* Patches from Microsoft, OpenPKG, others * Beware "polymorphic" worm * U.S. agencies get help with security patches, and other interesting reading
It’s never a good sign to turn on the weekend edition of NBC’s Today show and see a that a major virus is slowing Internet traffic to a crawl. If you haven’t heard already, the “Slammer” or “Sapphire” virus is affecting Microsoft SQL servers by flooding the systems with tons of traffic. I couldn’t pull up Weather.com late Saturday afternoon, presumably because of the worm. However, there is good news:
1. The virus seems to be slowing:
https://www.nwfusion.com/news/2003/0127slammworm.html
2. It doesn’t cause any permanent damage beyond slowing systems down to a crawl.
3. There is a patch, which has been out since July, for the vulnerability that the worm exploits:
https://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-039.asp
Today’s bug patches and security alerts:
Buffer overflow in Microsoft Locator Service
A buffer overflow vulnerability in Microsoft’s Locator Service could be exploited to crash or run arbitrary code on the affected machine. For more, go to:
Microsoft advisory:
https://www.microsoft.com/technet/security/bulletin/ms03-001.asp
Related CERT advisory:
https://www.cert.org/advisories/CA-2003-03.html
Microsoft releases cumulative patch for Content Management Server
A cross-scripting vulnerability has been found in Microsoft’s Content Management Server. An attacker could exploit this flaw to embed script into pages served by the CMS. This malicious code could then be run on a third-party machine. For more, go to:
https://www.microsoft.com/technet/security/bulletin/MS03-002.asp
Microsoft patches SMB flaw
The Server Message Block protocol used for file-sharing in Windows 2000 and XP contains a flaw that could allow an attacker to lower SMB’s level of security. The attacker could then be able to monitor and change data inside an SMB session. For more, go to:
https://www.microsoft.com/technet/security/bulletin/MS02-070.asp
Microsoft: Flaw in Outlook 2002 certificate handling
A flaw in the way Outlook 2002 uses a V1 Exchange Server Security certificate when encrypting a message could leave the message unprotected and sent in clear text. For more, go to:
https://www.microsoft.com/technet/security/bulletin/MS03-003.asp
**********
More news on the CVS flaw
The CERT Coordination Center security organization has warned of a critical vulnerability in the widely-used Concurrent Versions System (CVS) software which could enable an unauthenticated remote attacker with read-only access to execute arbitrary code, alter program operation, read sensitive information, or cause a denial of service to servers. IDG News Service, 01/24/03.
Story:
https://www.nwfusion.com/news/2003/0124cvsflaw.html
CERT advisory:
https://www.cert.org/advisories/CA-2003-02.html
Vendor patches:
Slackware:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/cvs-1.11.5-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/d/cvs-1.11.5-i386-1.tgz
Conectiva:
https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000561
Mandrake Linux:
https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:009
**********
OpenPKG patches python
A flaw in the way the python scripting language creates filenames could be exploited to run arbitrary code on an affected machine. For more, go to:
https://www.openpkg.org/security/OpenPKG-SA-2003.006-python.html
**********
More DHCP packages available
As we’ve been reporting, a serious security flaw has been found in the Internet Software Consortium’s Dynamic Host Configuration Protocol that ships with many operating systems. An attacker could exploit this flaw to take control of the affected system. Additional operating system
patches are now available:
SuSE:
https://www.suse.com/de/security/2003_006_dhcp.html
Slackware:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/dhcp-3.0pl2-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/dhcp-3.0pl2-i386-1.tgz
Conectiva:
https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000562
**********
Today’s roundup of virus alerts:
Troj/Dloader-BO – A Trojan horse that runs a file from masteraz.hypermart.net within three days of infecting a computer. No word on damage caused by this worm and it’s companion files. (Sophos)
Redlof.B – A “polymorphic” worm that spreads via Outlook, HTT and HTML pages. The work disguises itself as Outlook stationary. (Panda Software)
Buffy.D – This worm spreads via IRC, displaying messages on the infected machine each time it is restarted. No word on other potential damage caused by this virus. (Panda Software)
Oror.Q – An Outlook virus that takes advantage of well-documented (and patches) iFrame vulnerabilities. The virus shuts down and deletes processes and files related to antivirus software. (Panda Software)
Pornspa.F – A virus that dials out to a premium dial up service related to porn. (Panda Software)
**********
From the interesting reading department:
Gates celebrates Trustworthy Computing in e-mail
Microsoft has come far to deliver on its “Trustworthy Computing” promise, but more needs to be done, Microsoft Chairman and Chief Software Architect Bill Gates said in an e-mail late Thursday. IDG News Service, 01/24/03.
https://www.nwfusion.com/news/2003/0124gatesceleb.html
Software automates video surveillance
Companies and government agencies now can keep an eye on their facilities without having guards constantly watch monitors, thanks to software from ObjectVideo, the start-up announced Monday. IDG News Service, 01/27/03.
https://www.nwfusion.com/news/2003/0127softwautom.html
U.S. agencies get help with security patches
U.S. government agencies gained a new tool for fighting computer vulnerabilities this week with the launch of a service that helps them find the security patches they need. IDG News Services, 01/24/03.
https://www.nwfusion.com/news/2003/0124usagenc.html
ISS reins in security management
Internet Security Systems last week reinforced its security management package to let it manage and correlate information about security events from across its family of intrusion-detection and vulnerability-assessment products. Network World, 01/27/03.
https://www.nwfusion.com/news/2003/0127simiss.html
**********
Archives online:
We’ve got archives. Come take a look:
