Security
Brief items
Here we go again
vnunet has posted another one of its Linux security articles with the same sort of theme:
X-Force, the US-based monitoring group of security software firm
Internet Security Systems, has been tracking the number of security
holes in software. Last year the centre found 149 bugs in
Microsoft software compared to 309 for Linux. This year the
situation was worse, with 485 Linux bugs this year compared to
Microsoft's 202.
Nobody would try to argue that Linux is free of security holes - anybody who thinks so need only read the rest of this page to learn otherwise. But the above comparison is absolutely meaningless for a number of reasons:
- Each distribution is counted independently. The same vulnerability in
five distributions will count as five separate vulnerabilities. This
practice, of course, inflates the number of reported Linux problems.
- Linux vulnerabilities include those in applications (i.e. PostgreSQL)
which are not part of a standard Windows system.
- Most Linux vulnerabilities are found through code audits and similar efforts; they are patched and reported before any exploits happen. Any Windows bugs found through similar audits are fixed silently and do not appear in these counts.
Articles like this one try to make it appear that Linux has worse security problems than other operating systems. If you look, however, at the amount of actual security pain suffered by Linux administrators, the story is different. Linux security is nowhere near as good as it really should be, but it's not as bad as some people would like to make it out to be.
Red Hat and Dell host open source security summit
Red Hat and Dell have announced that an "open source security summit" will be held on October 29 in Washington, DC. "The Security Summit will provide an open forum to discuss and explore how open source technologies, methodologies, tools, and support processes meet the challenges of securing networks and computer systems."
New vulnerabilities
Apache 2.0 cross-site scripting vulnerability
| Package(s): | apache | CVE #(s): | CAN-2002-0840 |
| Created: | October 2, 2002 | Updated: | October 2, 2002 |
| Description: | Versions of Apache 2.0 prior to 2.0.43 have a cross-site scripting vulnerability in the error page handling code. If you are running Apache 2.0, this one is worth fixing. | ||
| Alerts: | (No alerts in the database for this vulnerability) | ||
Multiple vulnerabilities in bugzilla
| Package(s): | bugzilla | CVE #(s): | |||||
| Created: | October 2, 2002 | Updated: | October 9, 2002 | ||||
| Description: | The Bugzilla bug tracking system (versions prior to 2.14.4 or 2.16.1) suffers from a number of vulnerablities, including one which could result in remote command and SQL injection. An upgrade to 2.16.1 is recommended, since the 2.14 branch will be unmaintained after the end of the year. See the Bugzilla advisory for details. | ||||||
| Alerts: |
| ||||||
Another set of fetchmail buffer overflows
| Package(s): | fetchmail fetchmail-ssl | CVE #(s): | |||||||||||||||||||||||||||||||||||||
| Created: | October 1, 2002 | Updated: | December 17, 2002 | ||||||||||||||||||||||||||||||||||||
| Description: | e-matters GmbH has issued an advisory warning of a new set of buffer overflows in the fetchmail header parsing code. The vulnerabilities have been fixed in fetchmail 6.1.0. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
Buffer overflow in gv
| Package(s): | gv | CVE #(s): | CAN-2002-0838 | ||||||||||||||||||||||||||||||||
| Created: | October 1, 2002 | Updated: | November 25, 2002 | ||||||||||||||||||||||||||||||||
| Description: | gv, a graphical front end to ghostscript, has a buffer overflow vulnerability which can be exploited by a properly crafted PostScript or PDF file. If a user can be tricked into viewing such a file, arbitrary code can be executed with that user's privileges. See this iDEFENSE advisory for the details. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
Buffer overflows in heimdal
| Package(s): | heimdal | CVE #(s): | |||||||||
| Created: | October 1, 2002 | Updated: | October 17, 2002 | ||||||||
| Description: | A SuSE security team audit of the heimdal Kerberos implementation turned up sever buffer overflow vulnerabilities. No exploits are known as of this writing, but these vulnerabilities are almost certainly possible for a remote attacker to exploit; if you are running heimdal, you should upgrade at the first opportunity. | ||||||||||
| Alerts: |
| ||||||||||
sendmail smrsh bypass vulnerability
| Package(s): | sendmail | CVE #(s): | CAN-2002-1165 | ||||||||||||||||
| Created: | October 2, 2002 | Updated: | November 29, 2002 | ||||||||||||||||
| Description: | iDEFENSE has posted an advisory warning of a couple of ways of bypassing the restrictions imposed by the sendmail "smrsh" utility. smrsh puts limits on which programs a user may run out of a .forward file; this vulnerability could give a local user undesired access to the mail server system. A patch has been made available from sendmail.org which closes the vulnerability. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip | CVE #(s): | CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399 | ||||||||||||||||||||||||||||||||||||
| Created: | October 1, 2002 | Updated: | April 10, 2006 | ||||||||||||||||||||||||||||||||||||
| Description: | The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
Resources
Linux Security Week - September 30th 2002
Linux Security Week for September 30 from LinuxSecurity.com is available.Slapper Worm brought to heel (Register)
The Register covers two recent varients of the Slapper worm, Slapper.B (Cinik) and Slapper.C (Unlock). "Two fresh variants of the Slapper worm, which spreads through Linux machines by exploiting a well-known flaw in OpenSSL libraries, have been sighted this week."
Page editor: Jonathan Corbet
Next page:
Kernel development>>