Linux kernel vulnerability

Network World needs your help. We’re looking for the weirdest, most wild, descriptive and/or silly network product name you’ve come across. Got one to share? Fill out this short form and you could win a fabulous Network World prize: http://www.nwfusion.com/survey/favprod2003.html

Network World needs your help. We’re looking for the weirdest, most wild, descriptive and/or silly network product name you’ve come across. Got one to share? Fill out this short form and you could win a fabulous Network World prize:

https://www.nwfusion.com/survey/favprod2003.html

Today’s bug patches and security alerts:

Linux kernel vulnerability behind Debian attack

A serious vulnerability in the Linux 2.4 kernel that allows users on a Linux machine to gain unlimited access privileges has been discovered, according to a security advisory posted by developers of the noncommercial Debian Linux distribution. The bug affects versions of the Linux kernel prior to 2.4.23, and was the method used during a recent attack on Debian’s servers, according to the advisory. IDG News Service, 12/02/03.

https://www.nwfusion.com/news/2003/1202linuxkerne.html?nl

Debian advisory:

https://www.nwfusion.com/go2/1201bug2a.html

More kernel updates:

Mandrake Linux:

https://www.nwfusion.com/go2/1201bug2b.html

Red Hat:

https://rhn.redhat.com/errata/RHSA-2003-392.html

Slackware

https://www.nwfusion.com/go2/1201bug2c.html

Trustix:

https://www.nwfusion.com/go2/1201bug2d.html

**********

Cisco warns of wireless security hole

Cisco is warning customers using its Aironet wireless access points about a security vulnerability that could allow attackers to obtain keys used to secure communications on wireless networks. The vulnerability affects Aironet 1100, 1200 and 1400 series access points. IDG News Service, 12/03/03.

https://www.nwfusion.com/news/2003/1203ciscowarns.html?nl

Cisco advisory:

https://www.nwfusion.com/go2/1201bug2e.html

**********

BIND 8 patch for UnixWare available

As we reported earlier this week, a programming error in the BIND 8 DNS server could “result in a DNS message being incorrectly cached as a negative response.” This could lead to a denial of service against legitimate domain names. For more, go to:

ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.33

**********

SGI releases ProPack v2.3 security update for IRIX

This new security update for IRIX fixes vulnerabilities in stunnel and glibc. For more, go to:

https://www.nwfusion.com/go2/1201bug2f.html

**********

OpenPKG patches screen

A buffer overflow has been found in OpenPKG’s Virtual Screen Manager GNU screen. Attackers could gain control of other users’ screens or potentially gain elevated privileges on the affected machine. For more, go to:

https://www.openpkg.org/security/OpenPKG-SA-2003.050-screen.html

**********

Red Hat issues updated Net-SNMP packages

A new version of Net-SNMP, a set of Simple Network Management Protocol tools, is now available. This release fixes a number of minor flaws in previous releases. For more, go to:

https://rhn.redhat.com/errata/RHSA-2003-335.html

**********

SecuriTeam warns of AlaCart flaw

A flaw in the AlaCart shopping cart application could be exploited to remotely inject SQL commands into the application. An attacker could use this to gain elevated privileges on the affected machine. For more, go to:

https://www.securitytracker.com/alerts/2003/Dec/1008341.html

**********

Today’s roundup of virus alerts:

W32/Mimail-L – An interesting variation of the Mimail worm. This one too spreads via e-mail claiming to be from Wendy and an attachment with naked pictures of her. When the virus runs, it attempts to send itself to everyone in the Outlook address book. If that fails, the virus sends out a fake e-mail (no attachment) claiming to be a confirmation for a kiddie porn download service. The opt-out message and links are to anti-spam companies, in the hopes of creating a denial-of-service via angry users. (Sophos)

W32/Mimail-M – A slight variation on Mimail-L, this time targeting different Web sites and services. (Sophos)

W32/Agobot-AG – Another version of the Agobot family of viruses. This one spreads via weakly protected network shares and allows unauthorized third-party access to the infected machine via IRC. (Sophos)

**********

From the interesting reading department:

Sobig virus tops charts for 2003

The Sobig e-mail worm that clogged in-boxes in August was the most prolific virus of 2003, according to a top 10 list of viruses published by anti-virus software vendor Sophos. IDG News Service, 12/03/03.

https://www.nwfusion.com/news/2003/1203sobigvirus.html?nl

Rampant Epidemics of Powerful Malicious Software

“Malicious software,” the insidious purveyor of viruses and other threats, has consistently gotten faster and more powerful. The New York Times, 12/01/03.

https://www.nytimes.com/2003/12/01/technology/01comp.html

Ridge calls on business for security blueprint

Calling on the private sector to do its part in securing the U.S. computer network infrastructure, top officials from the U.S. Department of Homeland Security Wednesday warned members of the high-technology industry that unless they took concrete steps toward cybersecurity, their industry could face government regulation. IDG News Service, 12/03/03.

https://www.nwfusion.com/news/2003/1203ridgecalls.html?nl

Report: Domestic security tech efforts lagging

The U.S. is not taking advantage of its technology expertise to fight terrorism because U.S. government agencies are still reluctant to share terrorism-related information with each other, two years after the Sept. 11 terrorist attacks, according to a new report authored by leading IT and national security experts. IDG News Service, 12/02/03.

https://www.nwfusion.com/news/2003/1202report.html?nl

Security Webcast week at Microsoft

This week, Microsoft is offering a series of live Webcast events that cover various areas of security. All of the events are or will be available for on-demand viewing. Naturally, you’ll need Windows Media Player to view these.

https://www.microsoft.com/technet/security/webcasts/default.asp