Microsoft issues Windows 2000 SP4

Today’s bug patches and security alerts:

Windows 2000 gets fourth service pack

Microsoft Thursday released Service Pack 4 for Windows 2000, a bundle of all updates and patches for the operating system released since Service Pack 3 last August. IDG News Service, 06/27/03.

Story:

https://www.nwfusion.com/news/2003/0627windo2000.html

Download Service Pack 4:

https://www.microsoft.com/windows2000/downloads/servicepacks/sp4/default.asp

**********

Mandrake Linux patches ypserv

A flaw in the way ypserv’s Network Information Service (NIS) server deals with ignored responses could be exploited in denial-of-service attack against the affected machine. For more, go to:

https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:072

Mandrake Linux issues xpdf fix

A flaw in Xpdf, an X Window application for viewing PDF files, could be exploited to run arbitrary code on the affected machine. A malicious user would have to embed external hyperlinks into a PDF document in order to take advantage of this vulnerability. For more, go to:

https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:071

**********

Conectiva releases ethereal update

A number of buffer overflow vulnerabilities have been found in the ethereal code for various Linux flavors. The flaws have been corrected. For more, go to:

https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000662

Conectiva patches radiusd-cistron

A buffer overflow flaw in Conectiva’s implementation of radiusd-cistron, a RADIUS protocol, could be exploited to gain the privileges of the RADIUS server, usually root. A fix is available. For more, go to:

https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000664

Conectiva updates kopete

A flaw in kopete, a KDE instant messaging application, could be exploited by a malicious user to run arbitrary commands on the affected machine. This update fixes this problem as well as a number of other bugs found in previous versions. For more, go to:

https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000665

**********

Debian patches tcptraceroute

The tcptraceroute command for Debian does not properly drop all of its root privileges. This could be exploited through another vulnerability to gain root access on the affected machine. No exploit is known at this time, but users are urged to download the fix. For more, go to:

https://www.debian.org/security/2003/dsa-330

**********

Red Hat updates redhat-config-date package

A flaw in previous versions of the redhat-config-date for Red Hat left the operating system vulnerable to a symlink attack. This update fixes the vulnerability. For more, go to:

https://rhn.redhat.com/errata/RHBA-2003-211.html

**********

SGI patches IPv6-related bugs

An update to SGI’s IRIX operating system that added support for IPv6 has introduced a number of vulnerabilities into the platform. A new update is available to fix the flaws caused by the IPv6 implementation. For more, go to:

https://www.networkworld.com/ftp://patches.sgi.com/support/free/security/advisories/20030607-01-P

**********

Flaw found in Symantec Security Check

A buffer overflow flaw in the ActiveX control used in the free Symantec Security Check tool could be exploited by a malicious Web site to crash the browser or potentially run arbitrary code on the affected machine. For more, go to:

https://securityresponse.symantec.com/avcenter/security/Content/2003.06.25.html

**********

Today’s roundup of virus alerts:

W32/Slanper-A – A worm that attempts to exploit network shares via port 445. It contains some backdoor functionality and may arrive as a file called “msmsgri3.exe”. (Sophos)

W32/Cailont-A – This virus spreads via e-mail using a variety of subject lines, message bodies and attachment names. No word on any permanent damage caused by the worm. (Sophos)

W32/Mumu-C – A worm that exploits network shares with no password protection. The virus also contains code to help it search out potential remote victims. (Sophos)

Troj/Sandesa-A – A Trojan horse that attempts to download hacker tools to the infected machine from a remote location. (Sophos)

W32/Sage-A – This virus comes in e-mail message entitled “UPDATE” and a file attachment called “ICQ2003a.exe”. Once installed on the infected machine, the virus attempts to connect to a remote machine to allow backdoor access to an attacker. (Sophos)

**********

From the interesting reading department:

Development Impacts of Security Changes in Windows Server 2003

Michael Howard outlines some of the security changes made to Microsoft Windows Server 2003 to reduce its attack surface, and discusses how these changes impact the software developer. Microsoft, 06/16/03.

https://msdn.microsoft.com/library/en-us/dncode/html/secure06122003.asp

Calif. breach-disclosure law raises questions, concerns

A groundbreaking California law that takes effect this week compels any business or state agency that suffers a computer security breach to immediately notify residents if their personal information is compromised . . . or risk a lawsuit. Network World, 06/30/03.

https://www.nwfusion.com/news/2003/0630california.html

Sobig.E@MM worm spreading around globe

The latest version of the Sobig worm is making its way through computer networks around the world, apparently causing no direct damage but hogging bandwidth and IT resources in its path. Computerworld, 06/26/03.

https://www.nwfusion.com/news/2003/0626sobigworm.html

University systems hacked to derail student elections

A 21-year-old student was arrested for allegedly hacking into a university computer system during student elections to cast hundreds of votes for a made-up candidate he named American Ninja. The Star Online, 06/23/03.

https://www.nwfusion.com/go2/0630bug1a.html