AOH :: IS1609.HTM

Linux Security Week - January 16th 2009




Linux Security Week - January 16th 2009
Linux Security Week - January 16th 2009



+----------------------------------------------------------------------+
| LinuxSecurity.com                                  Weekly Newsletter |
| January 16th, 2009                               Volume 10, Number 3 |
|                                                                      |
| Editorial Team: Dave Wreski  | 
| Benjamin D. Thomas  | 
+----------------------------------------------------------------------+

Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.

This week advisories were released for xulrunner, bind9, ntp, openssl,
lasso, zaptel, gforge, tqsllib, amarok, xine, avahi, mplayer, jhead,
steamripper, d-bus, ndiswrapper, virtualbox, qemu, kvm, xterm,
pam_mount, python, squirrelmail, java, hplip, cups, audiofile,
valgrind, and samba.  The distributors include Debian, Fedora, Gentoo,
Mandriva, Red Hat, Ubuntu, and Pardus.

---

>> Linux+DVD Magazine <<

In each issue you can find information concerning the best use of Linux:
safety, databases, multimedia, scientific tools, entertainment,
programming, e-mail, news and desktop environments.

Catch up with what professional network and database administrators,
system programmers, webmasters and all those who believe in the power of
Open Source software are doing!

http://www.linuxsecurity.com/ads/adclick.php?bannerid=26 

---

Review: Googling Security: How Much Does Google Know About You
--------------------------------------------------------------
If I ask "How much do you know about Google?" You may not take even a
second to respond.  But if I may ask "How much does Google know about
you"? You may instantly reply "Wait... what!? Do they!?"  The book
"Googling Security: How Much Does Google Know About You" by Greg Conti
(Computer Science Professor at West Point) is the first book to reveal
how Google's vast information stockpiles could be used against you or
your business and what you can do to protect yourself.

http://www.linuxsecurity.com/content/view/145939 

---

A Secure Nagios Server
----------------------
Nagios is a monitoring software designed to let you know about problems
on your hosts and networks quickly. You can configure it to be used on
any network. Setting up a Nagios server on any Linux distribution is a
very quick process however to make it a secure setup it takes some
work. This article will not show you how to install Nagios since there
are tons of them out there but it will show you in detail ways to
improve your Nagios security.

http://www.linuxsecurity.com/content/view/144088 

-->  Take advantage of the LinuxSecurity.com Quick Reference Card!  <--
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <-- 

------------------------------------------------------------------------

* EnGarde Secure Community 3.0.22 Now Available! (Dec 9)
  ------------------------------------------------------
  Guardian Digital is happy to announce the release of EnGarde Secure
  Community 3.0.22 (Version 3.0, Release 22).  This release includes
  many updated packages and bug fixes and some feature enhancements to
  the EnGarde Secure Linux Installer and the SELinux policy.

http://www.linuxsecurity.com/content/view/145668 

------------------------------------------------------------------------

* Debian: New xulrunner packages fix several vulnerabilities (Jan 14)
  -------------------------------------------------------------------
  Several remote vulnerabilities have been discovered in Xulrunner, a
  runtime environment for XUL applications. The Common Vulnerabilities
  and Exposures project identifies the following problems...

http://www.linuxsecurity.com/content/view/147167 

* Debian: New bind9 packages fix cryptographic weakness (Jan 12)
  --------------------------------------------------------------
  It was discovered that BIND, an implementation of the DNS protocol
  suite, does not properly check the result of an OpenSSL function
  which is used to verify DSA cryptographic signatures.  As a result,
  incorrect DNS resource records in zones protected by DNSSEC could be
  accepted as genuine.

http://www.linuxsecurity.com/content/view/147140 

* Debian: New ntp packages fix cryptographic weakness (Jan 12)
  ------------------------------------------------------------
  It has been discovered that NTP, an implementation of the Network
  Time Protocol, does not properly check the result of an OpenSSL
  function for verifying cryptographic signatures, which may ultimately
  lead to the acceptance of unauthenticated time information.  (Note
  that cryptographic authentication of time servers is often not
  enabled in the first place.)

http://www.linuxsecurity.com/content/view/147139 

* Debian: New OpenSSL packages fix cryptographic weakness (Jan 12)
  ----------------------------------------------------------------
  It was discovered that OpenSSL does not properly verify DSA
  signatures on X.509 certificates due to an API misuse, potentially
  leading to the acceptance of incorrect X.509 certificates as genuine
  (CVE-2008-5077).

http://www.linuxsecurity.com/content/view/147138 

* Debian: New lasso packages fix validation bypass (Jan 11)
  ---------------------------------------------------------
  It was discovered that Lasso, a library for Liberty Alliance and SAML
  protocols performs incorrect validation of the return value of
  OpenSSL's DSA_verify() function.

http://www.linuxsecurity.com/content/view/147130 

* Debian: New zaptel packages fix privilege escalation (Jan 11)
  -------------------------------------------------------------
  An array index error in zaptel, a set of drivers for telephony
  hardware, could allow users to crash the system or escalate their
  privileges by overwriting kernel memory (CVE-2008-5396).

http://www.linuxsecurity.com/content/view/147127 

* Debian: New gforge packages fix SQL injection (Jan 9)
  -----------------------------------------------------
  It was discovered that GForge, a collaborative development tool,
  insufficiently sanitises some input allowing a remote attacker to
  perform SQL injection.

http://www.linuxsecurity.com/content/view/147118 

------------------------------------------------------------------------

* Fedora 9 Update: tqsllib-2.0-5.fc9 (Jan 14)
  -------------------------------------------
  The TrustedQSL library incorrectly checked the result after  calling
  the EVP_VerifyFinal function, allowing a malformed signature to be
  treated as a good signature rather than as an error. Package includes
  a patch to fix EVP_VerifyFinal result check.

http://www.linuxsecurity.com/content/view/147350 

* Fedora 10 Update: amarok-2.0.1.1-1.fc10 (Jan 14)
  ------------------------------------------------
  An update to the latest release, includes new features such as
  queuing, playlist search and filtering as well as "stop after current
  track". And, long awaited and finally available: sorting the
  collection by composer.    Also includes a security fix concerning
  the parsing of malformed Audible digital audio files. For further
details, see	http://amarok.kde.org/en/releases/2.0.1.1 

http://www.linuxsecurity.com/content/view/147354 

* Fedora 9 Update: xine-lib-1.1.16-1.fc9.1 (Jan 14)
  -------------------------------------------------
  This updates xine-lib to the upstream 1.1.16 release. This fixes
  several bugs, including the security issues CVE-2008-5234 vector 1,
  CVE-2008-5236, CVE-2008-5237, CVE-2008-5239, CVE-2008-5240 vectors 3
  & 4 and CVE-2008-5243. See
http://sourceforge.net/project/shownotes.php?release_id=652075&group_ 
  id=9655 for the full list of changes.    In addition, the Fedora
  xine-lib package now includes the demuxers for the MPEG container
  format, which are not patent- encumbered. (The decoders for actual
  MPEG video and audio data are still excluded due to software
  patents.)

http://www.linuxsecurity.com/content/view/147348 

* Fedora 9 Update: nfs-utils-1.1.2-9.fc9 (Jan 14)
  -----------------------------------------------
  - Added warnings to tcp wrapper code when mounts are	  denied due to
  misconfigured DNS configurations.  - gssd: By default, don't spam
  syslog when users' credentials expire   Re-enabled and fixed/enhanced
  tcp wrappers.

http://www.linuxsecurity.com/content/view/147320 

* Fedora 10 Update: xine-lib-1.1.16-1.fc10 (Jan 14)
  -------------------------------------------------
  This updates xine-lib to the upstream 1.1.16 release. This fixes
  several bugs, including the security issues CVE-2008-5234 vector 1,
  CVE-2008-5236, CVE-2008-5237, CVE-2008-5239, CVE-2008-5240 vectors 3
  & 4 and CVE-2008-5243. See
http://sourceforge.net/project/shownotes.php?release_id=652075&group_ 
  id=9655 for the full list of changes.    In addition, the Fedora
  xine-lib package now includes the demuxers for the MPEG container
  format, which are not patent- encumbered. (The decoders for actual
  MPEG video and audio data are still excluded due to software
  patents.)

http://www.linuxsecurity.com/content/view/147297 

* Fedora 10 Update: bind-9.5.1-1.P1.fc10 (Jan 14)
  -----------------------------------------------
  Update to 9.5.1-P1 maintenance release which fixes CVE-2009-0025.
  This update also address following issues:  - sample config file was
  outdated  - specifying a fixed query source was broken

http://www.linuxsecurity.com/content/view/147268 

* Fedora 10 Update: tqsllib-2.0-5.fc10 (Jan 14)
  ---------------------------------------------
  The TrustedQSL library incorrectly checked the result after  calling
  the EVP_VerifyFinal function, allowing a malformed signature to be
  treated as a good signature rather than as an error. Package includes
  a patch to fix EVP_VerifyFinal result check.

