Security [LWN.net]

Brief items

The value of privacy policies

Most serious web sites post a privacy policy describing what the site's owners will do with data collected from and about the site's users. For users who are concerned about the spread of their personal information, a strongly-written privacy policy can be a reassuring feature. A recent court ruling, however, suggests that web privacy policies may not be worth the paper they aren't printed on, at least some of the time.

Northwest Airlines was recently faced with a class-action lawsuit headed by some of its customers, who were upset that the airline had provided passenger name record (PNR) data to the U.S. government after the September 11 attacks. The plaintiffs made several allegations, including the violation of various laws and, crucially, breach of contract as a result of Northwest's failure to live up to its privacy policy.

The policy reads, in part:

When you reserve or purchase travel services through Northwest Airlines nwa.com Reservations, we provide only the relevant information required by the car rental agency, hotel, or other involved third party to ensure the successful fulfillment of your travel arrangements.

There is nothing here about giving PNR data (which includes hotel and car information, along with credit card numbers) to interested governmental agencies. One might well conclude that the privacy policy has been breached.

The court struck down the breach of contract claim, however. The reasoning was:

The privacy statement on Northwest's website did not constitute a unilateral contract. The language used vests discretion in Northwest to determine when the information is "relevant" and which "third parties" might need that information... Moreover, absent an allegation that Plaintiffs actually read the privacy policy, not merely the general allegation that Plaintiffs "relied on" the policy, Plaintiffs have failed to allege an essential element of a contract claim: that the alleged "offer" was accepted by Plaintiffs.

The implications are clear: weasel words in a privacy statement can be used against you. If you ever think you may want to take a site operator to court for the violation of a privacy statement, you will, at a minimum, have to be able to show that you read that statement before the violation occurred. It seems unlikely that many potential plaintiffs in privacy policy cases will be able to make that demonstration. Privacy policies, thus, may not be worth a whole lot - at least, not in countries which lack more general restrictions on the use of personal data.

(For the curious, the full ruling is available in PDF format).

Comments (3 posted)

Evans Data on Linux security

Evans Data has sent out a press release about a Linux security survey done by the company. "Ninety two percent of survey respondents indicated that their Linux systems have never been infected with a virus, according to Evans Data's new Summer 2004 Linux Development Survey." The PR lacks an answer for the most interesting question, however: what, exactly, happened to the other 8%?

Comments (28 posted)

New vulnerabilities

courier: cross-site scripting vulnerability

Package(s):

courier

CVE #(s):

CAN-2004-0591

Created:

July 23, 2004

Updated:

August 4, 2004

Description:

The sqwebmail application has a cross-site scripting vulnerability. An attacker can inject and execute a web mail script via an email message.

Alerts:

Gentoo	200408-02	2004-08-04
Debian	DSA-533-1	2004-07-22

Security

The value of privacy policies

Evans Data on Linux security

courier: cross-site scripting vulnerability

mailreader: directory traversal vulnerability

Pavuk: Digest authentication helper buffer overflow

samba: potential buffer overruns

sox: buffer overflow

subversion: access control bypass

Apache mod_proxy: denial of service

apache2: stack-based buffer overflow in ssl_util.c

apache mod_ssl format string vulnerability

aspell: bounds checking problem

Ethereal: Multiple security problems

Filename disclosure vulnerability in fam

flim: insecure file creation

gtkhtml: malformed messages cause crash

Horde-IMP: improper input validation

iproute: local denial of service

racoon: failure to verify signatures

racoon: denial of service vulnerability

kdelibs: cookie disclosure

kernel allows unauthorized changes to the group ID

kernel: netfilter denial of service

kernel-utils: setuid vulnerability

l2tpd buffer overflow

libxml2 - arbitrary code execution

logcheck: symlink vulnerability

mailman: password disclosure

mikmod: buffer overflow

mod_python: denial of service vulnerability

MoinMoin Group ACL Bypass

mozilla: multiple vulnerabilties

mpg321: format string vulnerability

MySQL: temporary file vulnerabilities

neon: buffer overflow

Nessus NASL scripting engine security issues

netkit-telnet-ssl format string vulnerability

netpbm: insecure temporary files

openssh: timing attack leads to information disclosure

OpenSSL: denial of service vulnerabilities

Opera: Multiple spoofing vulnerabilities

pavuk: buffer overflow

php: remotely exploitable memory errors

postgresql buffer overflow in ODBC driver

python: buffer overflow

squid: buffer overflow

SquirrelMail cross site scripting vulnerabilities

Subversion: Remote heap overflow

sysstat: temporary file vulnerability

File overwrite vulnerability in tar and unzip

tcpdump: ISAKMP payload handling denial-of-service vulnerabilities

Multiple vendor telnetd vulnerability

ut2003: Unreal Tournament 2003/2004 buffer overflow in 'secure' queries

webmin: denial of service

wv: buffer overflow

XChat 2.0.x SOCKS5 Vulnerability

XFree86, X.org: XDM ignores requestPort setting

xine-ui - insecure temporary file creation