AOH :: ISNQ5979.HTM
Linux Advisory Watch: February 26th, 2010
|
Linux Advisory Watch: February 26th, 2010
Linux Advisory Watch: February 26th, 2010
+----------------------------------------------------------------------+
| LinuxSecurity.com Linux Advisory Watch |
| February 26th, 2010 Volume 11, Number 9 |
| |
| Editorial Team: Dave Wreski |
| Benjamin D. Thomas |
+----------------------------------------------------------------------+
Thank you for reading the Linux Advisory Watch Security Newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's vendor security bulletins and pointers on
methods to improve the security posture of your open source system.
Vulnerabilities affect nearly every vendor virtually every week, so
be sure to read through to find the updates your distributor have
made available.
Measuring Security IT Success
-----------------------------
In a time where budgets are constrained and Internet threats are on the
rise, it is important for organizations to invest in network security
applications that will not only provide them with powerful
functionality but also a rapid return on investment.
http://www.linuxsecurity.com/content/view/118817
Buffer Overflow Basics
----------------------
A buffer overflow occurs when a program or process tries to store more
data in a temporary data storage area than it was intended to hold.
Since buffers are created to contain a finite amount of data, the extra
information can overflow into adjacent buffers, corrupting or
overwriting the valid data held in them.
http://www.linuxsecurity.com/content/view/119087
--> Take advantage of the LinuxSecurity.com Quick Reference Card! <--
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <--
------------------------------------------------------------------------
* EnGarde Secure Community 3.0.22 Now Available! (Dec 9)
------------------------------------------------------
Guardian Digital is happy to announce the release of EnGarde Secure
Community 3.0.22 (Version 3.0, Release 22). This release includes
many updated packages and bug fixes and some feature enhancements to
the EnGarde Secure Linux Installer and the SELinux policy.
http://www.linuxsecurity.com/content/view/145668
------------------------------------------------------------------------
* Debian: Linux 2.6.18 several vulnerabilities (Feb 22)
-----------------------------------------------------
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a denial of service or privilege escalation. The Common
Vulnerabilities and Exposures project identifies the following
problems:
http://www.linuxsecurity.com/content/view/151755
* Debian: polipo denial of service (Feb 19)
-----------------------------------------
Several denial of service vulnerabilities have been discovered in
polipo, a small, caching web proxy. The Common Vulnerabilities and
Exposures project identifies the following problems:
http://www.linuxsecurity.com/content/view/151740
* Debian: php5 multiple vulnerabilities (Feb 19)
----------------------------------------------
Several remote vulnerabilities have been discovered in PHP 5, an
hypertext preprocessor. The Common Vulnerabilities and Exposures
project identifies the following problems:
http://www.linuxsecurity.com/content/view/151739
* Debian: ffmpeg several vulnerabilities (Feb 18)
-----------------------------------------------
Several vulnerabilities have been discovered in ffmpeg, a multimedia
player, server and encoder, which also provides a range of multimedia
libraries used in applications like MPlayer:
http://www.linuxsecurity.com/content/view/151736
* Debian: xulrunner several vulnerabilities (Feb 18)
--------------------------------------------------
Several remote vulnerabilities have been discovered in Xulrunner, a
runtime environment for XUL applications, such as the Iceweasel web
browser. The Common Vulnerabilities and Exposures project identifies
the following problems:
http://www.linuxsecurity.com/content/view/151734
------------------------------------------------------------------------
* Mandriva: 2010:050: apache-mod_security (Feb 26)
------------------------------------------------
This release fixes several important issues to help prevent a
detection bypass and denial of service attacks against ModSecurity.
Quite a few small but notable bugs were fixed. The latest Core
Ruleset (2.0.5) is included. [More...]
http://www.linuxsecurity.com/content/view/151785
* Mandriva: 2010:049: sudo (Feb 25)
---------------------------------
A vulnerabilitiy has been found and corrected in sudo: sudo 1.6.x
before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is
enabled, permits a match between the name of the pseudo-command and
the name of an executable file in an arbitrary [More...]
http://www.linuxsecurity.com/content/view/151781
* Mandriva: 2010:048: roundcubemail (Feb 25)
------------------------------------------
Roundcube 0.3.1 and earlier does not request that the web browser
avoid DNS prefetching of domain names contained in e-mail messages,
which makes it easier for remote attackers to determine the network
location of the webmail user by logging DNS requests (CVE-2010-0464).
