Brief items
vnunet has posted
another one
of its Linux security articles with the same sort of theme:
X-Force, the US-based monitoring group of security software firm
Internet Security Systems, has been tracking the number of security
holes in software. Last year the centre found 149 bugs in
Microsoft software compared to 309 for Linux. This year the
situation was worse, with 485 Linux bugs this year compared to
Microsoft's 202.
Nobody would try to argue that Linux is free of security holes - anybody
who thinks so need only read the rest of this page to learn otherwise. But
the above comparison is absolutely meaningless for a number of reasons:
- Each distribution is counted independently. The same vulnerability in
five distributions will count as five separate vulnerabilities. This
practice, of course, inflates the number of reported Linux problems.
- Linux vulnerabilities include those in applications (i.e. PostgreSQL)
which are not part of a standard Windows system.
- Most Linux vulnerabilities are found through code audits and similar
efforts; they are patched and reported before any exploits happen.
Any Windows bugs found through similar audits are fixed silently and
do not appear in these counts.
Articles like this one try to make it appear that Linux has worse security
problems than other operating systems. If you look, however, at the amount
of actual security pain suffered by Linux administrators, the story is
different. Linux security is nowhere near as good as it really should be,
but it's not as bad as some people would like to make it out to be.
Comments (5 posted)
Red Hat and Dell have
announced
that an "open source security summit" will be held on October 29 in
Washington, DC.
"
The Security Summit will provide an open forum to discuss and
explore how open source technologies, methodologies, tools, and support
processes meet the challenges of securing networks and computer
systems.
"
Comments (none posted)
New vulnerabilities
Another set of fetchmail buffer overflows
| Package(s): | fetchmail fetchmail-ssl |
CVE #(s): | |
| Created: | October 1, 2002 |
Updated: | December 17, 2002 |
| Description: |
e-matters GmbH has issued an advisory
warning of a new set of buffer overflows in the fetchmail header parsing
code. The vulnerabilities have been fixed in fetchmail 6.1.0. |
| Alerts: |
|
Comments (none posted)
Multiple vulnerabilities in bugzilla
| Package(s): | bugzilla |
CVE #(s): | |
| Created: | October 2, 2002 |
Updated: | October 9, 2002 |
| Description: |
The Bugzilla bug tracking system (versions prior to 2.14.4 or 2.16.1)
suffers from a number of vulnerablities, including one which could result
in remote command and SQL injection. An upgrade to 2.16.1 is recommended,
since the 2.14 branch will be unmaintained after the end of the year. See
the Bugzilla advisory for details. |
| Alerts: |
|
Comments (1 posted)
Apache 2.0 cross-site scripting vulnerability
| Package(s): | apache |
CVE #(s): | CAN-2002-0840
|
| Created: | October 2, 2002 |
Updated: | October 2, 2002 |
| Description: |
Versions of Apache 2.0 prior to 2.0.43 have a
cross-site scripting vulnerability in the error page handling code. If
you are running Apache 2.0, this one is worth fixing. |
| Alerts: |
(No alerts in the database for this vulnerability)
|
Comments (none posted)
Buffer overflow in gv
| Package(s): | gv |
CVE #(s): | CAN-2002-0838
|
| Created: | October 1, 2002 |
Updated: | November 25, 2002 |
| Description: |
gv, a graphical front end to ghostscript, has a buffer overflow
vulnerability which can be exploited by a properly crafted PostScript or
PDF file. If a user can be tricked into viewing such a file, arbitrary
code can be executed with that user's privileges. See this iDEFENSE advisory for the details. |
| Alerts: |
|
Comments (none posted)
Buffer overflows in heimdal
| Package(s): | heimdal |
CVE #(s): | |
| Created: | October 1, 2002 |
Updated: | October 17, 2002 |
| Description: |
A SuSE security team audit of the heimdal Kerberos implementation turned up sever buffer overflow vulnerabilities. No exploits are known as of this writing, but these vulnerabilities are almost certainly possible for a remote attacker to exploit; if you are running heimdal, you should upgrade at the first opportunity. |
| Alerts: |
|
Comments (none posted)
sendmail smrsh bypass vulnerability
| Package(s): | sendmail |
CVE #(s): | CAN-2002-1165
|
| Created: | October 2, 2002 |
Updated: | November 29, 2002 |
| Description: |
iDEFENSE has posted an advisory warning of a
couple of ways of bypassing the restrictions imposed by the sendmail
"smrsh" utility. smrsh puts limits on which programs a user may run out of
a .forward file; this vulnerability could give a local user
undesired access to the mail server system. A patch has
been made available from sendmail.org which closes the vulnerability. |
| Alerts: |
|
Comments (none posted)
File overwrite vulnerability in tar and unzip
| Package(s): | tar unzip |
CVE #(s): | CAN-2001-1267
CAN-2001-1268
CAN-2001-1269
CAN-2002-0399
|
| Created: | October 1, 2002 |
Updated: | April 10, 2006 |
| Description: |
The tar utility does not properly filter file names containing
"../", meaning that a hostile archive can, if unpacked by an
unsuspecting user, overwrite any file that is writable by that user. GNU
tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42
has the same vulnerability. |
| Alerts: |
|
Comments (1 posted)
Resources
Linux Security Week for September 30 from LinuxSecurity.com is available.
Full Story (comments: none)
The Register
covers
two recent varients of the Slapper worm, Slapper.B (Cinik) and Slapper.C
(Unlock).
"
Two fresh variants of the Slapper worm, which spreads through Linux machines
by exploiting a well-known flaw in OpenSSL libraries, have been sighted this week.
"
Comments (none posted)
Page editor: Jonathan Corbet
Next page:
Kernel development>>
