FEATURE: Building a Virtual Honeynet - Hisham shares his experiences with building a virtual honeynet on his existing Linux box. He describes data capture and control techniques, the types of honeynets, and configuration changes to get one running on your system.

http://www.linuxsecurity.com/feature_stories/feature_story-100.html
 

FREE Apache SSL Guide from Thawte  Planning Web Server Security? Find out how to implement SSL! Get the free Thawte Apache SSL Guide and find the answers to all your Apache SSL security issues and more at:

http://www.gothawte.com/rd182.html
 
 

Vendor	Product
cups	Mandrake
snmp	Mandrake
hanterm	Debian
uucp	Caldera, Conectiva
ncurses	Debian, Red Hat
squid	FreeBSD, squid
gnujsp	Debian

 

Why be vulnerable? Its your choice. - Are you looking for a solution that provides the applications necessary to easily create thousands of virtual Web sites, manage e-mail, DNS, firewalling database functions for an entire organization, and supports high-speed broadband connections all using a Web-based front-end? EnGarde Secure Professional provides those features and more!
 
Linux Advisory Watch is a comprehensive newsletter that outlines the security vulnerabilities that have been announced throughout the week.It includes pointers to updated packages and descriptions of each vulnerability.

cups

There is a potential buffer overflow vulnerability in CUPS when reading the names of attributes.  This bug affects all versions of CUPS and is fixed upstream in version 1.1.14.

Mandrake Linux 8.1:
8.1/RPMS/cups-1.1.10-9.1mdk.i586.rpm
25b44ff88d1cc95387827526b576dfcd
 
8.1/RPMS/cups-common-1.1.10-9.1mdk.i586.rpm
27718fa74c9d1af3a282295546c88444

8.1/RPMS/cups-serial-1.1.10-9.1mdk.i586.rpm
8f2f1fcf331dfdd38e8222c1c1b5159f

8.1/RPMS/libcups1-1.1.10-9.1mdk.i586.rpm
a9ee9e6c95cfe25ef465247717d49429

8.1/RPMS/libcups1-devel-1.1.10-9.1mdk.i586.rpm
43c5a9bd5e6b1fb40958986201bd00a7

http://www.mandrakesecure.net/en/ftp.php

Mandrake Vendor Advisory:
http://www.linuxsecurity.com/advisories/mandrake_advisory-1898.html

snmp

The Oulu University Secure Programming Group (OUSPG) has identified numerous vulnerabilities in multiple vendor SNMPv1 implementations.  These vulnerabilities may allow unauthorized privileged access, denial of service attacks, or unstable behaviour.

Mandrake Linux 8.1:
8.1/RPMS/libsnmp0-4.2.3-1.1mdk.i586.rpm
f35c85a83c83019da401f960a17820a7

8.1/RPMS/libsnmp0-devel-4.2.3-1.1mdk.i586.rpm
ec1674b1a01486383218fec8d3bdeaa2

8.1/RPMS/ucd-snmp-4.2.3-1.1mdk.i586.rpm
c1bbbce3d1edeb366af8207476f8bba4

8.1/RPMS/ucd-snmp-utils-4.2.3-1.1mdk.i586.rpm
ec1118634eb28a4f78a37c7dcbb4b122
 
http://www.mandrakesecure.net/en/ftp.php

Mandrake Vendor Advisory:
http://www.linuxsecurity.com/advisories/mandrake_advisory-1897.html

hanterm

A set of buffer overflow problems have been found in hanterm, a Hangul terminal for X11 derived from xterm, that will read and display Korean characters in its terminal window.  The font handling code in hanterm uses hard limited string variables but didn't check for boundaries.

Intel ia32 architecture:
http://security.debian.org/dists/stable/updates/main/
binary-i386/hanterm_3.3.1p17-5.2_i386.deb
MD5 checksum: 26f7bfa946ded30fdb9a1bf6a22558d7

Debian Vendor Advisory:
http://www.linuxsecurity.com/advisories/debian_advisory-1899.html

uucp

UUCP is a Unix to Unix transfer mechanism. It is used primarily for remote sites to download and upload email and news files to local machines.

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/
uucp-1.06.2-10U70_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/
uucp-cu-1.06.2-10U70_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/
uucp-doc-1.06.2-10U70_1cl.i386.rpm

Conectiva Vendor Advisory:
http://www.linuxsecurity.com/advisories/other_advisory-1900.html

Caldera Vendor Advisory:
http://www.linuxsecurity.com/advisories/caldera_advisory-1903.html

ncurses

Several buffer overflows were fixed in the "ncurses" library in November 2000.  Unfortunately, one was missed.  This can lead to crashes when using ncurses applications in large windows.

Debian Intel ia32 architecture:
http://security.debian.org/dists/potato/updates/main/
binary-i386/libncurses5-dbg_5.0-6.0potato2_i386.deb
MD5 checksum: 5c43981090144c8c19d37f455056dac9
 
http://security.debian.org/dists/potato/updates/main/
binary-i386/libncurses5-dev_5.0-6.0potato2_i386.deb
MD5 checksum: 476bd2329a991423df2fadf7097c710a
 
http://security.debian.org/dists/potato/updates/main/
binary-i386/libncurses5_5.0-6.0potato2_i386.deb
MD5 checksum: ca7e31dc8bb7b2132732749a08ef520b
 
http://security.debian.org/dists/potato/updates/main/
binary-i386/ncurses-bin_5.0-6.0potato2_i386.deb
MD5 checksum: 2029230b29eab7e755b0a533eff7fe10

Debian Vendor Advisory:
http://www.linuxsecurity.com/advisories/debian_advisory-1901.html

Red Hat Vendor Advisory:
http://www.linuxsecurity.com/advisories/redhat_advisory-1907.html

squid

An attacker with the ability to send packets to the Squid SNMP port can cause Squid to run out of memory and crash. (NOTE: The FreeBSD port does not have SNMP enabled by default.)

FreeBSD:  PLEASE SEE VENDOR ADVISORY

FreeBSD Vendor Advisory:
http://www.linuxsecurity.com/advisories/freebsd_advisory-1904.html


General Squid Vendor Advisory:
http://www.linuxsecurity.com/advisories/other_advisory-1906.html

gnujsp

Thomas Springer found a vulnerability in GNUJSP, a Java servlet that allows you to insert Java source code into HTML files.  The problem can be used to bypass access restrictions in the web server.  An attacker can view the contents of directories and download files directly rather then receiving their HTML output.  This means that the source code of scripts could also be revealed.

Debian Architecture independent components:
http://security.debian.org/dists/stable/updates/
contrib/binary-all/gnujsp_1.0.0-5_all.deb
MD5 checksum: 1e88d28cf4898287c55a2b2f2465cb84

Debian Vendor Advisory:
http://www.linuxsecurity.com/advisories/caldera_advisory-1905.html