[More...]
http://www.linuxsecurity.com/content/view/151780
* Mandriva: 2010:047: fuse (Feb 23)
---------------------------------
A race condition has been found in fuse that could escalate
privileges for local users and lead to a DoS (Denial of Service)
(CVE-2009-3297). The updated packages have been patched to correct
this issue. [More...]
http://www.linuxsecurity.com/content/view/151766
* Mandriva: 2010:046: ncpfs (Feb 23)
----------------------------------
A vulnerability has been found in ncpfs which can be exploited by
local users to disclose potentially sensitive information, cause a
DoS (Denial of Service), and potentially gain escalated privileges
(CVE-2009-3297). [More...]
http://www.linuxsecurity.com/content/view/151765
* Mandriva: 2010:045: php (Feb 23)
--------------------------------
A vulnerability has been found and corrected in php: PHP before
5.2.12 does not properly handle session data, which has unspecified
impact and attack vectors related to (1) interrupt corruption of the
SESSION superglobal array and (2) the [More...]
http://www.linuxsecurity.com/content/view/151758
* Mandriva: mysql (Feb 19)
------------------------
A vulnerabilitiy has been found and corrected in mysql: MySQL is
vulnerable to a symbolic link attack when the data home directory
contains a symlink to a different filesystem which allows remote
authenticated users to bypass intended access restrictions
http://www.linuxsecurity.com/content/view/151748
* Mandriva: blogtk (Feb 19)
-------------------------
The blogtk package in 2010.0 was crashing on start. This update fixes
the problem by updating blogtk to the latest version. Additionally
the python-gdata packages are being provided as well due to
requirements.
http://www.linuxsecurity.com/content/view/151747
* Mandriva: libtheora (Feb 19)
----------------------------
A vulnerability have been discovered and corrected in libtheora:
Integer overflow in libtheora in Xiph.Org Theora before 1.1 allows
remote attackers to cause a denial of service (application crash) or
possibly execute arbitrary code via a video with large dimensions
http://www.linuxsecurity.com/content/view/151746
* Mandriva: firefox (Feb 19)
--------------------------
Security issues were identified and fixed in firefox 3.0.x and 3.5.x:
Mozilla developers identified and fixed several stability bugs in the
browser engine used in Firefox and other Mozilla-based products. Some
of these crashes showed evidence of memory corruption under certain
http://www.linuxsecurity.com/content/view/151741
* Mandriva: xdg-utils (Feb 18)
----------------------------
This update enables files to be properly attached when xdg-email is
used with Thunderbird as the default mail client.
http://www.linuxsecurity.com/content/view/151735
* Mandriva: dhcp (Feb 18)
-----------------------
The DHCP client ignores the interface-mtu option set by server. This
update fixes the issue.
http://www.linuxsecurity.com/content/view/151733
* Mandriva: kernel (Feb 18)
-------------------------
Some vulnerabilities were discovered and corrected in the Linux 2.6
kernel: Array index error in the gdth_read_event function in
drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows
local users to cause a denial of service or possibly gain privileges
http://www.linuxsecurity.com/content/view/151732
* Mandriva: mdkonline (Feb 18)
----------------------------
The new mdkonline packages adds the extended maintenance support to
mdkonline. Packages for 2008.0 are provided for Corporate Desktop
2008.0 customers as well as for official 2008.0 updates.
