+---------------------------------------------------------------------+
| LinuxSecurity.com Weekly Newsletter |
| January 5th 2007 Volume 8, Number 1a |
+---------------------------------------------------------------------+
Editors: Dave Wreski Benjamin D. Thomas
dave@xxxxxxxxxxxxxxxxx ben@xxxxxxxxxxxxxxxxx
Linux Advisory Watch is a comprehensive newsletter that outlines the
security vulnerabilities that have been announced throughout the
week. It includes pointers to updated packages and descriptions of
each vulnerability.
This week, advisories were released for xine-lib, DenyHosts, libmodplug,
kernel, OpenOffice, mono-web, Firefox, and w3m. The distributors
include Debian, Gentoo, Mandriva, SuSE, and Ubuntu.
---
Earn an NSA recognized IA Masters Online
The NSA has designated Norwich University a center of Academic
Excellence in Information Security. Our program offers unparalleled
Infosec management education and the case study affords you unmatched
consulting experience. Using interactive e-Learning technology, you
can earn this esteemed degree, without disrupting your career or home
life.
http://www.msia.norwich.edu/linsec/
---
* EnGarde Secure Linux v3.0.11 Now Available
Guardian Digital is happy to announce the release of EnGarde Secure
Community 3.0.11 (Version 3.0, Release 11). This release includes
several bug fixes and feature enhancements to the SELinux policy
and several updated packages.
http://wiki.engardelinux.org/index.php/ReleaseNotes3.0.11
---
RFID with Bio-Smart Card in Linux
In this paper, we describe the integration of fingerprint template
and RF smart card for clustered network, which is designed on Linux
platform and Open source technology to obtain biometrics security.
Combination of smart card and biometrics has achieved in two step
authentication where smart card authentication is based on a
Personal Identification Number (PIN) and the card holder is
authenticated using the biometrics template stored in the smart
card that is based on the fingerprint verification. The fingerprint
verification has to be executed on central host server for
security purposes. Protocol designed allows controlling entire
parameters of smart security controller like PIN options, Reader
delay, real-time clock, alarm option and cardholder access
conditions.
http://www.linuxsecurity.com/content/view/125052/171/
---
Packet Sniffing Overview
The best way to secure you against sniffing is to use encryption.
While this won't prevent a sniffer from functioning, it will ensure
that what a sniffer reads is pure junk.
http://www.linuxsecurity.com/content/view/123570/49/
--------
--> Take advantage of the LinuxSecurity.com Quick Reference Card!
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf
+---------------------------------+
| Distribution: Debian | ----------------------------//
+---------------------------------+
* Debian: New xine-lib packages fix arbitrary code execution
28th, December, 2006
It was discovered that the Xine multimedia library performs
insufficient sanitising of Real streams, which might lead to
the execution of arbitrary code through a buffer overflow.
http://www.linuxsecurity.com/content/view/126369
+---------------------------------+
| Distribution: Gentoo | ----------------------------//
+---------------------------------+
* Gentoo: DenyHosts Denial of Service
3rd, January, 2007
DenyHosts does not correctly parse log entries, potentially causing a
remote Denial of Service.
http://www.linuxsecurity.com/content/view/126411
+---------------------------------+
| Distribution: Mandriva | ----------------------------//
+---------------------------------+
* Mandriva: Update libmodplug packages fix buffer overflow
vulnerabilities
2nd, January, 2007
Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43
and earlier and libmodplug 0.8 and earlier allow user-assisted remote
attackers to execute arbitrary code via (1) long strings in ITP files
used by the CSoundFile::ReadITProject function in soundlib/Load_it.cpp
and (2) crafted modules used by the CSoundFile::ReadSample function
in soundlib/Sndfile.cpp, as demonstrated by crafted AMF files.
http://www.linuxsecurity.com/content/view/126395
* Mandriva: Updated kernel packages fix multiple vulnerabilities
2nd, January, 2007
Some vulnerabilities were discovered and corrected in the Linux 2.6
kernel.
http://www.linuxsecurity.com/content/view/126403
+---------------------------------+
| Distribution: SuSE | ----------------------------//
+---------------------------------+
* SuSE: Mozilla Firefox, Thunderbird
29th, December, 2006
This security update brings the current set of Mozilla security
updates, with following versions...
http://www.linuxsecurity.com/content/view/126374
* SuSE: OpenOffice_org WMF buffer overflows
4th, January, 2007
Security problems were fixed in the WMF and Enhanced WMF handling in
OpenOffice_org These could potentially be used to execute code or
crash OpenOffice when a user could be convinced to open specially
crafted document (for instance a document sent by E-mail). This issue
is tracked by the Mitre CVE ID CVE-2006-5870. openSUSE 10.2 is not
affected by this problem, it already contains the fixed
OpenOffice_org 2.1 version. Additionally the OpenOffice_org 2.0
version in SLED 10 was fitted with hooks to add OfficeXML support
with a later update. Due to the very large size of this update and
mirror lag it might take some hours or days until the updates are
available on our mirrors.
http://www.linuxsecurity.com/content/view/126420
* SuSE: mono-web ASP.net sourcecode
4th, January, 2007
A security problem was found and fixed in the Mono / C# web server
implementation. By appending spaces to URLs attackers could download
the source code of ASP.net scripts that would normally get executed
by the web server. This issue is tracked by the Mitre CVE ID
CVE-2006-6104 and only affects SUSE Linux 10.1, openSUSE 10.2 and
SUSE Linux Enterprise 10. Older products are not affected. The
updated packages for this problem were released on December 29th
2006.
http://www.linuxsecurity.com/content/view/126425
* Ubuntu: Firefox vulnerabilities
2nd, January, 2007
Various flaws have been reported that allow an attacker to execute
arbitrary code with user privileges by tricking the user into opening
a malicious web page containing JavaScript or SVG.
http://www.linuxsecurity.com/content/view/126405
+---------------------------------+
| Distribution: Debian | ----------------------------//
+---------------------------------+
* Ubuntu: w3m vulnerabilities
2nd, January, 2007
A format string vulnerability was discovered in w3m. If a user were
tricked into visiting an HTTPS URL protected by a specially crafted
SSL certificate, an attacker could execute arbitrary code with user
privileges.
http://www.linuxsecurity.com/content/view/126406
* Ubuntu: Firefox vulnerabilities
3rd, January, 2007
USN-398-1 fixed vulnerabilities in Firefox 2.0. This update provides
the corresponding updates for Firefox 1.5. Various flaws have been
reported that allow an attacker to execute
arbitrary code with user privileges by tricking the user into opening
a malicious web page containing JavaScript or SVG. (CVE-2006-6497,
CVE-2006-6498, CVE-2006-6499, CVE-2006-6501, CVE-2006-6502,
CVE-2006-6504) Various flaws have been reported that allow an
attacker to bypass Firefox's internal XSS protections by tricking the
user into opening a malicious web page containing JavaScript.
(CVE-2006-6503)
http://www.linuxsecurity.com/content/view/126412
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
