|
|
Subscribe / Log in / New account

Security

Brief items

Fighting spam in the courts

Reading legal filings has never been your editor's idea of a good time, and many of the filings which have gone his way over the last year have been less fun than usual. So it has been a bit of a relief to read complaints with titles like "Microsoft Corporation v. John Does 1-50 d/b/a Super Viagra Group." The big ISPs are figuring out that spam is costing them money; as a result, Microsoft, AOL, Earthlink, and Yahoo have filed a set of lawsuits aimed at those who, they say, have sent spam into their systems.

These suits have been trumpeted as the first application of the much-maligned U.S. "CAN-SPAM" act. The complaints (most of which can be found on FindLaw) do, indeed, cite this act, but they also bring many other counts and could easily have been filed before that act was passed. Microsoft's complaint, for example, alleges "trespass to chattels," "conversion," violation of the Washington electronic mail act, violation of the federal computer fraud and abuse act, Lanham act violations, and more. AOL's complaint brings in violations of the Virginia computer crimes act, dealing in falsified bulk email software (Virginia law, again), conspiracy to commit trespass of chattels, and more. The CAN-SPAM act, clearly, is only part of the picture.

The filings are good for publicity and as a way to look like something is being done, but it remains to be seen whether they will accomplish anything against spam. The fact that the complaints are filed against over 100 "John Does" makes one problem clear: these ISPs still do not have a clear idea of who they are fighting. They claim that, armed with subpoenas, they can follow the money trails starting with the manufacturers of the products being pitched and track down the spammers from there. Perhaps, but it would be a mistake to assume that the people involved will be easily found, or that it will be easy to prove that they, in particular, sent the messages in question.

That said, legal action is likely to be an important part of the fight against spam in the future. With luck, a squad of expensive corporate lawyers can help to push spammers further underground and make it harder to actually earn money by sending junk email. There are reasons to worry too, however; anti-spam laws are, to a great extent, being used to squelch a certain type of unpleasant speech. It is not that hard to imagine those laws being used to shut down other types of speech which powerful groups find distasteful, much like domain name laws and procedures have been used to pull the plug on consumer and satire sites. Making spammers uncomfortable is a good thing; let's just hope this effort stops there.

Comments (2 posted)

New vulnerabilities

gdk-pixbuf: buffer overflow

Package(s):gdk-pixbuf CVE #(s):CAN-2004-0111
Created:March 10, 2004 Updated:March 16, 2004
Description: Versions of gdk-pixbuf prior to 0.20 contain a vulnerability which can be exploited, via a malicious BMP file, to crash Evolution.
Alerts:
Debian DSA-464-1 gdk-pixbuf 2004-03-16
Whitebox WBSA-2004:103-01 gdk-pixbuf 2004-03-15
Red Hat RHSA-2004:103-01 gdk-pixbuf 2004-03-10
Red Hat RHSA-2004:102-01 gdk-pixbuf 2004-03-10
Mandrake MDKSA-2004:020 gdk-pixbuf 2004-03-10

Comments (none posted)

kdelibs: cookie disclosure

Package(s):kdelibs CVE #(s):CAN-2003-0592
Created:March 10, 2004 Updated:August 24, 2004
Description: kdelibs (and, thus, Konqueror) has a vulnerability where a hostile server can force the disclosure of cookies that should not be presented to it. KDE versions 3.1.3 and later contain a fix.
Alerts:
Gentoo 200408-23 kdelibs 2004-08-24
Red Hat RHSA-2004:074-01 kdelibs 2004-03-10
Red Hat RHSA-2004:075-01 kdelibs 2004-03-10
Mandrake MDKSA-2004:022 kdelibs 2004-03-10
Debian DSA-459-1 kdelibs 2004-03-10

Comments (none posted)

mozilla: multiple vulnerabilties

Package(s):mozilla CVE #(s):CAN-2003-0594 CAN-2003-0564
Created:March 10, 2004 Updated:August 19, 2004
Description: Mozilla 1.4 contains a few vulnerabilities, including disclosure of cookies to the wrong server, a scripting vulnerability which can allow an attacker to run arbitrary code, and an S/MIME vulnerability which can lead to remote denial of service or code execution attacks.
Alerts:
Whitebox WBSA-2004:421-01 mozilla 2004-08-19
Whitebox WBSA-2004:110-01 Mozilla 2004-03-29
Red Hat RHSA-2004:112-01 Mozilla 2004-03-17
Mandrake MDKSA-2004:021 mozilla 2004-03-10

Comments (none posted)

python: buffer overflow

Package(s):python CVE #(s):CAN-2004-0150
Created:March 10, 2004 Updated:October 11, 2004
Description: Python (versions 2.2 and 2.2.1 only) has a buffer overflow in the getaddrinfo() function which can be exploited by a malformed IPv6 address.
Alerts:
Debian DSA-458-3 python2.2 2004-10-10
Gentoo 200409-03 python 2004-09-02
Debian DSA-458-2 python2.2 2004-08-31
Mandrake MDKSA-2004:019 python 2004-03-09
Debian DSA-458-1 python 2004-03-09

Comments (none posted)

sysstat: temporary file vulnerability

Package(s):sysstat CVE #(s):CAN-2004-0107 CAN-2004-0108
Created:March 10, 2004 Updated:October 4, 2004
Description: The sysstat utility has a temporary file vulnerability which can be exploited by a local attacker to overwrite system files.
Alerts:
Fedora-Legacy FLSA:1372 sysstat 2004-10-03
Gentoo 200404-04 sysstat 2004-04-06
Debian DSA-460-2 sysstat 2004-04-03
Trustix TSLSA-2004-0011 sysstat 2004-03-16
Whitebox WBSA-2004:053-01 sysstat 2004-03-10
Red Hat RHSA-2004:053-01 sysstat 2004-03-10
Red Hat RHSA-2004:093-01 sysstat 2004-03-10
Debian DSA-460-1 sysstat 2004-03-10

Comments (none posted)

wu-ftpd: two vulnerabilities

Package(s):wu-ftpd CVE #(s):CAN-2004-0148 CAN-2004-0185
Created:March 9, 2004 Updated:March 10, 2004
Description: CAN-2004-0148 - Glenn Stewart discovered that users could bypass the directory access restrictions imposed by the restricted-gid option by changing the permissions on their home directory. On a subsequent login, when access to the user's home directory was denied, wu-ftpd would fall back to the root directory.

CAN-2004-0185 - A buffer overflow existed in wu-ftpd's code which deals with S/key authentication.

Alerts:
Red Hat RHSA-2004:096-01 ftpd 2004-03-08
Debian DSA-457-1 wu-ftpd 2004-03-08

Comments (none posted)

Events

Black Hat Briefings call for papers

The Black Hat Briefings will be held July 26 and 27 in Las Vegas. The call for papers has gone out, with a June 1 due date.

Full Story (comments: none)

Page editor: Jonathan Corbet
Next page: Kernel development>>


Copyright © 2004, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds