Linux Advisory Watch is a comprehensive newsletter that outlines the security vulnerabilities that have been announced throughout the week.  It includes pointers to updated packages and descriptions of each vulnerability.

Newsletter Subscription Information: Subscribe!

OpenDoc Publishing
Our sponsor this week is OpenDoc Publishing.  Their 480-page comprehensive security book, Securing and Optimizing Linux, takes a hands-on approach to installing, optimizing, configuring, and securing Red Hat Linux. Topics include sendmail 8.10.1, OpenSSL,   ApacheSSL, OpenSSH and much more! Includes Red Hat 6.2 and Red Hat 6.2 PowerTools edition.

http://www.linuxsecurity.com/sponsors/opendocs.html

FreeBSD: 'netscape' ports vulnerability - 11/07/2000

Remote attackers can execute arbitrary code on the local system by convincing users to visit a malicious website.  Versions of netscape prior to 4.76 allow a client-side exploit through
a buffer overflow in html code. A malicious website operator can cause arbitrary code to be executed by the user running the netscape client.

Updated Package:
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/

Vendor Advisory:
-> http://www.linuxsecurity.com/advisories/freebsd_advisory-855.html
 
 

Local users can monitor and control the contents of the X display running xfce, as well as input devices such as mice and keyboards.

Updated Package:
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/x11-wm/xfce-3.12.tgz

Vendor Advisory:
-> http://www.linuxsecurity.com/advisories/freebsd_advisory-854.html
 

If the 'htags -f' command is used to generate a CGI script which is then installed under a webserver, then remote users may execute arbitrary commands on the local system as the user which runs the CGI script. If you have not chosen to install the global port/package, or you have not used the 'htags -f' command to produce a CGI script, then your system is not vulnerable to this problem.

Updated Package:
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/global-4.0.1.tgz

Vendor Advisory:
-> http://www.linuxsecurity.com/advisories/freebsd_advisory-853.html
 
 

Local users can read privileged data from kernel memory which may provide information allowing them to further increase their local or remote system access privileges.

Updated Package:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:62/top.patch.v1.1

Vendor Advisory:
-> http://www.linuxsecurity.com/advisories/freebsd_advisory-852.html
 

Remote users can cause the local tcpdump process to crash, and (under FreeBSD 4.0-RELEASE, 4.1-RELEASE, 4.1.1-RELEASE and 4.1.1-STABLE prior to the correction date) may be able to cause arbitrary code to be executed as the user running tcpdump, usually root.

Updated Package:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:61/tcpdump-4.x.patch.v1.1

Vendor Advisory:
-> http://www.linuxsecurity.com/advisories/freebsd_advisory-851.html

RedHat: 'usermode' format-string vulnerability - 11/09/2000

The usermode package contains a binary (/usr/bin/userhelper), which is used to control access to programs which are to be executed as root.  Because programs invoked by userhelper are not actually running setuid-root, security measures built into recent versions of glibc are not active.

Red Hat Linux 6.2:

alpha:
ftp://updates.redhat.com/6.2/alpha/usermode-1.37-1.6.alpha.rpm
MD5 Checksum:  978af994a09fcbc4bf1cb2fa2723bfe7

ftp://updates.redhat.com/6.2/alpha/SysVinit-2.78-5.alpha.rpm
MD5 Checksum:  546bf7949c5be73b9f28b1819bfbd7c6

sparc:
ftp://updates.redhat.com/6.2/sparc/usermode-1.37-1.6.sparc.rpm
MD5 Checksum:  ba94a59a3a8195346735f202f28af3f8

ftp://updates.redhat.com/6.2/sparc/SysVinit-2.78-5.sparc.rpm
MD5 Checksum:  4dfeacb8db12af4b2666f2792e1027c1

i386:
ftp://updates.redhat.com/6.2/i386/usermode-1.37-1.6.i386.rpm
MD5 Checksum:  e8fe2db6f95348a93a373673b1c87443

ftp://updates.redhat.com/6.2/i386/SysVinit-2.78-5.i386.rpm
MD5 Checksum:  ca5b97a1abb47b64d71ef69ab96fcb8a
 

Red Hat Linux 7.0:

i386:
ftp://updates.redhat.com/7.0/i386/usermode-1.37-2.i386.rpm
MD5 Checksum:  c32888b6f362b04f8a3805d4465c042a

Vendor Advisory:
-> http://www.linuxsecurity.com/advisories/redhat_advisory-856.html
 

Trustix: 'dump' vulnerability - 11/4/2000

All released versions of Trustix Secure Linux contain a version of dump that is known to have a local root exploit.  People with untrusted local users should upgrade as soon as possible.

Package Name: dump-0.4b19-2tr.i586.rpm
ftp://ftp.trustix.com/pub/Trustix/updates/1.1/RPMS/
MD5 Checksum: fd266c1a6a8a5d2ab9b65fc0f9affc32

Pacakge Name: rmt-0.4b19-2tr.i586.rpm
ftp://ftp.trustix.com/pub/Trustix/updates/1.1/RPMS/
MD5 Checksum: a1429d8d752e0cbff0154b0c3ff90b0c

Vendor Advisory:
-> http://www.linuxsecurity.com/advisories/other_advisory-850.html