----------------------------------------
This Issue is Sponsored by: SecureWave
Free Pod Slurping Whitepaper - Stop Data Theft Now
The 4 most important steps your organization should take to prevent data loss via ipods, mp3 players or any other removable usb devices.
http://newsletter.industrybrains.com/c?fe;1;633a9;16eaa;2ce;0;da4
------------------------------------------------------------------
I. FRONT AND CENTER
1. All I Want For Christmas
2. Password Management Concerns with IE and Firefox, part two
II. LINUX VULNERABILITY SUMMARY
1. Linux Kernel Multiple Vulnerabilities
2. D-Bus Signals.C Local Denial of Service Vulnerability
3. Fully Automated Installation Administrator Hashed Password Information Disclosure Vulnerability
4. Linux Kernel Robust_List Local Denial of Service Vulnerability
5. ProFTPD Controls Module Local Buffer Overflow Vulnerability
6. Linux Kernel Do_Coredump Security Bypass Vulnerability
7. McAfee VirusScan For Linux Insecure DT_RPATH Remote Code Execution Vulnerability
8. GNOME Display Manager GDMChooser Local Format String Vulnerability
9. Linux Kernel Bluetooth CAPI Packet Remote Buffer Overflow Vulnerability
10. Clam Anti-Virus Attachment Wrapping Denial Of Service Vulnerability
11. Multiple BitDefender Products Parsing Engine Integer Overflow Vulnerability
12. SQL-Ledger Unspecified Code Execution Vulnerability
13. IBM DB2 Remote SQLJRA Packet Denial of Service Vulnerability
14. Linux Kernel MinCore User Space Access Locking Local Denial of Service Vulnerability
15. Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities
III. LINUX FOCUS LIST SUMMARY
1. HITBSecConf2007 - Dubai - Call for Papers now open!
2. Pandora FMS 1.2 released
3. Selecting OS for High-availability/mission-critical web portal
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. All I Want For Christmas
By Mark Rasch
Mark Rasch takes a step back and offers his holiday and New Year's wish list of all things security - items that should exist, be made available and be easy to use for everyone over the coming year.
http://www.securityfocus.com/columnists/426
2. Password Management Concerns with IE and Firefox, part two
By Mikhael Felker
This two-part paper presents an analysis of the security mechanisms, risks, attacks, and defenses of the two most commonly used password management systems for web browsers, found in Internet Explorer and Firefox. The article specifically addresses IE 6 and 7 and Firefox 1.5 and 2.0.
http://www.securityfocus.com/infocus/1883
II. LINUX VULNERABILITY SUMMARY
------------------------------------
1. Linux Kernel Multiple Vulnerabilities
BugTraq ID: 21523
Remote: No
Date Published: 2006-12-10
Relevant URL: http://www.securityfocus.com/bid/21523
Summary:
Linux Kernel is prone to multiple vulnerabilities that can allow local attackers to carry out various attacks, including denial-of-service attacks.
Kernel 2.6.8 and prior versions are reported affected.
2. D-Bus Signals.C Local Denial of Service Vulnerability
BugTraq ID: 21571
Remote: No
Date Published: 2006-12-13
Relevant URL: http://www.securityfocus.com/bid/21571
Summary:
D-Bus is prone to a local denial-of-service vulnerability.
Exploiting this issue allows local attackers to disable the ability of a specific process to receive certain messages, effectively denying service to legitimate users.
D-Bus versions prior to 1.0.2 are vulnerable to this issue.
3. Fully Automated Installation Administrator Hashed Password Information Disclosure Vulnerability
BugTraq ID: 21579
Remote: No
Date Published: 2006-12-13
Relevant URL: http://www.securityfocus.com/bid/21579
Summary:
Fully Automated Installation (FAI) is prone to a local information-disclosure vulnerability because the application fails to protect sensitive information from unprivileged users.
An attacker can exploit this issue to gain access to sensitive information that may lead to other attacks.
This issue affects versions 2.1.0 and 3.1.2; other versions may also be affected.
4. Linux Kernel Robust_List Local Denial of Service Vulnerability
BugTraq ID: 21582
Remote: No
Date Published: 2006-12-13
Relevant URL: http://www.securityfocus.com/bid/21582
Summary:
The Linux kernel is prone to a local denial-of-service vulnerability.
An attacker can exploit this issue to cause the kernel to hang, denying further service to legitimate users.
5. ProFTPD Controls Module Local Buffer Overflow Vulnerability
BugTraq ID: 21587
Remote: No
Date Published: 2006-12-13
Relevant URL: http://www.securityfocus.com/bid/21587
Summary:
ProFTPD is prone to a local stack-based buffer-overflow vulnerability.
Attackers may exploit this issue to corrupt memory and execute arbitrary code in the context of the server application, resulting in a complete compromise of affected computers.
NOTE: ProFTPD is vulnerable only when compiled with 'mod_ctrls' support and the module is enabled.
6. Linux Kernel Do_Coredump Security Bypass Vulnerability
BugTraq ID: 21591
Remote: No
Date Published: 2006-12-14
Relevant URL: http://www.securityfocus.com/bid/21591
Summary:
Linux Kernel is prone to a vulnerability that can allow local unauthorized attackers to modify certain files.
Kernel versions prior to 2.6.19.1 are vulnerable.
7. McAfee VirusScan For Linux Insecure DT_RPATH Remote Code Execution Vulnerability
BugTraq ID: 21592
Remote: Yes
Date Published: 2006-12-14
Relevant URL: http://www.securityfocus.com/bid/21592
Summary:
McAfee VirusScan for Linux is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with the privileges of the process invoking VirusScan.
McAfee VirusScan 4510e and prior versions are vulnerable to this issue.
8. GNOME Display Manager GDMChooser Local Format String Vulnerability
BugTraq ID: 21597
Remote: No
Date Published: 2006-12-14
Relevant URL: http://www.securityfocus.com/bid/21597
Summary:
GNOME Display Manager (GDM) is prone to a local format-string vulnerability because it fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.
A local attacker may exploit this issue to execute arbitrary machine code in the context of the affected application.
9. Linux Kernel Bluetooth CAPI Packet Remote Buffer Overflow Vulnerability
BugTraq ID: 21604
Remote: Yes
Date Published: 2006-12-14
Relevant URL: http://www.securityfocus.com/bid/21604
Summary:
The Linux kernel is prone to a remote buffer-overflow vulnerability because the kernel fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker may exploit this issue to execute arbitrary code with kernel-level privileges, facilitating the complete compromise of affected computers. Failed exploit attempts will result in denial-of-service conditions.
Versions prior to 2.4.33.5 are vulnerable to this issue.
10. Clam Anti-Virus Attachment Wrapping Denial Of Service Vulnerability
BugTraq ID: 21609
Remote: Yes
Date Published: 2006-12-15
Relevant URL: http://www.securityfocus.com/bid/21609
Summary:
ClamAV is prone to a denial-of-service vulnerability because it fails to handle specific multipart attachments.
A successful exploit of this issue will cause the application to crash, resulting in a denial-of-service condition.
This issue affects version 0.88.6 and earlier.
11. Multiple BitDefender Products Parsing Engine Integer Overflow Vulnerability
BugTraq ID: 21610
Remote: Yes
Date Published: 2006-12-15
Relevant URL: http://www.securityfocus.com/bid/21610
Summary:
Multiple BitDefender products are prone to an integer-overflow vulnerability because the application fails to ensure that integer values are not overrun.
An attacker can exploit this issue to execute arbitrary code with administrative privileges, facilitating the complete compromise of the affected application. Failed exploit attempts will result in a denial of service.
12. SQL-Ledger Unspecified Code Execution Vulnerability
BugTraq ID: 21634
Remote: Yes
Date Published: 2006-12-18
Relevant URL: http://www.securityfocus.com/bid/21634
Summary:
SQL-Ledger is prone to a remote unspecified code-execution vulnerability.
An attacker could exploit this issue to execute arbitrary code in the context of the affected application. This could lead to the compromise of a vulnerable system.
SQL-Ledger 2.6 and prior versions are vulnerable; other versions may also be affected.
13. IBM DB2 Remote SQLJRA Packet Denial of Service Vulnerability
BugTraq ID: 21646
Remote: Yes
Date Published: 2006-12-18
Relevant URL: http://www.securityfocus.com/bid/21646
Summary:
DB2 Universal Database is affected by a remote denial-of-service vulnerability because the application fails to properly handle malformed packets in CONNECT data streams.
An attacker can exploit this vulnerability to cause a denial-of-service condition in affected database servers.
14. Linux Kernel MinCore User Space Access Locking Local Denial of Service Vulnerability
BugTraq ID: 21663
Remote: No
Date Published: 2006-12-19
Relevant URL: http://www.securityfocus.com/bid/21663
Summary:
The Linux Kernel is prone to a denial-of-service vulnerability due to a design error.
A local attacker can exploit this issue to cause the kernel to become unresponsive, denying further service to legitimate users.
Linux Kernel versions prior to 2.4.33.6 are vulnerable.
15. Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities
BugTraq ID: 21668
Remote: Yes
Date Published: 2006-12-19
Relevant URL: http://www.securityfocus.com/bid/21668
Summary:
The Mozilla Foundation has released nine security advisories specifying vulnerabilities in Firefox, SeaMonkey, and Thunderbird.
These vulnerabilities allow attackers to:
- execute arbitrary code
- perform cross-site scripting attacks
- inject arbitrary content
- gain escalated privileges
- crash affected applications and potentially execute arbitrary code.
Other attacks may also be possible.
III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. HITBSecConf2007 - Dubai - Call for Papers now open!
http://www.securityfocus.com/archive/91/454801
2. Pandora FMS 1.2 released
http://www.securityfocus.com/archive/91/454078
3. Selecting OS for High-availability/mission-critical web portal
http://www.securityfocus.com/archive/91/453320
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.
V. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: SecureWave
Free Pod Slurping Whitepaper - Stop Data Theft Now
The 4 most important steps your organization should take to prevent data loss via ipods, mp3 players or any other removable usb devices.
http://newsletter.industrybrains.com/c?fe;1;633a9;16eaa;2ce;0;da4
No comments:
Post a Comment