+----------------------------------------------------------------------+ | LinuxSecurity.com Weekly Newsletter | | December 19th, 2008 Volume 9, Number 51 | | | | Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> | | Benjamin D. Thomas <bthomas@xxxxxxxxxxxxxxxxx> | +----------------------------------------------------------------------+ Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines. This week, advisories were released for no-ip, uw-imap, JasPer, Ruby, Dovecot, POV-Ray, aview, Honeyd, firefox, drakx-net, enscript, wireshark, java, seamonkey, pidgin, and cups. The distributors include Debian, Gentoo, Mandriva, Red Hat, and Ubuntu. --- Earn your MS in Info Assurance online Norwich University's Master of Science in Information Assurance (MSIA) program, designated by the National Security Agency as providing academically excellent education in Information Assurance, provides you with the skills to manage and lead an organization-wide information security program and the tools to fluently communicate the intricacies of information security at an executive level. http://www.linuxsecurity.com/ads/adclick.php?bannerid=12 --- Review: Googling Security: How Much Does Google Know About You -------------------------------------------------------------- If I ask "How much do you know about Google?" You may not take even a second to respond. But if I may ask "How much does Google know about you"? You may instantly reply "Wait... what!? Do they!?" The book "Googling Security: How Much Does Google Know About You" by Greg Conti (Computer Science Professor at West Point) is the first book to reveal how Google's vast information stockpiles could be used against you or your business and what you can do to protect yourself. http://www.linuxsecurity.com/content/view/145939 --- A Secure Nagios Server ---------------------- Nagios is a monitoring software designed to let you know about problems on your hosts and networks quickly. You can configure it to be used on any network. Setting up a Nagios server on any Linux distribution is a very quick process however to make it a secure setup it takes some work. This article will not show you how to install Nagios since there are tons of them out there but it will show you in detail ways to improve your Nagios security. http://www.linuxsecurity.com/content/view/144088 --> Take advantage of the LinuxSecurity.com Quick Reference Card! <-- --> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <-- ------------------------------------------------------------------------ * EnGarde Secure Community 3.0.22 Now Available! (Dec 9) ------------------------------------------------------ Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy. http://www.linuxsecurity.com/content/view/145668 ------------------------------------------------------------------------ * Debian: New Linux 2.6.18 packages fix several vulnerabilities (Dec 15) ---------------------------------------------------------------------- Tavis Ormandy reported a local DoS and potential privilege escalation in the Virtual Dynamic Shared Objects (vDSO) implementation. http://www.linuxsecurity.com/content/view/145937 * Debian: New no-ip packages fix arbitrary code execution (Dec 14) ---------------------------------------------------------------- A buffer overflow has been discovered in the HTTP parser of the No-IP.com Dynamic DNS update client, which may result in the execution of arbitrary code. http://www.linuxsecurity.com/content/view/145925 * Debian: New uw-imap packages fix multiple vulnerabilities (Dec 12) ------------------------------------------------------------------ It was discovered that several buffer overflows can be triggered via a long folder extension argument to the tmail or dmail program. This could lead to arbitrary code execution (CVE-2008-5005). http://www.linuxsecurity.com/content/view/145812 ------------------------------------------------------------------------ * Gentoo: JasPer User-assisted execution of arbitrary code (Dec 16) ----------------------------------------------------------------- Multiple memory management errors in JasPer might lead to execution of arbitrary code via jpeg2k files. http://www.linuxsecurity.com/content/view/145947 * Gentoo: Ruby Multiple vulnerabilities (Dec 16) ---------------------------------------------- Multiple vulnerabilities have been discovered in Ruby that allow for attacks including arbitrary code execution and Denial of Service. http://www.linuxsecurity.com/content/view/145946 * Gentoo: Dovecot Multiple vulnerabilities (Dec 15) ------------------------------------------------- Multiple vulnerabilities were found in the Dovecot mailserver. http://www.linuxsecurity.com/content/view/145928 * Gentoo: POV-Ray User-assisted execution of arbitrary (Dec 14) ------------------------------------------------------------- POV-Ray includes a version of libpng that might allow for the execution of arbitrary code when reading a specially crafted PNG file http://www.linuxsecurity.com/content/view/145926 * Gentoo: aview Insecure temporary file usage (Dec 13) ---------------------------------------------------- An insecure temporary file usage has been reported in aview, leading to symlink attacks. http://www.linuxsecurity.com/content/view/145924 * Gentoo: OpenOffice.org Multiple vulnerabilities (Dec 12) -------------------------------------------------------- Multiple vulnerabilities in OpenOffice.org might allow for user-assisted execution of arbitrary code or symlink attacks. http://www.linuxsecurity.com/content/view/145816 * Gentoo: Honeyd Insecure temporary file creation (Dec 12) -------------------------------------------------------- An insecure temporary file usage has been reported in Honeyd, possibly leading to symlink attacks. http://www.linuxsecurity.com/content/view/145814 ------------------------------------------------------------------------ * Mandriva: Subject: [Security Announce] [ MDVSA-2008:245 ] firefox (Dec 17) -------------------------------------------------------------------------- Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 3.x, version 3.0.5 This update provides the latest Mozilla Firefox 3.x to correct these issues. http://www.linuxsecurity.com/content/view/146051 * Mandriva: Subject: [Security Announce] [ MDVA-2008:202 ] drakx-net (Dec 17) --------------------------------------------------------------------------- Drakfirewall, as shipped with Mandriva Linux 2009.0, was not able to save the firewall configuration after changing port selection. This update fixes the issue. http://www.linuxsecurity.com/content/view/146050 * Mandriva: Subject: [Security Announce] [ MDVSA-2008:244 ] mozilla-firefox (Dec 17) ---------------------------------------------------------------------------------- Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 2.x, version 2.0.0.19 http://www.linuxsecurity.com/content/view/145953 * Mandriva: Subject: [Security Announce] [ MDVSA-2008:243 ] enscript (Dec 15) --------------------------------------------------------------------------- Two buffer overflow vulnerabilities were discovered in GNU enscript, which could allow an attacker to execute arbitrary commands via a specially crafted ASCII file, if the file were opened with the -e or --escapes option enabled (CVE-2008-3863, CVE-2008-4306). The updated packages have been patched to prevent these issues. http://www.linuxsecurity.com/content/view/145938 * Mandriva: Subject: [Security Announce] [ MDVSA-2008:242 ] wireshark (Dec 15) ---------------------------------------------------------------------------- Two vulnerabilities were discovered in Wireshark. The first is a vulnerability in the SMTP dissector that could cause it to consume excessive CPU and memory via a long SMTP request (CVE-2008-5285). The second is an issue with the WLCCP dissector that could cause it to go into an infinite loop. http://www.linuxsecurity.com/content/view/145936 ------------------------------------------------------------------------ * RedHat: Important: java-1.4.2-bea security update (Dec 18) ---------------------------------------------------------- java-1.4.2-bea as shipped in Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary, contains security flaws and should not be used. This update has been rated as having important security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/146053 * RedHat: Important: java-1.5.0-bea security update (Dec 18) ---------------------------------------------------------- java-1.5.0-bea as shipped in Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise Linux 5 Supplementary, contains security flaws and should not be used. This update has been rated as having important security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/146054 * RedHat: Important: java-1.6.0-bea security update (Dec 18) ---------------------------------------------------------- java-1.6.0-bea as shipped in Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise Linux 5 Supplementary, contains security flaws and should not be used.This update has been rated as having important security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/146055 * RedHat: Important: kernel security and bug fix update (Dec 17) -------------------------------------------------------------- Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/145950 * RedHat: Critical: seamonkey security update (Dec 16) ---------------------------------------------------- Updated seamonkey packages that fix security issues are now available for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3, and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/145949 * RedHat: Critical: firefox security update (Dec 16) -------------------------------------------------- An updated firefox package that fixes various security issues is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/145948 * RedHat: Important: kernel security and bug fix update (Dec 16) -------------------------------------------------------------- Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/145942 * RedHat: Moderate: pidgin security and bug fix update (Dec 15) ------------------------------------------------------------- Updated Pidgin packages that fix several security issues and bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/145932 * RedHat: Moderate: cups security update (Dec 15) ----------------------------------------------- Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/145933 * RedHat: Moderate: cups security update (Dec 15) ----------------------------------------------- Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/145934 * RedHat: Moderate: enscript security update (Dec 15) --------------------------------------------------- An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/145930 * RedHat: Moderate: enscript security update (Dec 15) --------------------------------------------------- An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/145931 ------------------------------------------------------------------------ * Slackware: mozilla-firefox (Dec 18) ------------------------------------- New mozilla-firefox packages are available for Slackware 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. http://www.linuxsecurity.com/content/view/146060 ------------------------------------------------------------------------ * Ubuntu: Firefox vulnerabilities (Dec 17) ----------------------------------------- Several flaws were discovered in the browser engine. These problems could allow an attacker to crash the browser and possibly execute arbitrary code with user privileges. http://www.linuxsecurity.com/content/view/145954 * Ubuntu: Firefox vulnerabilities (Dec 17) ----------------------------------------- Several flaws were discovered in the browser engine. These problems could allow an attacker to crash the browser and possibly execute arbitrary code with user privileges. (CVE-2008-5500) http://www.linuxsecurity.com/content/view/145955 * Ubuntu: Ruby vulnerability (Dec 16) ------------------------------------ Laurent Gaffie discovered that Ruby did not properly check for memory allocation failures. If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service. (CVE-2008-3443) http://www.linuxsecurity.com/content/view/145944 ------------------------------------------------------------------------ Distributed by: Guardian Digital, Inc. LinuxSecurity.com To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx with "unsubscribe" in the subject of the message. ------------------------------------------------------------------------
