Security
Brief items
Spam blocking with greylisting
A certain amount of attention has recently been given to a spam-blocking method called greylisting. A look at the description of the technique shows that it does not, actually, have much in the new way of ideas. Greylisting might, however, become a useful part of the antispam arsenal at some sites.The core idea of the greylisting technique has been around for a while. It relies on the fact most spammers do not bother to track and retry deliveries which are declined by the receiving system with a temporary failure status. Real mail systems will retry the message later on, until they run out of patience. Spammers just forget about it and move on. So an effective way of blocking a large percentage of incoming spam is to simply refuse mail from new sources with a temporary failure on the first delivery attempt. Real mail will eventually show up again, and be delivered with a small delay. Most spam will never return.
The greylisting technique uses a slightly finer-grained approach. It creates a three-entry tuple out of the originating address, the sender, and the recipient of the message. If the tuple is new, the mail is refused for a configurable period of time. The use of the three-way tuple helps prevent spam from slipping in by using false sender addresses.
The obvious workaround, from a spammer's point of view, is to add retrying for temporary failures to their code. Given the desire of the spam industry to pollute our mailboxes regardless of how hard we try to prevent that, the implementation of temporary failure retrying is only a matter of time. Of course, mail sent through open relays is generally retried anyway, so widespread use of greylisting could result in more use of open relays, and, perhaps, more attempts to compromise systems to turn them into unwilling relays.
As the author describes it, greylisting is meant to be used in conjunction with other spam-blocking techniques, especially blackhole lists. The hope is that, by the time the temporary failure interval has ended for a particular spam source, that source will have found its way into the blacklists and the message can be blocked permanently. This combination could, indeed, prove hard for the spammers to get around.
New vulnerabilities
eldav: insecure temporary file
| Package(s): | eldav | CVE #(s): | CAN-2003-0438 | ||||
| Created: | June 19, 2003 | Updated: | June 24, 2003 | ||||
| Description: | eldav, a WebDAV client for Emacs, creates temporary files without taking appropriate security precautions. This vulnerability could be exploited by a local user to create or overwrite files with the privileges of the user running emacs and eldav. | ||||||
| Alerts: |
| ||||||
ethereal: security problems in Ethereal 0.9.12
| Package(s): | ethereal | CVE #(s): | CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432 | ||||||||||||||||||||||||
| Created: | June 23, 2003 | Updated: | November 10, 2003 | ||||||||||||||||||||||||
| Description: | Several security problems have been found in Ethereal
0.9.12. "It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file." | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
orville-write: buffer overflows
| Package(s): | orville-write | CVE #(s): | CAN-2003-0441 | ||||
| Created: | June 19, 2003 | Updated: | June 24, 2003 | ||||
| Description: | Orville Write, a replacement for the standard write(1) command, contains a number of buffer overflows. These could be exploited to gain either gid tty or root privileges, depending on the configuration selected when the package is installed. | ||||||
| Alerts: |
| ||||||
osh: buffer overflows
| Package(s): | osh | CVE #(s): | |||||
| Created: | June 20, 2003 | Updated: | June 24, 2003 | ||||
| Description: | Steve Kemp discovered that osh, a shell intended to restrict the actions of the user, contains two buffer overflows, in processing environment variables and file redirections. These vulnerabilities could be used to execute arbitrary code, overriding any restrictions placed on the shell. | ||||||
| Alerts: |
| ||||||
webfs: buffer overflow
| Package(s): | webfs | CVE #(s): | CAN-2003-0445 | ||||
| Created: | June 20, 2003 | Updated: | June 24, 2003 | ||||
| Description: | webfs, a lightweight HTTP server for static content, contains a buffer overflow whereby a long Request-URI in an HTTP request could cause arbitrary code to be executed. | ||||||
| Alerts: |
| ||||||
xbl: buffer overflows
| Package(s): | xbl | CVE #(s): | CAN-2003-0451 CAN-2003-0535 | ||||||||
| Created: | June 20, 2003 | Updated: | July 9, 2003 | ||||||||
| Description: | Steve Kemp discovered several buffer overflows in xbl, a game, which
can be triggered by long command line arguments. This vulnerability
could be exploited by a local attacker to gain gid 'games'. This has been assigned CVE #
CAN-2003-0451.
Another buffer overflow was discovered in xbl which could also be exploited by a local attacker to gain gid 'games'. This has been assigned CVE # CAN-2003-0535. | ||||||||||
| Alerts: |
| ||||||||||
xterm: command execution and denial of service
| Package(s): | XFree86 xterm | CVE #(s): | CAN-2001-1409 CAN-2002-1472 CAN-2002-0164 CAN-2003-0063 CAN-2003-0071 | ||||||||||||||||
| Created: | June 25, 2003 | Updated: | July 2, 2003 | ||||||||||||||||
| Description: | A couple of new vulnerabilities have been found in the xterm application shipped with XFree86. There is yet another "execute arbitrary commands by setting the window title" vulnerability, along with a bug which can allow an attacker to lock up an exterm window. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
ypserv: denial of service
| Package(s): | ypserv | CVE #(s): | CAN-2003-0251 | ||||||||||||||||
| Created: | June 25, 2003 | Updated: | July 11, 2003 | ||||||||||||||||
| Description: | From the Red Hat advisory: "A vulnerability has been discovered in the ypserv NIS server prior to version 2.7. If a malicious client queries ypserv via TCP and subsequently ignores the server's response, ypserv will block attempting to send the reply. This results in ypserv failing to respond to other client requests." The fix is up upgrade to version 2.8.0. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
Resources
Report: International Research on Privacy for Electronic Government
Joichi Ito has, with many helpers, compiled a report on privacy and privacy-enhancing technologies which is intended to help with the planning of electronic government initiatives in Japan. It's a large thing, being several hundred pages available in PDF format. It is well worth a look, though, as a comprehensive summary of the privacy situation in several parts of the world.Linux Advisory Watch
The June 20 issue of the Linux Advisory Watch newsletter from LinuxSecurity.com is available.
Events
Security Symposium, Aug 4-8, Washington DC
The 12th Usenix Security Symposium is scheduled for August 4 through 8 in Washington, DC. Participants include Steve Bellovin, Bill Cheswick, Niels Provos, Kevin Fu, Peter Gutmann, Dan Boneh, David Farber and Mark Seiden. Registration is open now for interested participants.Industrial Experience in Security at ACM CCS
The Tenth ACM Conference on Computer and Communications Security is happening in Washington, DC, on October 28 and 29. This year there will be a special session on "industrial experience in security." "This special session in an otherwise academic conference is an opportunity for security practitioners in industry to tell academics how it's really done: what works, and what doesn't. Submissions are only 3 pages long, and so should impose minimal burden on those submitting a paper." Papers are due June 27 (soon!).
Page editor: Jonathan Corbet
Next page:
Kernel development>>