3Com patches wireless access point

There’s some wild goings on at this week’s Black Hat gathering in Las Vegas. Lawsuits are flying over what has been disclosed in one of the conference sessions:

Furor over Cisco IOS router exploit erupts at Black Hat

Although Cisco and Internet Security Systems had abruptly cancelled a planned technical talk and demo at the Black Hat Conference to reveal how unpatched Cisco routers can be remotely compromised, the researcher who had originally uncovered the problem went ahead with the talk anyway, igniting a spate of lawsuits against himself and the Black Hat Conference. Network World, 07/28/05.

http://www.networkworld.com/news/2005/072805-cisco-black-hat.html?nl

We’re hoping to have more on this legal tussle with Test Alliance member Rodney Thayer in Monday’s Network World Radio program.

Today’s bug patches and security alerts:

3Com patches wireless access point

3Com has released an update for its Office Connect Wireless 11g Access Point that fixes a flaw in the Web-based administrative interface. An attacker could exploit the flaw to gather device configuration information. For more, go to:

https://webprd1.3com.com/swd/jsp/user/index.jsp?id=OCWAP15

**********

FreeBSD, OpenPKG patch zlib

A flaw in the way zlib, a file compression/decompression utility, handles compressed files could be exploited to crash the application. For more, go to:

FreeBSD:

http://www.networkworld.com/go2/0725bug2a.html

OpenPKG:

https://www.openpkg.org/security/OpenPKG-SA-2005.014-zlib.html

**********

Linux vendors patch ClamAV

A number of integer overflows have been found in the ClamAV anti-virus application. An attacker could exploit these flaws using specially crafted files. The exploit could be used to run malicious code on the affected machine. For more, go to:

Gentoo:

https://security.gentoo.org/glsa/glsa-200507-25.xml

Mandriva:

https://www.mandriva.com/security/advisories?name=MDKSA-2005:125

**********

More Mozilla Suite, Firefox fixes available

A number of Linux vendors have released update for the Mozilla Suite and Firefox browser based on multiple flaws found in the underlying code for both applications. Attackers could gain elevated privileges by exploiting the flaws. For more, go to:

Gentoo (Mozilla Suite):

https://security.gentoo.org/glsa/glsa-200507-24.xml

Ubuntu (Firefox):

https://www.ubuntulinux.org/support/documentation/usn/usn-149-3

Ubuntu (Mozilla Suite):

https://www.ubuntulinux.org/support/documentation/usn/usn-155-1

**********

Gentoo, Mandriva release Shorewall packages

According to the Gentoo advisory, “A vulnerability in Shorewall allows clients authenticated by MAC address filtering to bypass all other security rules.” For more, go to:

Gentoo:

https://security.gentoo.org/glsa/glsa-200507-20.xml

Mandriva:

https://www.mandriva.com/security/advisories?name=MDKSA-2005:123

**********

Debian patches heartbeat

Heartbeat, a sub-system for High-Availability Linux, does not create temporary files in a secure fashion. An attacker could exploit this using a symlink attack. For more, go to:

https://www.debian.org/security/2005/dsa-761

Debian releases fix for affix

According to an alert from Debian, “Kevin Finisterre discovered two problems in the Bluetooth FTP client from affix, user space utilities for the Affix Bluetooth protocol stack.” For more, go to:

https://www.debian.org/security/2005/dsa-762

**********

Fedora issues krb5 patch

Two flaws in the MIT Kerberos 5 system (krb5) could be exploited to run arbitrary code on the affected machine. For more, go to:

https://www.securityfocus.com/archive/1/406384/30/30/threaded

**********

Gentoo, Ubuntu release fetchmail fixes

A buffer overflow in the popular fetchmail e-mail client could be exploited in a denial-of-service attack or to potentially execute arbitrary code. For more, go to:

Gentoo:

https://security.gentoo.org/glsa/glsa-200507-21.xml

Ubuntu:

https://www.ubuntulinux.org/support/documentation/usn/usn-153-1

**********

Today’s roundup of virus alerts:

W32/Sdbot-AAY — A new Sdbot variant that spreads through network shares and allows backdoor access via IRC. It drops “edit.exe” and “RDRIV.SYS” on the infected host. (Sophos)

W32/Sdbot-ZO — Our second Sdbot worm of the day drops “burndl32.exe” in the infected machine’s Windows System folder. It too allows backdoor access via IRC. (Sophos)

W32/Sdbot-ABI — Sdbot number three for today has similar capabilities to its predecessors. Its main differentiating characteristic is the file it drops: “clipserv.exe”. (Sophos)

W32/Mytob-HM — This new Mytob e-mail worm can allow backdoor access through IRC. It drops “yahooicons.exe” on the target host when a recipient opens the infected attachment, which is usually a double extension file. (Sophos)

W32/Mytob-DW — Another Mytob e-mail worm variant. This one tries to exploit the Windows LSASS vulnerability in its attempt to penetrate a host. It installs itself as “taskgmr.exe” in the Windows System directory. (Sophos)

W32/Mytob-BV — Yet another Mytob variant. This one spreads through e-mails that look like some sort of account warning from a system administrator. The attached file usually has a double extension to fool users. When executed, Mytob-BV drops “TimeManager.exe” in the Windows System folder. (Sophos)

W32/Mytob-DX — The fourth Mytob variant of the day drops two files in the Windows System folder: “taskgmr32.exe” and “winnet32.exe”. It too allows backdoor access through IRC and limits access to security Web sites by modifying the Windows HOSTS file. (Sophos)

Troj/Mdrop-F — A Trojan that drops “veja_fotos.exe” in a temporary folder. No word on how it spreads. (Sophos)

Troj/Myftu-H — A password-stealing Trojan that sends its bounty via HTTP. The key file that it drops on the infected host is “cMovie.exe” in the Program Files folder. (Sophos)

W32/Rbot-AJA — An Rbot variant designed to steal information from the infected host and participate in Internet-based denial-of-service attacks. It spreads through network shares by exploiting a number of known Windows vulnerabilities, all of which have patches available. (Sophos)

Riot Immort-51 — An old-school DOS virus that infects COM files. It may display the message “iMMoRTaL.510 Encrypted!!}” (Sophos)

W32/Randon-AO — A Trojant that tries to exploit the Windows LSASS vulnerability as it spreads through network shares. It drops a number of files on its host and can provide backdoor access via IRC channels. (Sophos)

Troj/Bancban-DY — Another worm that targets the username and password data for Brazilian banking sites. It sends the collected data to a predefined Web site. (Sophos)

**********

From the interesting reading department:

Threat alert highlights vulnerabilities in backup software

The SANS Institute Monday reported 422 new Internet security vulnerabilities discovered during the second quarter, up nearly 11% from the first quarter, with weaknesses in popular backup software highlighting the report. NetworkWorld.com, 07/25/05.

http://www.networkworld.com/news/2005/072505-backup.html?nl