Brief items
[This article was contributed by tummy.com]
With the purchase of RAV by Microsoft, many Linux email providers
and ISPs, are looking for an affordable, reliable replacement for RAV
Antivirus.
Kevin Fenzi, Senior Member Technical Staff of tummy.com, ltd. and the
co-author of the Linux Security HOWTO, has reviewed some of the currently
available alternatives.
Kevin evaluated the alternatives on several different criteria, including
Pricing policy (unlimited use is better than a per-domain or per-user
price), broad support for Mail Transport Agents, and ease of installation and
configuration.
Criteria Used:
- Pricing policy: Unlimited use got the highest score. Per-domain pricing
was next best, and per-user pricing was last. Those products that did
not have pricing information on their website received no score in this
category.
- Support for MTAs: A point was awarded for each of the popular Mail
Transport Agents supported (Qmail, Postfix, Exim, SuSE,
Sendmail+Milters, Sendmail, Dmail).
- Ease of Installation: Is the product easy to download and install?
- Ease of Configuration: Is the product easy to configure with your
local MTA?
- Scores are on a 'bad, fair, good, excellent' scale.
Read the full article here.
Comments (10 posted)
New vulnerabilities
gtksee: buffer overflow
| Package(s): | gtksee |
CVE #(s): | CAN-2003-0444
|
| Created: | June 30, 2003 |
Updated: | July 11, 2003 |
| Description: |
Viliam Holub discovered a bug in gtksee whereby, when loading PNG
images of certain color depths, gtksee would overflow a heap-allocated
buffer. This vulnerability could be exploited by an attacker using a
carefully constructed PNG image to execute arbitrary code when the
victim loads the file in gtksee. |
| Alerts: |
|
Comments (none posted)
imagemagick: insecure temporary file
| Package(s): | imagemagick |
CVE #(s): | CAN-2003-0455
|
| Created: | June 30, 2003 |
Updated: | July 10, 2003 |
| Description: |
There are circumstances in which imagemagick's libmagick library creates
temporary files without taking appropriate security precautions. This
vulnerability could be exploited by a local user to create or overwrite
files with the privileges of another user who is invoking a program using
this library. |
| Alerts: |
|
Comments (none posted)
PHP: Cross site scripting vulnerability
| Package(s): | PHP |
CVE #(s): | CAN-2003-0442
|
| Created: | July 2, 2003 |
Updated: | August 13, 2003 |
| Description: |
In PHP version 4.3.1 and earlier, when transparent session ID support is
enabled using the "session.use_trans_sid" option, the session ID is not
escaped before use. This allows a Cross Site Scripting attack. |
| Alerts: |
|
Comments (none posted)
phpbb: sql injection
| Package(s): | phpbb |
CVE #(s): | CAN-2003-0486
|
| Created: | June 28, 2003 |
Updated: | July 2, 2003 |
| Description: |
An SQL injection vulnerability in viewtopic.php for phpBB 2.0.5 and earlier
allows remote attackers to steal password hashes via the topic_id parameter. |
| Alerts: |
|
Comments (none posted)
proftpd: SQL injection
| Package(s): | proftpd |
CVE #(s): | |
| Created: | June 30, 2003 |
Updated: | June 30, 2003 |
| Description: |
runlevel [runlevel@raregazz.org] reported that ProFTPD's PostgreSQL
authentication module is vulnerable to a SQL injection attack. This
vulnerability could be exploited by a remote, unauthenticated attacker
to execute arbitrary SQL statements, potentially exposing the
passwords of other users, or to connect to ProFTPD as an arbitrary
user without supplying the correct password. |
| Alerts: |
|
Comments (none posted)
tcptraceroute: problems dropping root privileges
| Package(s): | tcptraceroute |
CVE #(s): | CAN-2003-0489
|
| Created: | June 28, 2003 |
Updated: | July 10, 2003 |
| Description: |
tcptraceroute 1.4 and earlier does not fully drop privileges after
obtaining a file descriptor for capturing packets. This may allow local
users to gain access to the descriptor via a separate vulnerability in
tcptraceroute. |
| Alerts: |
|
Comments (none posted)
unzip: directory traversal vulnerability
| Package(s): | unzip |
CVE #(s): | CAN-2003-0282
|
| Created: | July 1, 2003 |
Updated: | November 13, 2003 |
| Description: |
A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to
overwrite arbitrary files during archive extraction by placing invalid
(non-printable) characters between two "." characters. These non-printable
characters are filtered, resulting in a ".." sequence. See the full
advisory for further information. |
| Alerts: |
|
Comments (none posted)
xgalaga: buffer overflows
| Package(s): | xgalaga |
CVE #(s): | CAN-2003-0454
|
| Created: | June 30, 2003 |
Updated: | July 2, 2003 |
| Description: |
Steve Kemp discovered several buffer overflows in the game xgalaga, which
can be triggered by a long HOME environment variable. This vulnerability
could be exploited by a local attacker to gain gid 'games'. |
| Alerts: |
|
Comments (none posted)
Resources
The June 27 issue of the Linux Advisory Watch newsletter from
LinuxSecurity.com is available.
Full Story (comments: none)
The June 30 issue of the Linux Security Week newsletter from
LinuxSecurity.com is available.
Full Story (comments: none)
Events
Page editor: Rebecca Sobol
Next page:
Kernel development>>
