what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New


Posted Jun 19, 2000
Authored by Benjamin Thomas | Site linuxsecurity.com

Linux Security Week June 12 - In this issue: Updates are available for the Document Template package, BRU Backup Utility, Kerberos 5, and a bug on FreeBSD/Alpha systems that weakens its encryption. OpenBSD 2.7 is annunced and and the U.S. House gives its "OK" to the digital signature bill.

systems | linux, freebsd, openbsd
SHA-256 | d3af4c437f7224ecb592716f7973e2c5f6eeb9545d977a4490847348ca8cf0e6


Change Mirror Download
| LinuxSecurity.com Weekly Newsletter |
| June 19, 2000 Volume 1, Number 8 |
| |
| Editorial Team: Dave Wreski dave@linuxsecurity.com |
| Benjamin Thomas ben@linuxsecurity.com |

Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines and system
advisories. It is distributed each Monday by Guardian Digital, Inc.

After two weeks of constant advisories, it's comforting to see the amount
of activity die down. This week, updates are available for the Document
Template package, BRU Backup Utility, Kerberos 5, and a bug on
FreeBSD/Alpha systems that weakens its encryption.

In the news, OpenBSD announces its release of version 2.7, Mimestar
"Shoots Down Intruders" by releasing Version 3.0.7 of SecureNet PRO, and
the U.S. House gives its "OK" to the digital signature bill.

This week a number of interesting papers were posted. The article "Open
Sources, Security by Default" discusses actions taken by the OpenBSD team,
and Theo De Raadt, the founder of OpenBSD. With the release of OpenBSD
2.7, the goal was to "remove most of the extraneous, unnecessary, and
insecure protocols from the OS, tightened up the default configuration,
and then hunt for bugs ruthlessly." Sound advice for all users.

The historical paper, "Security Controls for Computer Systems" was
referenced on our site this week. It is regarded as "The Paper that
Launched Computer Security." The paper discusses intrusions, physical
security, threats, policy considerations, and gives recommendations.
Anyone interested in computer security and its history should definitly
take a look at this. A majority of this paper is applicable to situations
we face today.

We've recently learned that Red Hat has released a development build of
the 2.2.16 kernel which fixes several security issues discovered last
week. Information on this rawhide (development) version is available at
We'll post their formal announcement as soon as it's made.

Our sponsor this week is WebTrends. Thier Security Analyzer has the most
vulnerability tests available for Red Hat & VA Linux. It uses advanced
agent-based technology, enabling you to scan your Linux servers from your
Windows NT/2000 console and protect them against potential threats. Now
with over 1,000 tests available.


HTML Version Available:

Advisories this Week:

Conectiva: Zope problems in DocumentTemplate - 06/16/2000 - The issue
involves an inadequately protected method in one of the base classes in
the DocumentTemplate package that could allow the contents of
+DTMLDocuments or DTMLMethods to be changed remotely or through DTML code
without forcing proper user authorization.


RedHat 6.2: Kerberos 5 vulnerability - 06/15/2000 - Security
vulnerabilities have been found in the Kerberos 5 implementation shipped
with Red Hat Linux 6.2. A number of possible buffer overruns were found in
libraries included in the affected packages. A denial-of-service
vulnerability was also found in the ksu program.


RedHat: New emacs packages available - 06/15/2000 - With emacs < 20.7,
unprivileged local users can eavesdrop the communication between Emacs and
its subprocesses. Red Hat offers an update for this package.


Zope: Fixed version available - 06/15/2000 - The issue involves an
inadequately protected method in one of the base classes in the
DocumentTemplate package that could allow the contents of DTMLDocuments or
DTMLMethods to be changed remotely or through DTML code without forcing
proper user authorization.


Caldera: local ROOT exploit in BRU - 06/14/2000 - There is a serious
vulnerability in the commandline option and logfile handling of the BRU
Backup Utility which can be exploited by a local attacker to gain root
access to the machine.


FreeBSD: Alpha port vulnerability - 06/12/2000 - Cryptographic secrets
(such as OpenSSH public/private keys) generated on FreeBSD/Alpha systems
may be much weaker than their "advertised" strength, and may lead to data
compromise to a dedicated and knowledgeable attacker.


Linux Host Security:

Network Intrusion Detection, An Analyst's Handbook - 6/17/2000 - Here is
an interesting book review for "Network Intrusion Detection, An Analyst's
Handbook" It gives chapter by chapter summaries throughout the book. "This
book is far-and-away one of the more relevant and well-written books on
security issues, and should be required reading for every system
administrator and network professional."


Linux Kernel Bug prompts Security Alert - 6/15/2000 - The perceived
security of Linux has suffered a setback after the discovery of a serious
bug in the Linux kernel which allows attackers to gain root access through
a variety of programs, including Sendmail. The kernel bug affects versions
2.2.15 and earlier, as well as some 2.4.0 versions, and Linux users are
advised to upgrade to 2.2.16. The problem is all the more serious because
code that exploits the flaw has been posted widely on the internet,
including on a number of well-known security sites.


Detecting Signs of Intrusion - 6/14/2000 - This paper discusses various
ways on how to detect intrusions. Intruders are always looking for new
ways to break into systems. "They may attempt to breach your network's
perimeter defenses from remote locations, or physically infiltrate your
organization to gain direct access to its information resources."


An Overview of TCP and IP Spoofing - 6/12/2000 - To understand the
spoofing process, I will begin by explaining the TCP and IP authentication
process. Then I will discuss how an attacker can spoof your network.


Linux Server Security:

Building a Secure Gateway System - 6/15/2000 - This article explains how
to secure a Linux gateway. If you do not have a gateway already setup, it
suggest that you read this article. The author assumes that you are
already familiar with Linux and currently have a constant connection to
the internet.


