* Patches from Red Hat, Mandrake Linux, SuSE, others * Beware the family of worms * U.K. virus writer sentenced to two years in prison, and other interesting reading Today’s bug patches and security alerts:Flaw found in CVS version control systemA vulnerability in the popular Concurrent Version System (CVS) server could allow a malicious user to run arbitary code on the affected machine. Versions of CVS prior to and including 1.11.4 are effected by this problem. Users should download Version 1.11.5 to fix the problem. For more, go to:https://ccvs.cvshome.org/servlets/NewsItemView?newsID=51 Red Hat:https://rhn.redhat.com/errata/RHSA-2003-012.html OpenPKG:https://www.openpkg.org/security/OpenPKG-SA-2003.004-cvs.htmlDebian:https://www.debian.org/security/2003/dsa-233Gentoo:https://forums.gentoo.org/viewtopic.php?t=31285 **********More DHCP packages availableAs we’ve been reporting over the past week, a serious security flaw has been found in the Internet Software Consortium’s Dynamic Host Configuration Protocol that ships with many operating systems. An attacker could exploit this flaw to take control of the affected system. Additional operating system patches are now available:Mandrake Linux: https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:007Gentoo:https://forums.gentoo.org/viewtopic.php?t=30721**********Red Hat releases libpng patchesA buffer overflow vulnerability in libpng, a program used for viewing PNG images, could be exploited to run arbitrary commands on the affected machine. For more, go to:https://rhn.redhat.com/errata/RHSA-2003-006.htmlRed Hat patches MySQLA flaw in the popular MySQL database could be exploited to crash the affected service and potentially gain elevated privileges on the affected machine. For more, go to:https://rhn.redhat.com/errata/RHSA-2002-288.htmlPostgreSQL patch for Red Hat implementationsA number of vulnerabilities have been found in the PostgreSQL object-relational database. These flaws could be exploited in a denial-of-service attack or potentially execute arbitrary code on the affected machine. For more, go to:https://rhn.redhat.com/errata/RHSA-2003-001.htmlRed Hat releases fix for python packagesA flaw in the way certain functions with in the python scripting language package create temporary files could be exploited in a symlink attack. For more, go to:https://rhn.redhat.com/errata/RHSA-2002-202.html**********Mandrake Linux patches printer driversThree flaws have been found in the printer drivers for Mandrake Linux. One flaw could allow an attacker to empty or create a any file on the affected the system. The other two vulnerabilities could be exploited to gain root access on the affected machine. For more, go to:https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:010-1**********OpenPKG releases vim patchAs we reported in our last edition, there’s a problem with the vim text editor that could allow a malicious user to call external programs. This could be used to run arbitrary commands on the affected machine. For more, go to:https://www.openpkg.org/security/OpenPKG-SA-2003.003-vim.html**********Debian releases patch for libmcryptSeveral buffer overflow vulnerabilities have been found in libmcrypt, a decryption/encryption code library. The flaws could be exploited to crash the affected machine and potentially run malicious code. For more, go to:https://www.debian.org/security/2003/dsa-228Debian patches bugzilla applicationTwo flaws have been found in the bugzilla bug tracking application for Linux. The first flaw could allow a remote user alter or delete data collected by the application. A second vulnerability could allow a malicious user access to backup files. For more, go to:https://www.debian.org/security/2003/dsa-230Debian warns of vulnerabilities in KDETwo separate pieces of KDE for Debian contain vulnerabilities. First, the kdeadmin package contains flaws that could be exploited to run arbitrary commands on the affected machine. Second, the kdegraphics is vulnerable to arbitrary code injection that can be run with the privileges of the victim. For more, go to:kdeadmin:https://www.debian.org/security/2003/dsa-234kdegraphics:https://www.debian.org/security/2003/dsa-235**********SuSE patches susehelpAccording to an alert from SuSE, “Remote attackers can insert certain characters in CGI queries to the susehelp system tricking it into executing arbitrary code as the ‘wwwrun’ user.” For more, go to:https://www.suse.com/de/security/2003_005_susehelp.html**********Gentoo updates KDEMultiple vulnerabilities exist in the KDE implementation for Gentoo. These flaws could be exploited to remotely execute shell commands. For more, go to:https://forums.gentoo.org/viewtopic.php?t=30777Gentoo warns of fnord buffer overrunVersion 1.6 of fnord contains a buffer overrun in its CGI code, according to an alert from Gentoo. The company recommends users upgrade to a later version. For more, go to:https://forums.gentoo.org/viewtopic.php?t=30720**********Caldera patches cannaTwo vulnerabilities have been found in the canna module that is used to display Chinese character sets. A local user could exploit this to gain access to certain system folders. For more, go to:ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-005.0.txt**********Buffer overflow in WinRARA buffer overflow vulnerability has been found in WinRAR, an archive manager for Windows. A malicious user could exploit the flaw to insert viruses into the affected machine or potentially delete files. Download Version 3.11 to fix this flaws. For more, go to:https://www.rarlab.com/**********Today’s roundup of virus alerts:W32/Oror-Fam – A family of worms that spreads in the same manner: e-mail, network shares and the Kazaa file-sharing network. The virus pops up fake dialog boxes, changes registry settings so that it activates on start up and creates mIRC scripts for distributing itself via IRC. (Sophos, Computer Associates)**********From the interesting reading department:U.K. virus writer sentenced to two years in prisonA 22-year-old British man has been sentenced to two years in prison for creating and sending out three computer viruses, one of the toughest sentences given so far to a virus writer. IDG News Service, 01/22/03.https://www.nwfusion.com/news/2003/0122ukvirus.htmlAstaro releases new Linux based security softwareAstaro this week at the LinuxWorld Expo announced its Security Linux V4 package for building Linux-based security devices on standard Intel server hardware. Network World, 01/22/03. https://www.nwfusion.com/news/2003/0122astaro.html**********Archives online:If it’s archives you want, then it’s archives we’ve got:https://www.nwfusion.com/newsletters/bug/ Related content news analysis Cisco, AWS strengthen ties between cloud-management products Combining insights from Cisco ThousandEyes and AWS into a single view can dramatically reduce problem identification and resolution time, the vendors say. By Michael Cooney Nov 28, 2023 4 mins Network Management Software Network Management Software Networking opinion Is anything useful happening in network management? Enterprises see the potential for AI to benefit network management, but progress so far is limited by AI’s ability to work with company-specific network data and the range of devices that AI can see. By Tom Nolle Nov 28, 2023 7 mins Generative AI Network Management Software brandpost Sponsored by HPE Aruba Networking SASE, security, and the future of enterprise networks By Adam Foss, VicePresident Pre-sales Consulting, HPE Aruba Networking Nov 28, 2023 4 mins SASE news AWS launches Cost Optimization Hub to help curb cloud expenses At its ongoing re:Invent 2023 conference, the cloud service provider introduced several new and free updates that are expected to help enterprises optimize their AWS costs. By Anirban Ghoshal Nov 28, 2023 3 mins Amazon re:Invent Podcasts Videos Resources Events NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe