session, according to his Dad's posting to Bugtraq. A patch was quickly put together by Martin Jones. Caldera has released an advisory and upgraded packages (kdebase-1.1.1-3, kdebase-opengl-1.1.1-5) in response.
VMWare for Linux 1.0.1 and earlier contains an exploitable buffer overrun which can result in unauthorized root access. VMWare 1.0.2 has been released with an update to fix this problem. For the updated version and more information on the problem, check out VMware's advisory.
Patches for Xi Graphics, Inc.'s Accelerated-X Server 4.x, 5.x have been released to address problems due to insufficient bounds checking on command-line parameters, which leave it vulnerable to buffer overruns. If you are using this server, installing the patches is highly recommended.
UpdatesMandrake has issued a set of security fixes for the 6.0 distribution; affected packages are printtool (upgraded to printtool-3.40-5), kdenetwork (upgraded to kdenetwork-1.1.1final-4), kdebase (upgraded to kdebase-1.1.1final-11), and net-tools (upgraded to net-tools-1.52-6). Note that the printtool update does not appear to be security related, so if you do not need the new printers that have been added to that package, you should not need to upgrade. The other three are security-related and upgrading is recommended.
Red Hat has also issued an advisory for nettools (upgrade to net-tools-1.52-2) under Red Hat 6.0. In addition, a "potential" problem has been turned up in the NFS server used with Red Hat 5.2. If you're running NFS under 5.2 (or earlier), take a look at the notice and apply the updates (nfs-server-2.2beta44 and nfs-server-clients2.2beta44). The 6.0 release uses a different NFS server, and should not be vulnerable.
Red Hat has also issued new RPMS for kde, which upgrade the packages to KDE 1.1.1-1. These new packages close a few security holes in addition to other bugfixes.
Section Editor: Liz Coolbaugh
July 1, 1999
Secure Linux Projects Bastille Linux
Khaos Linux Secure Linux
Security List Archives
Firewall Wizards Archive
Red Hat Errata
Linux Security Audit Project