+----------------------------------------------------------------------+ | LinuxSecurity.com Linux Advisory Watch | | September 24th, 2010 Volume 11, Number 39 | | | | Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> | | Benjamin D. Thomas <bthomas@xxxxxxxxxxxxxxxxx> | +----------------------------------------------------------------------+ Thank you for reading the inux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available. Review: The Official Ubuntu Book -------------------------------- If you haven't used Linux before, are new to Ubuntu, or would like a quick update on the latest in open source advancements for the desktop, then The Official Ubuntu Book is a great place to start. http://www.linuxsecurity.com/content/view/153159 Review: Zabbix 1.8 Network Monitoring ------------------------------------- If you have anything more than a small home network, you need to be monitoring the status of your systems to ensure they are providing the services they were designed to provide. http://www.linuxsecurity.com/content/view/152990 --> Take advantage of the LinuxSecurity.com Quick Reference Card! <-- --> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <-- ------------------------------------------------------------------------ * EnGarde Secure Community 3.0.22 Now Available! ---------------------------------------------- Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy. http://www.linuxsecurity.com/content/view/145668 ------------------------------------------------------------------------ * Debian: 2113-1: drupal6: several vulnerabilities (Sep 20) --------------------------------------------------------- Several vulnerabilities have been discovered in drupal6 a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following problems: [More...] http://www.linuxsecurity.com/content/view/153309 * Debian: 2112-1: bzip2: integer overflow (Sep 20) ------------------------------------------------ Mikolaj Izdebski has discovered an integer overflow flaw in the BZ2_decompress function in bzip2/libbz2. An attacker could use a crafted bz2 file to cause a denial of service (application crash) or potentially to execute arbitrary code. (CVE-2010-0405) [More...] http://www.linuxsecurity.com/content/view/153306 * Debian: 2106-2: xulrunner: Multiple vulnerabilities (Sep 19) ------------------------------------------------------------ DSA-2106-1 introduced a regression that could lead to an application crash. This update fixes this problem. For reference, the text of the original advisory is provided below. [More...] http://www.linuxsecurity.com/content/view/153305 * Debian: 2111-1: squid3: denial of service (Sep 19) -------------------------------------------------- Phil Oester discovered that squid3, a fully featured Web Proxy cache, is prone to a denial of service attack via a specially crafted request that includes empty strings. [More...] http://www.linuxsecurity.com/content/view/153304 * Debian: 2110-1: linux-2.6: privilege escalation/denial (Sep 17) --------------------------------------------------------------- CVE-2010-2492 Andre Osterhues reported an issue in the eCryptfs subsystem. A buffer overflow condition may allow local users to cause a denial of service [More...] http://www.linuxsecurity.com/content/view/153298 * Debian: 2109-1: samba: buffer overflow (Sep 16) ----------------------------------------------- A vulnerability has been discovered in samba, a SMB/CIFS file, print, and login server for Unix. [More...] http://www.linuxsecurity.com/content/view/153292 ------------------------------------------------------------------------ * Gentoo: 201009-07: libxml2: Denial of Service (Sep 21) ------------------------------------------------------ Multiple Denial of Services vulnerabilities were found in libxml2. http://www.linuxsecurity.com/content/view/153333 * Gentoo: 201009-08: python-updater: Untrusted search path (Sep 21) ----------------------------------------------------------------- An untrusted search path vulnerability in python-updater might resultin the execution of arbitrary code. http://www.linuxsecurity.com/content/view/153334 ------------------------------------------------------------------------ * Mandriva: 2010:189-1: pcsc-lite (Sep 24) ---------------------------------------- Multiple vulnerabilities has been found and corrected in pcsc-lite: The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted [More...] http://www.linuxsecurity.com/content/view/153351 * Mandriva: 2010:189: pcsc-lite (Sep 24) -------------------------------------- Multiple vulnerabilities has been found and corrected in pcsc-lite: The MSGFunctionDemarshall function in winscard_svc.c in the PC/SC Smart Card daemon (aka PCSCD) in MUSCLE PCSC-Lite before 1.5.4 might allow local users to cause a denial of service (daemon crash) via crafted [More...] http://www.linuxsecurity.com/content/view/153348 * Mandriva: 2010:188: kernel (Sep 23) ----------------------------------- Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel: fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount symlinks, which allows attackers to have an [More...] http://www.linuxsecurity.com/content/view/153343 * Mandriva: 2010:187: squid (Sep 22) ---------------------------------- A vulnerability has been found and corrected in squid: The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a [More...] http://www.linuxsecurity.com/content/view/153337 * Mandriva: 2010:186: phpmyadmin (Sep 21) --------------------------------------- A vulnerability has been found and corrected in phpmyadmin: Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name [More...] http://www.linuxsecurity.com/content/view/153324 * Mandriva: 2010:185: bzip2 (Sep 20) ---------------------------------- An integer overflow has been found and corrected in bzip2 which could be exploited by using a specially crafted bz2 file and cause a denial of service attack (CVE-2010-0405). Additionally clamav has been upgraded to 0.96.2 and has been patched [More...] http://www.linuxsecurity.com/content/view/153315 * Mandriva: 2010:184: samba (Sep 16) ---------------------------------- A vulnerability has been found and corrected in samba: Stack-based buffer overflow in the (1) sid_parse and (2) dom_sid_parse functions in Samba before 3.5.