* Patches from Mandrake Linux, Gentoo, others * Beware the Lovgate.C worm * SIP weakness could expose VoIP gear to attacks, and other interesting reading
Today’s bug patches and security alerts:
Apple patches Darwin and QuickTime Server vulnerabilities
A flaw in the authentication module of the Web management interface for Apple’s Darwin and QuickTime Streaming servers could be exploited to allow a malicious user to run arbitrary code on the underlying operating system. For more, go to:
Apple advisory:
https://docs.info.apple.com/article.html?artnum=61798
Related @Stake advisory:
https://www.atstake.com/research/advisories/2003/a032403-1.txt
**********
Updated version of CuteFTP available
A buffer overflow vulnerability has been found in CuteFTP XP 5.0, an FTP client for Windows. No known exploit is available, but GlobalScape has issued an update:
English Version:
ftp://ftp.cuteftp.com/pub/cuteftp/cuteftp.exe
French Version:
ftp://ftp.cuteftp.com/pub/cuteftp/french/cuteftpfr.exe
German Version:
ftp://ftp.cuteftp.com/pub/cuteftp/german/cuteftpde.exe
Spanish Version:
ftp://ftp.cuteftp.com/pub/cuteftp/spanish/cuteftpes.exe
**********
Nokia phones vulnerable to DoS attack
A vulnerability in the software used by Nokia’s 6210 model cellular telephone could make those phones vulnerable to a denial-of-service attack, similar to the types of attacks that are commonly launched against computer networks. IDG News Service, 02/26/03.
Story:
https://www.nwfusion.com/news/2003/0226nokiaphone.html
@Stake advisory:
https://www.atstake.com/research/advisories/2003/a022503-1.txt
**********
Additional openssl patches available
A flaw in the openssl package for OpenPKG could allow TSL/SSL communications to be passed in plain text. For more on the patch, go to:
FreeBSD:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:02.openssl.asc
SuSE:
https://www.suse.com/de/security/2003_011_openssl.html
Conectiva:
https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000570
**********
More VNC patches available
As we reported in our previous issue, two flaws have been found in the VNC software used for controlling a machine remotely. The flaws revolve around VNC’s authentication method, which has proven to be weak. For more, go to:
Mandrake Linux:
https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:022
Gentoo:
https://forums.gentoo.org/viewtopic.php?t=37666
https://forums.gentoo.org/viewtopic.php?t=37665
**********
Gentoo patches Webmin/usermin
Gentoo has released a patch for a remotely exploitable hole in Webmin. No public exploit has been found, but users are urged to upgrade. For more, go to:
https://forums.gentoo.org/viewtopic.php?t=37467
Related Secure Net Service Security advisory:
https://www.lac.co.jp/security/english/snsadv_e/62_e.html
Gentoo releases apcupsd update
A remote root vulnerability has been found in the apcupsd code. A fix is available that also includes some other enhancements. Gentoo users can get more information from:
https://forums.gentoo.org/viewtopic.php?t=37465
**********
Mandrake Linux patches Lynx vulnerability
A CRLF injection vulnerability exists in the text-only Lynx browser that could allow the browser to be redirected to a malicious Web site. For more, go to:
https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:023
**********
FreeBSD patches syncookies flaw
According to an alert from FreeBSD, “The FreeBSD syncookie implementation protects the generated ISN using a MAC that is keyed on one of several internal secret keys which are rotated periodically. However, the keys are only 32 bits in length, allowing brute force attacks on the secrets to be feasible.” For more, go to:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:03.syncookies.asc
**********
Today’s roundup of virus alerts:
Lovgate.C worm spreading across Internet
The Lovgate.C worm, a variant of an earlier worm with the same name, propagates itself by replying to e-mail in a user’s inbox with an attachment containing the bad code, Trend said. It then installs a backdoor port that allows a remote user to access and modify files on an infected user’s system. IDG News Service, 02/24/03.
https://www.nwfusion.com/news/2003/0224lovgaworm.html
W32/Gibe-D – This worm spreads via e-mail and the Kazaa file-sharing network. The virus claims to be a Microsoft Security Update. No word on the damage it can cause to an infected machine. (Sophos)
WM97/Ekiam-A – A Word macro virus that changes owner information in the system registry. The virus activates on the 1, 14 and 28th of the month. (Sophos)
W32/Oror-R – A worm that spreads via e-mail, network shares and the Kazaa file-sharing network. It e-mails itself to every e-mail address found on the infected machine and it attempts to terminate anti-virus software. (Sophos)
**********
From the interesting reading department:
SIP weakness could expose VoIP gear to attacks
A glitch in some vendors’ Session Initiation Protocol software could leave SIP-enabled devices – such as IP phones, IP PBXs and instant messaging clients – vulnerable to denial-of-service attacks, the CERT Coordination Center said last week. Network World Fusion, 02/24/03.
https://www.nwfusion.com/news/2003/0224sip.html
Hunt for worms shifts to LAN traffic
Some makers of intrusion-prevention systems designed to actively block harmful traffic such as last month’s MS-SQL Slammer worm are arguing that strategies should shift from guarding the corporate Internet perimeter to setting up IPS appliances deep within the LAN. Network World, 02/24/03.
https://www.nwfusion.com/news/2003/0224worms.html
Costs, security vex VoIP users
Return on investment and budget constraints are the biggest roadblocks to convergence projects. Or so say large corporate customers attending last week’s VoiceCon conference, where discussions focused on the business of planning, securing and cost-justifying IP telephony. Network World, 02/24/03.
https://www.nwfusion.com/news/2003/0224voicecon.html
Spammers hiding behind students
University networks already stressed by file-sharing programs, viruses and hackers now face a new threat: students who sublet their network access to spammers for as little as $20 per month. Network World, 02/24/03.
https://www.nwfusion.com/news/2003/0224spammers.html
Security, efficiency are key to AES
Advanced Encryption Standard supplants the Data Encryption Standard and Triple-DES to strengthen security and boost efficiency. Network World, 02/24/03.
https://www.nwfusion.com/news/tech/2003/0224techupdate.html
VPN experts downplay ‘splitting’ headache
At a time when protecting corporate networks is paramount, many users are steering clear of a feature of IP Security VPNs called split tunneling, a move that can give a false sense that remote-access networks are more secure than they really are, experts say. Network World, 02/24/03.
https://www.nwfusion.com/news/2003/0224splittunnels.html
OASIS gives OK to Web services standard
Corporate demand for better Web services security technology got another shot in the arm last week after a standards body finalized work on an XML-based access control protocol. Network World, 02/24/03.
https://www.nwfusion.com/news/2003/0224standard.html
Start-up changes name, launches security appliance
Teros is popping on the scene as an old start-up with a new name that is offering a way to protect networks from malicious Web traffic. Network World Fusion, 02/24/03.
https://www.nwfusion.com/news/2003/0224teros.html
Cisco to share WLAN security technology
Makers of 802.11 wireless LAN clients now can make their products support special security features offered in Cisco wireless networks under Cisco Compatible Extensions (CCX), a licensing and testing program announced Monday. IDG News Service, 02/24/03.
https://www.nwfusion.com/news/2003/0224ciscotosh.html
**********
Archives online:
As a service to our readers, we keep all previous editions of our newsletters online:
