Linux CUPS vulnerability fixed

Today’s bug patches and security alerts:

Linux CUPS vulnerability fixed

A flaw in versions of Common Unix Printing System prior to 1.1.19 could be exploited via the Internet Printing Protocol (IPP) to cause CUPS to enter a busy loop, resulting in a denial of service. For more, go to:

Red Hat:

https://rhn.redhat.com/errata/RHSA-2003-275.html

Mandrake Linux:

https://www.nwfusion.com/go2/1110bug1a.html

Conectiva:

https://www.nwfusion.com/go2/1110bug1b.html

**********

Debian patches postgresql

Two bugs found in the postgresql database code could be exploited to trigger a buffer overflow, which could be used to run malicious code on the affected server. For more, go to:

https://www.debian.org/security/2003/dsa-397

**********

Conectiva releases fix for thttpd

A flaw in the tiny http server (thttpd) for Conectiva’s Linux implementation could be exploited to by pass the virtual-hosting mechanism to read arbitrary files on the affected machine. For more, go to:

https://www.nwfusion.com/go2/1110bug1c.html

**********

Conectiva, SCO patch net-snmp

A flaw in earlier versions of net-snmp, an implementation of the Simple Network Management Protocol (SNMP) for network monitoring, could be exploited to allow users access to MIB objects that normally would be excluded from their view. For more, go to:

Conectiva:

https://www.nwfusion.com/go2/1110bug1d.html

SCO OpenLinux:

ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-029.0.txt

**********

SCO, Conectiva release ethereal patch

A number of flaws have been found in ethereal, a free network monitoring tool for Linux/Unix. The vulnerabilities could be exploited in a denial-of-service attack or to potentially execute the attacker’s code of choice. For more, go to:

ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-030.0.txt

**********

SCO releases Apache update for OpenServer

Version 2.0.48 of the Apache Web server is primarily a bug fix release, according to an alert from SCO. In addition to some minor bugs, this release also fixes a CGI path redirect flaw and a buffer overflow in the mod_alias and mod_rewrite. For more, go to:

ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.28

SCO issues fix for CDE libDtHelp

According to an alert from SCO, “The Common Desktop Environment (CDE) is a standard desktop environment for UNIX based systems. CDE libDTHelp contains a buffer overflow that can be exploited by a local user using specially crafted environment variables. An authenticated local user may be able to execute arbitrary code with root privileges.” For more, go to:

ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.31

**********

Red Hat patches fileutils

A buffer overflow vulnerability has been found in Red Hat Linux’s “ls” directory listing command found the fileutils package. The flaw could be exploited in a denial-of-service attack. The fix can be downloaded here:

https://rhn.redhat.com/errata/RHSA-2003-309.html

**********

Today’s roundup of virus alerts:

W32/SpyBot-W, V – A peer-to-peer virus that disables certain utilities and waits for commands sent via IRC. (Sophos)

**********

From the interesting reading department:

Virus writers dismiss Microsoft’s bounty fund

Though cyberspace outlaws may look over their shoulder one extra time before launching a computer virus or worm, they won’t be deterred by the $5 million bounty fund established by Microsoft to help capture and convict them, two virus writers said. IDG News Service, 11/07/03.

https://www.nwfusion.com/news/2003/1107viruswrite.html

Paper finds new wireless standard less secure

A new paper by a leading security expert says that the new Wi-Fi Protected Access (WPA) security standard may be less secure, in certain scenarios, than WEP, the wireless standard it was designed to replace. IDG News Service, 11/07/03.

https://www.nwfusion.com/news/2003/1107paperfinds.html