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a [More...] http://www.linuxsecurity.com/content/view/153293 ------------------------------------------------------------------------ * Red Hat: 2010:0711-01: kernel: Important Advisory (Sep 22) ---------------------------------------------------------- Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5.3 Extended Update Support. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/153336 * Red Hat: 2010:0706-01: flash-plugin: Critical Advisory (Sep 21) --------------------------------------------------------------- An updated Adobe Flash Player package that fixes one security issue is now available for Red Hat Enterprise Linux 3 and 4 Extras, and Red Hat Enterprise Linux 5 Supplementary. [More...] http://www.linuxsecurity.com/content/view/153322 * Red Hat: 2010:0705-01: kernel: Important Advisory (Sep 21) ---------------------------------------------------------- Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5.4 Extended Update Support. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/153321 * Red Hat: 2010:0704-01: kernel: Important Advisory (Sep 21) ---------------------------------------------------------- Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/153320 * Red Hat: 2010:0703-01: bzip2: Important Advisory (Sep 20) --------------------------------------------------------- Updated bzip2 packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/153318 ------------------------------------------------------------------------ * Slackware: 2010-265-01: 64-bit kernel: Security Update (Sep 22) --------------------------------------------------------------- New kernel packages are available for Slackware x86_64 13.1, and -current to fix security issues. [More Info...] http://www.linuxsecurity.com/content/view/153342 * Slackware: 2010-263-01: bzip2: Security Update (Sep 20) ------------------------------------------------------- New bzip2 packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix a security issue. [More Info...] http://www.linuxsecurity.com/content/view/153316 ------------------------------------------------------------------------ * SuSE: 2010-042: flash-player (Sep 22) ------------------------------------- Adobe Flash Player was updated to version 10.1.85.3 (resp. 9.0.283.0 on SLE10) to fix a vulnerability that allowed remote attackers to crash the player or potentially even cause execution of arbitrary code (CVE-2010-2884). http://www.linuxsecurity.com/content/view/153335 * SuSE: Weekly Summary 2010:017 (Sep 21) -------------------------------------- To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. http://www.linuxsecurity.com/content/view/153323 * SuSE: 2010-041: Linux kernel (Sep 17) ------------------------------------- The openSUSE 11.3 kernel was updated to version 2.6.34.7. The update fixes lots of bugs and security issues. A major regression in handling some USB Input devices (Mice and Keyboard) introduced by the previous update was fixed. We also fixed a lot of bugs in the ATH5K wireless driver. [More...] http://www.linuxsecurity.com/content/view/153297 ------------------------------------------------------------------------ * Ubuntu: 991-1: quassel vulnerability (Sep 23) --------------------------------------------- Jima discovered that quassel would respond to a single privmsgcontaining multiple CTCP requests with multiple NOTICEs, possiblyresulting in a denial of service against the IRC connection. [More...] http://www.linuxsecurity.com/content/view/153347 * Ubuntu: 990-2: Apache vulnerability (Sep 21) -------------------------------------------- USN-860-1 introduced a partial workaround to Apache that disabled clientinitiated TLS renegotiation in order to mitigate CVE-2009-3555. USN-990-1introduced the new RFC5746 renegotiation extension in openssl, andcompletely resolves the issue. [More...] http://www.linuxsecurity.com/content/view/153325 * Ubuntu: 990-1: OpenSSL vulnerability (Sep 21) --------------------------------------------- Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3protocols. If an attacker could perform a man in the middle attack at thestart of a TLS connection, the attacker could inject arbitrary content atthe beginning of the user's session. This update adds backported supportfor the new RFC5746 renegotiation extension and will use it when both the [More...] http://www.linuxsecurity.com/content/view/153326 * Ubuntu: 986-3: dpkg vulnerability (Sep 20) ------------------------------------------ USN-986-1 fixed vulnerabilities in bzip2. dpkg statically links against libbz2and needed to be rebuilt to use the updated libbz2. [More...] http://www.linuxsecurity.com/content/view/153314 * Ubuntu: 986-2: ClamAV vulnerability (Sep 20) -------------------------------------------- USN-986-1 fixed a vulnerability in bzip2. This update provides thecorresponding update for ClamAV. [More...] http://www.linuxsecurity.com/content/view/153307 * Ubuntu: 986-1: bzip2 vulnerability (Sep 20) ------------------------------------------- An integer overflow was discovered in bzip2. If a user or automated systemwere tricked into decompressing a crafted bz2 file, an attacker could causebzip2 or any application linked against libbz2 to crash or possibly executecode as the user running the program. [More...] http://www.linuxsecurity.com/content/view/153308 * Ubuntu: 978-2: Thunderbird regression (Sep 16) ---------------------------------------------- USN-978-1 fixed vulnerabilities in Thunderbird. Some users reportedstability problems under certain circumstances. This update fixes theproblem. [More...] http://www.linuxsecurity.com/content/view/153295 * Ubuntu: 975-2: Firefox and Xulrunner regression (Sep 16) -------------------------------------------------------- USN-975-1 fixed vulnerabilities in Firefox and Xulrunner. Some usersreported stability problems under certain circumstances. This update fixesthe problem. [More...] http://www.linuxsecurity.com/content/view/153294 ------------------------------------------------------------------------ Distributed by: Guardian Digital, Inc. LinuxSecurity.com To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx with "unsubscribe" in the subject of the message. ------------------------------------------------------------------------
