CERT warns of ISC DHCP 3 flaws

Today’s bug patches and security alerts:

CERT warns of multiple vulnerabilities in ISC DHCP 3

Two potential buffer overflow flaws have been found in the Internet Systems Consortium’s (ISC) DHCP 3 application. The flaws could be exploited to in a denial-of-service attack against the affected machine. For more, go to:

https://www.us-cert.gov/cas/techalerts/TA04-174A.html

Mandrake Linux:

https://www.nwfusion.com/go2/0621bug2a.html

SuSE:

https://www.suse.com/de/security/2004_19_dhcp_server.html

**********

More Linux kernel fixes

A floating point exception in the Linux kernel could be triggered to create a denial-of-service attack against the affected machine. For more, go to:

Conectiva:

https://www.nwfusion.com/go2/0621bug2b.html

EnGarde:

https://www.nwfusion.com/go2/0621bug2c.html

Mandrake Linux:

https://www.nwfusion.com/go2/0621bug2d.html

**********

Mandrake Linux patches tripwire

A format string vulnerability in tripwire could be exploited by a local user to run arbitrary code on the affected machine with the privileges of tripwire, usually root. For more, go to:

https://www.nwfusion.com/go2/0621bug2e.html

**********

Debian release patch for super package

According to an alert from Debian, “Max Vozeler discovered a format string vulnerability in super, a program to allow specified users to execute commands with root privileges.  This vulnerability could potentially be exploited by a local user to execute arbitrary code with root privileges.” For more, go to:

https://www.debian.org/security/2004/dsa-522

**********

SGI patches utempter, LHA and tcpdump

Flaws in the utempter, LHA and tcpdump packages have been fixed for SGI’s SGI Advanced Linux Environment 2.4 and SGI Advanced Linux Environment 3. All three updates are rolled into a single package. For more, go to:

SGI Advanced Linux Environment 3 Security Update #3:

https://www.nwfusion.com/go2/0621bug2f.html

SGI Advanced Linux Environment 2.4 security update #21

https://www.nwfusion.com/go2/0621bug2g.html

SGI fixes SquirrelMail, cvs, Ethereal, krb5 and squid

Various flaws in SquirrelMail, cvs, Ethereal, krb5 and squid have been fixed for SGI’s SGI Advanced Linux Environment 2.4 and SGI Advanced Linux Environment 3 via single downloads. For more, go to:

SGI Advanced Linux Environment 3 Security Update #4:

https://www.nwfusion.com/go2/0621bug2h.html

SGI Advanced Linux Environment 2.4 security update #22:

https://www.nwfusion.com/go2/0621bug2i.html

**********

Today’s roundup of virus alerts:

W32/Lovgate-V – A Lovegate variant that spreads via e-mail, peer-to-peer networks and network shares. It installs itself as WinHelp.exe, iexplore.exe, kernel66.dll and ravmond.exe in the Windows System folder and to the Windows folder as systra.exe. The virus uses a variety of subject lines, body text and attachment names to spread via e-mail. It harvests addresses from the local machine. It also tries to terminate certain anti-virus applications. (Sophos)

W32/Rbot-BC – An Rbot variant that uses network shares to spread and copies itself into the Windows System directory as “DOSPRMWIN.EXE”. The virus uses IRC as a backdoor access point. (Sophos)

W32/Rbot-BI – Like Rbot-BC, this virus spreads via network shares, installing itself in the Windows System directory as a read-only system file called “WINMGARD.EXE”. It allows backdoor access to the infected machine via IRC. (Sophos)

W32/Rbot-BL – Another Rbot variant. Same M.O. as above, except it uses the file name “WUAMGRD.EXE” and adds the ability to terminate certain commonly named network shares. (Sophos)

W32/Sdbot-JB – A memory resident worm that waits for remote commands that come in over IRC.  The virus spreads via network shares and installs itself as “WINUPDATE.EXE” in the Windows System directory. (Sophos)

W32/Dansh-A – Interestingly, this worm tries to patch the Windows hole that the Sasser worm exploits. Dansh-A spreads via network shares and installs itself as “DESKTOP.EXE” in the Windows System directory. (Sophos)

StartPage.FH – Is more of a nuisance. It changes the start page of Internet Explorer and displays fake messages warning of an adware/spyware infestation. This gets the user to a site that installs adware and spyware. (Panda Software)

Downloader.HC – Downloads adware to the infected machine, which affects the IE tool bar and displays ads. (Panda Software)

Argen – Is a joke that displays a message on screen and opens the CD-ROM tray. When the user clicks “OK”, the CD tray closes. The computer is unusable while Argen is running. (Panda Software)

**********

From the interesting reading department:

IEEE set to ratify 802.11i standard

Members of the IEEE standards board will meet Thursday to vote on the final specification for 802.11i, an update to the current standard for Wi-Fi security, the chair of the IEEE 802.11 working group said Wednesday. IDG News Service, 06/23/04.

https://www.nwfusion.com/news/2004/0623ieee.html?nl

New gadgets take on ‘Starbucks’ security threat

The growth in popularity of wireless technology and mobile computing has created a potent new threat for network administrators: unauthorized intrusions onto their networks by hackers and viruses that take advantage of loosely secured laptop PCs and public computer kiosks. IDG News Service, 06/21/04.

https://www.nwfusion.com/news/2004/0621newgadge.html?nl

AOL employee arrested on spam charges

An employee of AOL was arrested Wednesday morning for stealing AOL user screen names and selling them to an unsolicited commercial (spam) e-mail operation, AOL said in a statement. IDG News Service, 06/24/04.

https://www.nwfusion.com/news/2004/0624aolemplo.html?nl

Intranet Advisor:  Fight the cause, not the symptom

Worms and viruses plaguing users worldwide are symptoms of weak security in Windows and other programs. But so far, vendors are doing more to combat the disease’s symptoms than its root cause. Network World, 06/21/04.

https://www.nwfusion.com/columnists/2004/062104blum.html?nl

Estimating the cost of a Windows Armageddon

Experts say one carefully planned worm attack could cost U.S. businesses more than the gross domestic product of Guatemala within a few hours. Network World, 06/21/04.

https://www.nwfusion.com/columnists/2004/062104bradner.html?nl

Wireless Wizards:  Securing public-access Wi-Fi

What is the best approach to securing public access Wi-Fi? And what is needed to accomplish this? Network World, 06/21/04.

https://www.nwfusion.com/columnists/2004/0621wizards.html?nl