Trend Micro patches ‘p’ problem in eManager

Today’s bug patches and security alerts:

Trend Micro patches ‘p’ problem

A recent update to Trend Micro’s eManager e-mail security product did more than block spam e-mail – it took aim at the letter “p,” blocking all e-mail messages containing the popular consonant. IDG News Service, 05/23/03.

https://www.nwfusion.com/news/2003/0523trendmicro.html

eManager update page:

https://www.trendmicro.com/download/product.asp?productid=9

**********

Microsoft works to fix backup compatibility flaw

A change to Microsoft’s tape back-up feature makes file back-up tapes created with Windows Server 2003 incompatible with previous versions of Windows including Windows XP and Windows 2000. The problem is due to a change in the Windows Server 2003 version of the free ntbackup.exe utility that comes with Windows operating systems and was first disclosed in the online security news group NTBugtraq. IDG News Service, 05/23/03.

https://www.nwfusion.com/news/2003/0523microworks.html

Microsoft warns firewall does not block IPv6 traffic

Microsoft is warning Windows XP and 2003 users of a flaw in the way its Internet Connection Firewall (ICF) or Basic Firewall handle IPv6 traffic. When IPv6 is enabled and the firewall is turned on, IPv4 traffic will be filtered properly, but all IPv6 traffic will be allowed through. For more, go to:

https://support.microsoft.com/default.aspx?scid=kb;EN-US;Q306203

**********

Slackware, Mandrake Linux patch GnuPG

A flaw in the way keys held my multiple users is validated could allow certain users greater access than they’re intended to recieve. For more, go to:

Slackware:

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2003&m=slackware-security.297133

Mandrake Linux:

https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:061

**********

Slackware releases patch for XDR overflow

A overflow vulnerability in the xdrmem_getbytes() function that’s part of the XDR RPC library could be exploited to run arbitrary code on the affected machine. For more, go to:

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2003&m=slackware-security.424088

Slackware issues patch for quotacheck

A bug has been found in the way certain options in the quotacheck application are used. For more, go to:

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2003&m=slackware-security.359465

Slackware pathces BitchX

A flaw in BitchX, an IRC client, could be exploited by an attacker to write outside the buffer boundaries causing a denial-of-service. The vulnerability could also be exploited to run arbitrary code on the affected machine. For more, go to:

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2003&m=slackware-security.304790

Slackware users can download mod_ssl update

An upgrade to mod_ssl is available that “provides RSA blinding by default which prevents an extended timing analysis from revealing details of the secret key to an attacker,” according to an alert from Slackware. For more, go to:

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2003&m=slackware-security.301438

Slackware patches flaw in EPIC4 IRC client

A flaw in the EPIC4 IRC client could be exploited by a malicious IRC server operator to crash the affected client or potentially run arbitrary code on the machine. For more, go to:

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2003&m=slackware-security.297182

**********

Mandrake Linux updates LPRng

A flaw in LPRng’s psbanner use of temporary files could be exploited in symlink attack to overwrite certain file on the affected machine. For more, go to:

https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:060

Mandrake Linux patches lpr

According to an alert from Mandrake Linux, “A buffer overflow was discovered in the lpr printer spooling system that can be exploited by a local user to gain root privileges.  This can be done even if the printer is configured properly.” For more, go to:

https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:059

**********

Today’s roundup of virus alerts:

W32/Anacon-B – A mass mailing worm with a Trojan horse component that allows backdoor access to the infected machine. The virus spreads via Outlook, network shares and peer-to-peer networks. (Sophos)

VBS/Petik.N – A nasty little virus that attempts to overwrite all files on the infected machine. It spreads via network shares, making it more dangerous in a corporate network. (Panda Software)

W32/Melare – A nondestructive virus that spreads via e-mail with a subject line of “Alert! SARS is being Spread!” and an attachment called “SARS_IMAGE.JPG”. It just send itself out to everyone listed in the infected machine’s Outlook address book. (Panda Software)

W32/Redisto – This virus spreads via e-mail and peer-to-peer networks. It blocks firewall and antivirus applications on the infected machine. (Panda Software)

WM97/Panjang-A – A Word macro virus that seems to infected Office 95 documents but does not seem to cause permanent damage. (Sophos)

Troj/Peido-B – A virus that spreads via e-mail with an attachment called “error.hta”. The virus drops a Trojan horse program on the infected machine. (Sophos)

WM97/Lazy-C – Similar to WM97/Panjang-A, this virus infects Office 95 documents but does not seem to cause permanent damage. (Sophos)

**********

From the interesting reading department:

Network World supplement: Security for today’s workforce

Wireless LANs, remote access from anywhere, instant messaging. Today’s sophisticated workforce is demanding more of the corporate network. Meeting their needs securely is the greatest concern of today’s network executive. The following special content will help guide you through your latest security options. Network World, 05/26/03.

https://www.nwfusion.com/supp/2003/security/

The human firewall

Giving out sensitive data to people without first authenticating their identity and access privileges is one of the most common and worst mistakes employees can make. Allowing a stranger inside an organization without authorization is yet another example of a broken link in the human firewall chain. Network World, 05/26/03.

https://www.nwfusion.com/research/2003/0526human.html

Cisco tightens security

Cisco is wheeling out a smorgasbord of security upgrades and advanced threat-protection technologies in an effort to help users integrate security management. Network World, 05/26/03.

https://www.nwfusion.com/news/2003/0526ciscosec.html

802.11i shores up wireless security

802.11i includes two big security upgrades: Wi-Fi Protected Access (WPA) and Robust Security Network (RSN). Network World, 05/26/03.

https://www.nwfusion.com/news/tech/2003/0526techupdate.html

ISS hatches ‘virtual patching’ plan

Internet Security Systems is readying technology it says could benefit companies fed up with current patch management techniques. More precisely, ISS will enable its vulnerability-assessment scanner to gang up with its network- and host-based intrusion-detection systems (IDS) to stop newly discovered attacks or worms that could damage unprotected servers or desktops on enterprise networks. Network World Fusion, 05/26/03.

https://www.nwfusion.com/news/2003/0526isspatch.html