http://www.linuxsecurity.com/content/view/147228 

* Fedora 9 Update: bind-9.5.1-1.P1.fc9 (Jan 14)
  ---------------------------------------------
  Update to 9.5.1-P1 maintenance release which includes fix for
  CVE-2009-0025. This update also fixes rare crash of host utility.

http://www.linuxsecurity.com/content/view/147188 

* Fedora 10 Update: nfs-utils-1.1.4-6.fc10 (Jan 14)
  -------------------------------------------------
  Added warnings to tcp wrapper code when mounts are	denied due to
  misconfigured DNS configurations.    gssd: By default, don't spam
  syslog when users' credentials expire

http://www.linuxsecurity.com/content/view/147171 

------------------------------------------------------------------------

* Gentoo: Avahi Denial of Service (Jan 14)
  ----------------------------------------
  A Denial of Service vulnerability has been discovered in Avahi.

http://www.linuxsecurity.com/content/view/147168 

* Gentoo: Adobe Reader User-assisted execution of arbitrary code (Jan 13)
  -----------------------------------------------------------------------
  Adobe Reader is vulnerable to execution of arbitrary code.

http://www.linuxsecurity.com/content/view/147144 

* Gentoo: Online-Bookmarks Multiple vulnerabilities (Jan 12)
  ----------------------------------------------------------
  Multiple vulnerabilities have been reported in Online-Bookmarks.

http://www.linuxsecurity.com/content/view/147141 

* Gentoo: MPlayer Multiple vulnerabilities (Jan 12)
  -------------------------------------------------
  Multiple vulnerabilities in MPlayer may lead to the execution of
  arbitrary code or a Denial of Service.

http://www.linuxsecurity.com/content/view/147137 

* Gentoo: JHead Multiple vulnerabilities (Jan 12)
  -----------------------------------------------
  Multiple vulnerabilities in JHead might lead to the execution of
  arbitrary code or data loss.

http://www.linuxsecurity.com/content/view/147136 

* Gentoo: Tremulous User-assisted execution of arbitrary (Jan 11)
  ---------------------------------------------------------------
  A buffer overflow vulnerability has been discovered in Tremulous.

http://www.linuxsecurity.com/content/view/147129 

* Gentoo: Streamripper Multiple vulnerabilities (Jan 11)
  ------------------------------------------------------
  Multiple buffer overflows have been discovered in Streamripper,
  allowing for user-assisted execution of arbitrary code.

http://www.linuxsecurity.com/content/view/147128 

* Gentoo: D-Bus Denial of Service (Jan 10)
  ----------------------------------------
  An error condition can cause D-Bus to crash.

http://www.linuxsecurity.com/content/view/147126 

* Gentoo: pdnsd Denial of Service and cache poisoning (Jan 10)
  ------------------------------------------------------------
  Two errors in pdnsd allow for Denial of Service and cache poisoning.

http://www.linuxsecurity.com/content/view/147125 

* Gentoo: JHead Multiple vulnerabilities (Jan 10)
  -----------------------------------------------
  Multiple vulnerabilities in JHead might lead to the execution of
  arbitrary code or data loss.

http://www.linuxsecurity.com/content/view/147124 

* Gentoo: NDISwrapper Arbitrary remote code execution (Jan 10)
  ------------------------------------------------------------
  Multiple buffer overflows might lead to remote execution of arbitrary
  code with root privileges.

http://www.linuxsecurity.com/content/view/147123 

------------------------------------------------------------------------

* Mandriva: [ MDVSA-2009:011 ] virtualbox (Jan 14)
  ------------------------------------------------
  A vulnerability have been discovered and corrected in VirtualBox,
  affecting versions prior to 2.0.6, which allows local users to
  overwrite arbitrary files via a symlink attack on a
  /tmp/.vbox-qateam-ipc/lock temporary file (CVE-2008-5256). The
  updated packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/147169 

* Mandriva: [ MDVSA-2009:010 ] qemu (Jan 14)
  ------------------------------------------
  A security vulnerability have been discovered and corrected in VNC
  server of qemu 0.9.1 and earlier, which could lead to a
  denial-of-service attack (CVE-2008-2382). The updated packages have
  been patched to prevent this.

