SSH and Sendmail patches

Today’s bug patches and security alerts:

CERT warns of SSH vulnerability

The CERT Coordination Center is warning users about a serious security vulnerability in the OpenSSH that could enable a remote attacker to run malicious code or launch a denial-of-service attack against machines running the popular suite of secure network connectivity tools. IDG News Service, 09/17/03.

https://www.nwfusion.com/news/2003/0917certwarns.html

CERT advisory:

https://www.cert.org/advisories/CA-2003-24.html

ISS X-Force Security advisory:

https://xforce.iss.net/xforce/alerts/id/144

OpenSSH advisory:

https://www.openssh.com/txt/buffer.adv

Vendor patches:

Cisco:

https://www.nwfusion.com/go2/0915bug2a.html

Conectiva:

https://www.nwfusion.com/go2/0915bug2b.html

Debian:

https://www.debian.org/security/2003/dsa-382

EnGarde:

https://www.nwfusion.com/go2/0915bug2c.html

FreeBSD:

https://www.nwfusion.com/go2/0915bug2d.html

Gentoo:

https://forums.gentoo.org/viewtopic.php?t=86003

Immunix (general updates directory):

https://www.networkworld.com/ftp://ftp.ibiblio.org/pub/Linux/distributions/immunix/

Mandrake Linux:

https://www.nwfusion.com/go2/0915bug2e.html

OpenPKG:

https://www.openpkg.org/security/OpenPKG-SA-2003.040-openssh.html

Red Hat:

https://rhn.redhat.com/errata/RHSA-2003-279.html

Slackware:

https://www.nwfusion.com/go2/0915bug2f.html

Trustix:

https://www.nwfusion.com/go2/0915bug2g.html

**********

New sendmail vulnerability found

Michal Zalewski is reporting a bug in the prescan() function of sendmail, including the latest version of the application. Though no exploit is known, it could be possible for an attacker to cause heap and stack structure overflow, according to Zalewski. For more, go to:

Red Hat:

https://rhn.redhat.com/errata/RHSA-2003-283.html

FreeBSD:

https://www.nwfusion.com/go2/0915bug2h.html

Slackware:

https://www.nwfusion.com/go2/0915bug2i.html

**********

Eudora flaw patched

A number of vulnerabilities have been found in the popular e-mail client Eudora 6.0. These flaws could allow an attacker to run malicious applications on the affected machine. A patch is not yet available. Eudora’s technical support site can be found here:

https://www.eudora.com/techsupport

**********

Red Hat releases updated printer configuration tool

A bug in the printer configuration tool for could “affect printing to a remote queue provided by an SMB

(CIFS) share,” according to Red Hat. For more, go to:

https://rhn.redhat.com/errata/RHBA-2003-276.html

**********

KDE warns of KDM security flaws

A couple of weak security points have been found in KDM. One flaw could grant a local user root access without having to enter the proper authentication information. Another flaw results in insecure cookies being generated. For more, go to:

https://www.kde.org/info/security/advisory-20030916-1.txt

Red Hat:

https://rhn.redhat.com/errata/RHSA-2003-269.html

Mandrake Linux:

https://www.nwfusion.com/go2/0915bug2j.html

**********

Trustix, Gentoo patch mysql

A buffer overflow in the “set password” function could allow a MySQL user to gain shell access with root privileges, giving them control of the machine. For more, go to:

Trustix:

https://www.nwfusion.com/go2/0915bug2k.html

Gentoo:

https://forums.gentoo.org/viewtopic.php?t=84439

**********

Today’s roundup of virus alerts:

W32/Slanper-A – A network virus that spreads via port 445. Once it infects a machine it generates a list of random IP addresses to scan. The virus may include a backdoor function that could allow an attacker access to the infected machine. (Sophos)

Troj/JSurf-B – A Trojan horse that comes via e-mail an attempts to exploit a Internet Explorer flaw that Microsoft patched in August. No word on the damage that could be caused. (Sophos)

W32/Sluter-B – Another virus that attempts to spread to poorly protected network shares. This virus connects to an IRC server to allow an attacker unlimited access to the infected machine. (Sophos)

WM97/Simuleek-C – This Word macro virus attempts to replace the word “Ranuya” with “John” in an infected document. (Sophos)

W32/Opaserv-D – A variant of Opaserv-A, this virus attempts to connect to a remote Web site that is now unavailable, limiting its effectiveness. (Sophos)

W32/Gibe-F – A worm that spreads via its own SMTP engine, IRC and peer-to-peer networks. The infected file always starts with the letter P,Q,U or I. The virus will terminate anti-virus related applications. (Sophos)

**********

From the interesting reading department:

Hackers find way to exploit latest Microsoft hole

A security company said Tuesday that it found an example of working computer source code that exploits the latest critical security hole disclosed by Microsoft. IDG News Service, 09/16/03.

https://www.nwfusion.com/news/2003/0916hackefind.html

Solaris getting security improvements

Sun is mapping out near-term improvements to its Solaris Unix operating system that include enhanced security and network performance. InfoWorld, 09/17/03.

https://www.nwfusion.com/news/2003/0917solargetti.html

Ballmer: Security woes challenge innovation

Security woes threaten innovation in the computer industry, but they also offer an opportunity to innovate that the industry should seize, Microsoft CEO Steve Ballmer said Monday. IDG News Service, 09/16/03.

https://www.nwfusion.com/news/2003/0916ballmsecur2.html

Symantec VP picked as gov’t cybersecurity czar

Security software industry veteran Amit Yoran is expected to be named the new head of federal cybersecurity by the U.S. Department of Homeland Security (DHS) on Tuesday. IDG News Service, 09/15/03.

https://www.nwfusion.com/news/2003/0915symanvp.html

DHS, CERT CC team up for cyberthreats

The U.S. Department of Homeland Security (DHS) and the CERT Coordination Center at Carnegie Mellon University are teaming to prevent and respond to cyberattacks on the Internet, according to a statement Monday from DHS. IDG News Service, 09/15/03.

https://www.nwfusion.com/news/2003/0915dhscert.html

Electrical grid vulnerable to hackers, viruses

Since last month’s Northeast blackout, utilities have accelerated plans to automate the electric grid, replacing aging monitoring systems with digital switches and other high-tech gear. Houston Chronicle, 09/11/03.

https://www.chron.com/cs/CDA/ssistory.mpl/tech/news/2093902