Microsoft updates for March

Today’s bug patches and security alerts:

Microsoft releases March security updates

Microsoft continued its policy of releasing monthly security updates with three new software patches on Tuesday, including fixes for the MSN Messenger instant messaging program, Windows Media Services and the Outlook e-mail client. IDG News Service, 03/09/04.

https://www.nwfusion.com/go2/0308bug2a.html

Related Microsoft bulletins:

Office Security – Outlook flaw:

https://www.microsoft.com/technet/security/bulletin/offmar04.mspx

Microsoft Windows Security Bulletin Summary for March:

https://www.microsoft.com/technet/security/bulletin/winmar04.mspx

Microsoft MSN Products Security Bulletin Summary:

https://www.microsoft.com/technet/security/bulletin/msnmar04.mspx

CERT advisory, re: Outlook flaw:

https://www.us-cert.gov/cas/techalerts/TA04-070A.html

**********

NGSSoftware warns of IBM DB2 vulnerability

It was discovered that IBM DB2’s Remote Command Server executes remote commands with administrator rights for any valid Windows logon. This means a low-level guest user can still run commands with administrative privileges. For more, go to:

https://www.ngssoftware.com/advisories/db2rmtcmd.txt

IBM advisory:

https://www.nwfusion.com/go2/0308bug2b.html

**********

Squid Proxy flaw patched

A problem with the way the Squid Proxy Cache server handles certain URLs could be exploited by a malicious user to skip certain access controls. Squid Proxy 2.5 fixes the issue:

https://www.squid-cache.org/Versions/v2/2.5/

Related Security Tracker article:

https://www.securitytracker.com/alerts/2004/Mar/1009267.html

**********

Sysstat vulnerability fixed

A flaw in the way Sysstat, a system statistics gathering tool, uses temporary files could be exploited in a symbolic link attack to overwrite certain files. For more, go to:

Debian:

https://www.debian.org/security/2004/dsa-460

Red Hat:

https://rhn.redhat.com/errata/RHSA-2004-093.html

**********

New kdelibs fix

A flaw in the way various kdelibs packages handle cookie paths between client and server could be exploited by a malicious user to steal cookie information. For more, go to:

Debian:

https://www.debian.org/security/2004/dsa-459

Mandrake Linux:

https://www.nwfusion.com/go2/0308bug2c.html

Red Hat:

https://rhn.redhat.com/errata/RHSA-2004-075.html

**********

Python updates available

A buffer overflow in python 2.2’s getaddrinfo() function could be used to access memory where shell code is located. Only Version 2.2 is affected and only those systems that do not have IPv6 enabled. For more, go to:

Debian:

https://www.debian.org/security/2004/dsa-458

Mandrake Linux

https://www.nwfusion.com/go2/0308bug2d.html

**********

Mandrake Linux, Red Hat patch gdk-pixbuf

A denial-of-service vulnerability exists in gdk-pixbuf, a package for loading images in applications like Evolution. A fix is available. For more, go to:

Mandrake Linux:

https://www.nwfusion.com/go2/0308bug2e.html

Red Hat:

https://rhn.redhat.com/errata/RHSA-2004-102.html

**********

Mandrake Linux releases fix for mozilla

A number of vulnerabilities in mozilla 1.4 have been fixed by Mandrake Linux. For more, go to:

https://www.nwfusion.com/go2/0308bug2f.html

**********

Debian updates wu-ftpd

Two flaws have been found in wu-ftpd for Debian. One could allow a user to traverse the root directory and there’s a buffer overflow in the code that deals with S/key authentication. For more, go to:

https://www.debian.org/security/2004/dsa-457

**********

OpenPKG patches mutt

A buffer overflow in mutt, a mail user agent, could be exploited in a denial-of-service attack. For more, go to:

https://www.openpkg.org/security/OpenPKG-SA-2004.005-mutt.html

OpenPKG releases libtool fix

An insecure temporary directory is created by OpenPKG’s libtool implementation, which could leave an affected system vulnerable to a symlink attack. For more, go to:

https://www.openpkg.org/security/OpenPKG-SA-2004.004-libtool.html

**********

Today’s roundup of virus alerts:

W32/Randex-AA – Another Trojan horse that spreads via weakly protected network shares and uses IRC to receive commands from an attacker. The virus also collects CD keys for games installed on the infected machine. (Sophos)

W32/Agobot-DQ – We sound like we’re repeating ourselves, but this too is a virus that tried to spread via network shares that are weakly protected. The virus listens on a certain port for commands and also tries to kill certain security-related applications running on the infected machine. (Sophos)

Troj/Cidra-D – A Trojan that spreads via e-mail with an infected attachment called “p_usb.zip”. The Trojan acts as a proxy, redirecting TCP traffic through the infected machine. (Sophos)

Troj/Domwis-A – A backdoor Trojan that allows an attacker to take control of the infected machine. The Trojan can download remote files and execute them on the infected machine as well. (Sophos)

Troj/Eyeveg-C – A password stealing Trojan that e-mails its bounty to a remote Web site. (Sophos)

W32/Bereb-B – A peer-to-peer worm that logs on to an IRC channel once a machine is infected. (Sophos)

**********

From the interesting reading department:

Cisco releases security products, features

New hardware and enhancements to Cisco’s software products will make computer networks more resilient to attack, the company said Tuesday. IDG News Service, 03/09/04.

https://www.nwfusion.com/news/2004/0309cissec.html?nl

Patching: The cure that’s worse than the disease?

You might be familiar with the cliche that the cure can be worse than the disease. When it comes to patching software, Microsoft’s David Aucsmith now appears to be saying that the cure is frequently the cause of the disease. Network World, 03/08/04.

https://www.nwfusion.com/columnists/2004/0308kearns.html?nl

Breaking code in the name of good

It may seem odd to release a book called “Exploiting Software: How to break code” at a security conference.  But co-authors Gary McGraw and Greg Hoglund did just that at the RSA Conference in San Francisco in February and weren’t thrown out on their ears.  That’s because their real intent is to help people build better code by showing them how attackers work.  Network World Editor in Chief John Dix caught up with McGraw to learn more about the book, which was three-and-a-half years in the making, and follows McGraw’s other books, “Building Secure Software” and “Securing Java.” Network World Fusion, 03/08/04.

https://www.nwfusion.com/news/2004/0308mcgraw.html?nl

Teros enters XML security space

Application firewall maker Teros Monday said that it is adding features to protect Web services to its Secure Application Gateway product line. IDG News Service, 03/08/04.

https://www.nwfusion.com/news/2004/0308terosenter.html?nl

China’s Legend develops PC security technology

Legend Group, China’s largest PC maker, is developing technologies that could be used to make computers more secure. IDG News Service, 03/09/04.

https://www.nwfusion.com/news/2004/0309chinalegen.html?nl