Sub7 vid Trojan can launch distributed attacks - 6/17/2000 - As it turns
out, the most recent build of Sub7 contains an undocumented feature which
can indeed be used to ping the living hell out of Web servers, from
numerous infected clients simultaneously, according to research just
completed by security outfit iDefense.


BIND 8.2.x Overflow Vulnerability - 6/16/2000 - This paper covers a BIND
buffer overflow that exists in 8.2, 8.2.1 and 8.2.2. Here CIAC explains
how the exploit works, "The exploit requires two systems to be successful.
The first is a DNS server that will have an altered DNS table. The second
machine is where the attack will take place."


The Secrets of Snoop - 6/15/2000 - Lance writes, "Sniffers have exploded
in popularity over the past several years, from Network Generals Netxray
and Microsofts Network Monitor, to public domain tools such as Etherman
and Curry Sniffer. These tools are used for various reasons, including
network troubleshooting, traffic analysis, node discovery, etc. We will be
covering one of the most common, yet effective sniffers, snoop.


Cracked! part 5: Rebuilding - 6/12/2000 - This is the fifth part of the
story of a community network that was cracked and what was done to recover
from it. By this point we have realized that we must get the cracker off
of our machines before it is to late. It is only a matter of time before
he trashes our system to clean up his tracks, gets a sniffer running under
a different architecture or uses us to launch some denial of service



Bruce Schneier's Crypto-Gram - 6/16/2000 - In this month's issue of Bruce
Schneier's Crypto-Gram, he discusses SOAP, Crypto-Gram Reprints, News,
Counterpane Internet Security News, Java and Viruses The Doghouse:
Infraworks, The Data Encryption Standard (DES), and Comments from eaders.
Always an excellent read.


The Death of Unencrypted Connections? - 6/14/2000 - Over the last few
years "hacker" tools have become much more widespread and available to
malicious attackers. Combine this with the ease of getting operating
systems - almost anything a corporation has short of a mainframe OS you
can download from the Internet and run on your Intel PC. Encryption is now
more important than ever.


New MI5 unit to crack criminal computer codes - 6/13/2000 - A special
codebreaking organisation is to be set up inside the headquarters of MI5
to crack encrypted communications and computer discs belonging to
suspected organised criminals and terrorists. The new centre, which will
begin to recruit expert codebreakers soon, will cost about 25 million
over the next few years, and has already been budgeted for by the Home



OpenBSD Announces Release 2.7 - 6/15/2000 - Calgary, Canada -- OpenBSD
announces release 2.7 of the "Secure by Default" operating system for
Internet servers and workstations. OpenBSD 2.7 significantly enhances the
built-in strong cryptography with the OpenSSH suite to support the SSH 1
and 2 secure communication protocols and drivers for hardware accelerators
for IPSec VPNs.


RootFest Opens Today - 6/14/2000 - "The Midwest's largest computer
security convention opens today in St. Paul's RiverCentre. RootFest
organizers estimate that as many as 1000 people may attend RootFest this

http://www.linuxsecurity.com/articles/projects_article -883.html

MimeStar Shoots Down Intruders - 6/12/2000 - Version 3.0.7 of MimeStar's
SecureNet PRO Network Intrusion Detection and Monitoring suite has been
unveiled, revealing an enterprise-scalable security platform with custom
protocol decoding, real-time monitoring and unique intrusion response


Internet Security Voice Verification Technology - 6/12/2000 - Israeli
start-up Sentry Com has developed technology for a biometric voice
signature that is capable of creating a revolution in entry security and
protection of commercial transactions over the Internet. The company's
product, named VoiceShield, was demonstrated for the first time at the
SuperCOM 2000 communications exhibition in Atlanta in the US at the end of
last week, and aroused a great deal of interest.


General News:

IT Directors Under Fire for Poor Security Policies - 6/15/2000 - IT
decision makers have come under fire for failing to invest in adequate
network security as more companies adopt ecommerce strategies. According
to a report by research house Ovum, organisations are increasingly relying
on an out-dated approach to security. A failure to distinguish between
different applications and systems also left the network vulnerable to


U.S. House gives OK to digital signature - 6/15/2000 - A bill that gives
electronic signatures and documents the same force in law as their paper
counterparts won near unanimous approval in the U.S. House of
Representatives on Wednesday. Under the proposed law, consumers and
businesses will be able to sign checks, complete loan applications and
contract services all online in a further broadening of e-commerce.

http://www.linuxsecurity.com/articles/general_article-8 93.html

Old security models inadequate for ebusiness - 6/15/2000 - In its report
E-Business Security: New Directions and Successful Strategies, Ovum argues
that the traditional hierarchy of trust adopted by organisations does not
fit the ebusiness model, meaning that access channels, such as mobile
devices, could pose a major security threat.


The Paper that Launched Computer Security - 6/13/2000 - This is reportedly
the document that started computer security. It discusses intrusions,
physical security, threats, policy considerations, and recommendations.
Quite good.


Open Sources, Security by Default 6/12/2000 What would happen if you
removed most of the extraneous, unnecessary and insecure protocols from
your OS, tightened up the default configuration and then hunted bugs
ruthlessly? Something very much like OpenBSD, because that's precisely
what project founder Theo De Raadt decided to do. The result has been
largely successful in terms of achieving "security by default."


Distributed by: Guardian Digital, Inc. LinuxSecurity.com

To unsubscribe email newsletter-request@linuxsecurity.com
with "unsubscribe" in the subject of the message.

Login or Register to add favorites

File Archive:

December 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    32 Files
  • 5
    Dec 5th
    10 Files
  • 6
    Dec 6th
    14 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By