Security
Brief items
Where are the kernel updates?
On April 5, Florian Weimer sent a note to the linux-kernel mailing list describing a hashing vulnerability in the 2.4 kernel. His assessment:
This problem was also described on this page last week.
We are, in other words, going on two months since this vulnerability was publicly disclosed. A quick look at the LWN Vulnerability Database entry for this problem, however, shows that only two distributors (EnGarde and Red Hat) have updated their kernels to close this hole. So all of the other distributors, many of which have a very good history of quick response to security problems, are leaving their users exposed on this one.
This vulnerability may seem less urgent because it cannot be used to gain root access to a target machine. It can, however, be used to take a system off the net. It allows a remote attacker to obtain the results of a distributed denial of service attack without that attacker having to arrange the "distributed" part. It is a serious problem which will certainly be exploited, with unpleasant results. The distributors owe their users a fix.
New vulnerabilities
Apache 2 - denial of service
| Package(s): | apache | CVE #(s): | CAN-2003-0189 CAN-2003-0245 | ||||||||||||||||||||||||
| Created: | May 28, 2003 | Updated: | June 16, 2003 | ||||||||||||||||||||||||
| Description: | A new set of denial of service vulnerabilities has been found in Apache versions 2.0 through 2.0.45. The potential for a remote code exploit apparently exists as well. See the Apache 2.0.46 announcement for more information. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
CUPS: vulnerability in the CUPS IPP implementation
| Package(s): | cups | CVE #(s): | CAN-2003-0195 | ||||||||||||||||||||||||||||||||
| Created: | May 27, 2003 | Updated: | July 22, 2003 | ||||||||||||||||||||||||||||||||
| Description: | Phil D'Amore of Red Hat discovered a vulnerability in the CUPS IPP (Internet Printing Protocol) implementation. The IPP implementation is single-threaded, which means only one request can be serviced at a time. An attacker could make a partial request that does not time out and therefore creates a denial of service. In order to exploit this bug, an attacker must have the ability to make a TCP connection to the IPP port (by default 631). | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
Nessus NASL scripting engine security issues
| Package(s): | nessus | CVE #(s): | |||||
| Created: | May 27, 2003 | Updated: | August 12, 2004 | ||||
| Description: | Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information. | ||||||
| Alerts: |
| ||||||
Resources
Linux Advisory Watch
The May 23 Linux Advisory Watch newsletter from LinuxSecurity.com is available.
Page editor: Jonathan Corbet
Next page:
Kernel development>>