http://www.linuxsecurity.com/content/view/147155 

* Mandriva: [ MDVSA-2009:009 ] kvm (Jan 14)
  -----------------------------------------
  Security vulnerabilities have been discovered and corrected in VNC
  server of kvm version 79 and earlier, which could lead to
  denial-of-service attacks (CVE-2008-2382), and make it easier for
  remote crackers to guess the VNC password (CVE-2008-5714). The
  updated packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/147154 

* Mandriva: [ MDVSA-2009:008 ] qemu (Jan 14)
  ------------------------------------------
  Security vulnerabilities have been discovered and corrected in VNC
  server of qemu version 0.9.1 and earlier, which could lead to
  denial-of-service attacks (CVE-2008-2382), and make it easier for
  remote crackers to guess the VNC password (CVE-2008-5714). The
  updated packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/147153 

* Mandriva: [ MDVSA-2009:007 ] ntp (Jan 13)
  -----------------------------------------
  A flaw was found in how NTP checked the return value of signature
  verification.  A remote attacker could use this to bypass certificate
  validation by using a malformed SSL/TLS signature (CVE-2009-0021).
  The updated packages have been patched to prevent this issue.

http://www.linuxsecurity.com/content/view/147152 

* Mandriva: [ MDVSA-2009:006 ] openoffice.org (Jan 13)
  ----------------------------------------------------
  Heap-based overflow on functions to manipulate WMF and EMF files in
  OpenOffice.org documments enables remote attackers to execute
  arbitrary code on documments holding certain crafted either WMF or
  EMF files (CVE-2008-2237) (CVE-2008-2238). This update provide the
  fix for these security issues and further openoffice.org-voikko
  package has been updated as it depends on openoffice.org packages.

http://www.linuxsecurity.com/content/view/147145 

* Mandriva: [ MDVA-2009:010 ] bind (Jan 12)
  -----------------------------------------
  A build issue with the BIND9 packages in Mandriva Linux 2009.0
  prevents IPv6 from working correctly.  This is due to POSIX not
  including the IPv6 Advanced Socket API, so glibc hides parts of this
  API as a result.  The end result is a breakage in how IPv6 works.
  Compiling BIND9 with -D_GNU_SOURCE fixes this issue, and the updated
  packages use this additional flag.

http://www.linuxsecurity.com/content/view/147142 

* Mandriva: [ MDVSA-2009:005 ] xterm (Jan 11)
  -------------------------------------------
  A vulnerability has been discovered in xterm, which can be exploited
  by malicious people to compromise a user's system. The vulnerability
  is caused due to xterm not properly processing the DECRQSS Device
  Control Request Status String escape sequence. This can be exploited
  to inject and execute arbitrary shell commands by e.g. tricking a
  user into displaying a malicious text file containing a specially
  crafted escape sequence via the more command in xterm
  (CVE-2008-2383). The updated packages have been patched to prevent
  this.

http://www.linuxsecurity.com/content/view/147131 

* Mandriva: [ MDVSA-2009:002 ] bind (Jan 10)
  ------------------------------------------
  A flaw was found in how BIND checked the return value of the OpenSSL
  DSA_do_verify() function.  On systems that use DNSSEC, a malicious
  zone could present a malformed DSA certificate and bypass proper
  certificate validation, which would allow for spoofing attacks
  (CVE-2009-0025). The updated packages have been patched to prevent
  this issue.

http://www.linuxsecurity.com/content/view/147122 

* Mandriva: [ MDVSA-2009:004 ] pam_mount (Jan 9)
  ----------------------------------------------
  passwdehd script in pam_mount would allow local users to overwrite
  arbitrary files via a symlink attack on a temporary file. The updated
  packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/147121 

* Mandriva: [ MDVSA-2009:003 ] python (Jan 9)
  -------------------------------------------
  Multiple integer overflows in imageop.c in the imageop module in
  Python 1.5.2 through 2.5.1 allow context-dependent attackers to break
  out of the Python VM and execute arbitrary code via large integer
  values in certain arguments to the crop function, leading to a buffer
  overflow, a different vulnerability than CVE-2007-4965 and
  CVE-2008-1679. (CVE-2008-4864)

  Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6,
  allow context-dependent attackers to have an unknown impact via a
  large integer value in the tabsize argument to the expandtabs method,
  as implemented by (1) the string_expandtabs function in
  Objects/stringobject.c and (2) the unicode_expandtabs function in
  Objects/unicodeobject.c. NOTE: this vulnerability reportedly exists
  because of an incomplete fix for CVE-2008-2315. (CVE-2008-5031) The
  updated Python packages have been patched to correct these issues.

http://www.linuxsecurity.com/content/view/147120 

* Mandriva: Subject: [Security Announce] [ MDVSA-2009:001 ] openssl (Jan 8)
  -------------------------------------------------------------------------
  A vulnerability was found by the Google Security Team with how
  OpenSSL checked the verification of certificates.  An attacker in
  control of a malicious server or able to effect a man-in-the-middle
  attack, could present a malformed SSL/TLS signature from a
  certificate chain to a vulnerable client, which would then bypass the
  certificate validation (CVE-2008-5077). The updated packages have
  been patched to prevent this issue.

http://www.linuxsecurity.com/content/view/147117 

------------------------------------------------------------------------

* RedHat: Important: kernel security and bug fix update (Jan 14)
  --------------------------------------------------------------
  Updated kernel packages that resolve several security issues and fix
  various bugs are now available for Red Hat Enterprise Linux 4. This
  update has been rated as having important security impact by the Red
  Hat Security Response Team.

http://www.linuxsecurity.com/content/view/147166 

* RedHat: Critical: java-1.6.0-ibm security update (Jan 13)
  ---------------------------------------------------------
  Updated java-1.6.0-ibm packages that fix several security issues are
  now available for Red Hat Enterprise Linux 4 Extras and 5
  Supplementary. This update has been rated as having critical security
  impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/147150 

* RedHat: Critical: java-1.5.0-ibm security update (Jan 13)
  ---------------------------------------------------------
  Updated java-1.5.0-ibm packages that fix several security issues are
  now available for Red Hat Enterprise Linux 4 Extras and 5
  Supplementary. This update has been rated as having critical security
  impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/147151 

* RedHat: Moderate: squirrelmail security update (Jan 12)
  -------------------------------------------------------
  An updated squirrelmail package that resolves various security issues
  is now available for Red Hat Enterprise Linux 3, 4 and 5. This update
  has been rated as having moderate security impact by the Red Hat
  Security Response Team.

http://www.linuxsecurity.com/content/view/147133 

* RedHat: Moderate: avahi security update (Jan 12)
  ------------------------------------------------
  Updated avahi packages that fix a security issue are now available
  for Red Hat Enterprise Linux 5. This update has been rated as having
  moderate security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/147134 

* RedHat: Moderate: bind security update (Jan 8)
  ----------------------------------------------
  Updated Bind packages to correct a security issue are now available
  for Red Hat Enterprise Linux 2.1, 3, 4, and 5. A flaw was discovered
  in the way BIND checked the return value of the OpenSSL DSA_do_verify
  function. On systems using DNSSEC, a malicious zone could present a
  malformed DSA certificate and bypass proper certificate validation,
  allowing spoofing attacks. (CVE-2009-0025) This update has been rated
  as having moderate security impact by the Red Hat Security Response
  Team.

http://www.linuxsecurity.com/content/view/147114 

* RedHat: Important: kernel security update (Jan 8)
  -------------------------------------------------
  Updated kernel packages that fix a number of security issues are now
  available for Red Hat Enterprise Linux 2.1 running on 32-bit
  architectures. This update has been rated as having important
  security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/147112 

------------------------------------------------------------------------

* Slackware:   ntp (Jan 15)
  -------------------------
  New ntp packages are available for Slackware 8.1, 9.0, 9.1, 10.0,
  10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security
  issue.

http://www.linuxsecurity.com/content/view/147388 

* Slackware:   openssl (Jan 15)
  -----------------------------
  New openssl packages are available for Slackware 11.0, 12.0, 12.1,
  12.2, and -current to fix a security issue when connecting to an
  SSL/TLS server that uses a certificate containing a DSA or ECDSA key.

http://www.linuxsecurity.com/content/view/147389 

* Slackware:   bind (Jan 15)
  --------------------------
  New bind packages are available for Slackware 8.1, 9.0, 9.1, 10.0,
  10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix a security
  issue.