http://www.linuxsecurity.com/content/view/151731
* Mandriva: kernel (Feb 18)
-------------------------
Some vulnerabilities were discovered and corrected in the Linux 2.6
kernel: Array index error in the gdth_read_event function in
drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows
http://www.linuxsecurity.com/content/view/151728
* Mandriva: pidgin (Feb 18)
-------------------------
Multiple security vulnerabilities has been identified and fixed in
pidgin: Certain malformed SLP messages can trigger a crash because
the MSN protocol plugin fails to check that all pieces of the message
are set correctly (CVE-2010-0277). In a user in a multi-user chat
http://www.linuxsecurity.com/content/view/151727
------------------------------------------------------------------------
* RedHat: sudo (Feb 26)
---------------------
An updated sudo package that fixes two security issues is now
available for Red Hat Enterprise Linux 5. This update has been rated
as having important security impact by the Red Hat Security Response
Team.
http://www.linuxsecurity.com/content/view/151784
* RedHat: acroread security and bug fix update (Feb 18)
-----------------------------------------------------
Updated acroread packages that fix two security issues and a bug are
now available for Red Hat Enterprise Linux 4 Extras and Red Hat
Enterprise Linux 5 Supplementary. This update has been rated as
having critical security impact by the Red Hat Security Response
Team.
http://www.linuxsecurity.com/content/view/151729
* RedHat: pidgin (Feb 18)
-----------------------
Updated pidgin packages that fix three security issues are now
available for Red Hat Enterprise Linux 4 and 5. This update has been
rated as having moderate security impact by the Red Hat Security
Response Team.
http://www.linuxsecurity.com/content/view/151730
------------------------------------------------------------------------
* SuSE: Linux kernel (Feb 18)
---------------------------
http://www.linuxsecurity.com/content/view/151737
------------------------------------------------------------------------
* Ubuntu: 903-1: OpenOffice.org vulnerabilities (Feb 24)
------------------------------------------------------
It was discovered that the XML HMAC signature system did not
correctly check certain lengths. If an attacker sent a truncated
HMAC, it could bypass authentication, leading to potential privilege
escalation. (CVE-2009-0217) [More...]
http://www.linuxsecurity.com/content/view/151767
* Ubuntu: Pidgin vulnerabilities (Feb 22)
----------------------------------------
Fabian Yamaguchi discovered that Pidgin incorrectly validated all
fields of an incoming message in the MSN protocol handler. A remote
attacker could send a specially crafted message and cause Pidgin to
crash, leading to a denial of service. (CVE-2010-0277)
http://www.linuxsecurity.com/content/view/151750
* Ubuntu: XML-RPC for C and C++ vulnerabilities (Feb 18)
-------------------------------------------------------
USN-890-1 fixed vulnerabilities in Expat. This update provides the
corresponding updates for XML-RPC for C and C++. Original advisory
details: Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered
that Expat did not properly process malformed XML. If a user or
http://www.linuxsecurity.com/content/view/151738
------------------------------------------------------------------------
* Pardus: Kernel: Multiple Vulnerabilities (Feb 24)
-------------------------------------------------
Multiple vulnerabilities have been fixed in kernel, which can
be exploited by malicious people to cause denial of service, or
possibly arbitrary code execution.
http://www.linuxsecurity.com/content/view/151776
* Pardus: Flashplugin: Multiple (Feb 24)
--------------------------------------
Multiple vulnerabilities have been fixed in Flashplugin, which can
be used by malicious people to possibly 1) cause denial of service
2) make cross domain requests
http://www.linuxsecurity.com/content/view/151777
* Pardus: Alsa: Denial of Service (Feb 24)
----------------------------------------
A vulnerability has been fixed in Kernel, which can be exploited
by malicious people to crash kernel due to divide by zero
in azx_position_ok
http://www.linuxsecurity.com/content/view/151778
* Pardus: Pidgin: Multiple Vulnerabilities (Feb 24)
-------------------------------------------------
Multiple vulnerabilities have been fixed in Pidgin, which can be used
by malicious people to cause denial of service.
http://www.linuxsecurity.com/content/view/151779
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request@linuxsecurity.com
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
___________________________________________________________
Register now for HITBSecConf2010 - Dubai, the premier
deep-knowledge network security event in the GCC,
featuring keynote speakers John Viega and Matt Watchinski!
http://conference.hitb.org/hitbsecconf2010dxb/
Site design & layout copyright © 1986- CodeGods