http://www.linuxsecurity.com/content/view/147387 

------------------------------------------------------------------------

* SuSE: Mozilla (SUSE-SA:2009:002) (Jan 14)
  -----------------------------------------
  Various Mozilla browser suite programs were updated to the last
  ecurity release.  The Mozilla Firefox 3.0.5 browser, Seamonkey 1.1.14
  and xulrunner190 update were already published before Christmas,
  please see SUSE-SA:2008:058.	Mozilla Firefox for older products was
  updated to 2.0.0.19 and Mozilla Thunderbird was updated to 2.0.0.19.
  Other packages received backports.

http://www.linuxsecurity.com/content/view/147156 

* SuSE: Sun Java (SUSE-SA:2009:001) (Jan 13)
  ------------------------------------------
  Sun Java received several security fixes.  Numerous security issues
  such as privilege escalations, and sandbox breakouts were fixed.

http://www.linuxsecurity.com/content/view/147149 

------------------------------------------------------------------------

* Ubuntu: HPLIP vulnerability (Jan 13)
  ------------------------------------
  It was discovered that an installation script in the HPLIP package
  would change permissions on the hplip config files located in user's
  home directories. A local user could exploit this and change
  permissions on arbitrary files upon an HPLIP installation or upgrade,
  which could lead to root privileges.

http://www.linuxsecurity.com/content/view/147148 

* Ubuntu:  CUPS vulnerabilities (Jan 12)
  --------------------------------------
  It was discovered that CUPS didn't properly handle adding a large
  number of RSS subscriptions. A local user could exploit this and
  cause CUPS to crash, leading to a denial of service. This issue only
  applied to Ubuntu 7.10, 8.04 LTS and 8.10. (CVE-2008-5183) It was
  discovered that CUPS did not authenticate users when adding and
  cancelling RSS subscriptions. An unprivileged local user could bypass
  intended restrictions and add a large number of RSS subscriptions.
  This issue only applied to Ubuntu 7.10 and 8.04 LTS. (CVE-2008-5184)
  It was discovered that the PNG filter in CUPS did not properly handle
  certain malformed images. If a user or automated system were tricked
  into opening a crafted PNG image file, a remote attacker could cause
  a denial of service or execute arbitrary code with user privileges.
  In Ubuntu 7.10, 8.04 LTS, and 8.10, attackers would be isolated by
  the AppArmor CUPS profile. (CVE-2008-5286) It was discovered that the
  example pstopdf CUPS filter created log files in an insecure way.
  Local users could exploit a race condition to create or overwrite
  files with the privileges of the user invoking the program. This
  issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS.
  (CVE-2008-5377)

http://www.linuxsecurity.com/content/view/147135 

------------------------------------------------------------------------

* Pardus: Bind: Spoofing (Jan 14)
  -------------------------------
  A vulnerability has been reported in ISC BIND, which potentially can
  be  exploited by malicious people to conduct spoofing attacks.

http://www.linuxsecurity.com/content/view/147163 

* Pardus: Ntp: Security Bypass (Jan 14)
  -------------------------------------
  NTP  does not  properly  check  the  return  value  from  the
  OpenSSL   EVP_VerifyFinal  function, which  allows  remote  attackers
   to  bypass  validation of the certificate chain via a malformed
  SSL/TLS  signature  for DSA and ECDSA keys.

http://www.linuxsecurity.com/content/view/147164 

* Pardus: audiofile: Heap Overflow (Jan 14)
  -----------------------------------------
  There is a bug in libaudiofile when  attempting  to  decode  the
  file,  libaudiofile writes past the buffer in msadpcm.c.

http://www.linuxsecurity.com/content/view/147165 

* Pardus: Openssl: Spoofing (Jan 14)
  ----------------------------------
  A vulnerability has been reported in OpenSSL, which can be exploited
  by  malicious people to conduct spoofing attacks.

http://www.linuxsecurity.com/content/view/147161 

* Pardus: Valgrind: Untrusted Path (Jan 14)
  -----------------------------------------
  Untrusted search path vulnerability in valgrind allows local	users
  to  execute arbitrary programs via a Trojan horse

http://www.linuxsecurity.com/content/view/147162 

* Pardus: Samba Security Bypass (Jan 8)
  -------------------------------------
  A security issue has been reported in Samba, which can be exploited
  by malicious users to bypass certain security restrictions.

http://www.linuxsecurity.com/content/view/147113 

------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc.                LinuxSecurity.com

To unsubscribe email vuln-newsletter-request@linuxsecurity.com 
         with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------


_______________________________________________      
Please help InfoSecNews.org with a donation!
http://www.infosecnews.org/donate.html 

Site design & layout copyright © 1986-2014 CodeGods