Linux Advisory Watch - December 19th 2008
+----------------------------------------------------------------------+
| LinuxSecurity.com Weekly Newsletter |
| December 19th, 2008 Volume 9, Number 51 |
| |
| Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> |
| Benjamin D. Thomas <bthomas@xxxxxxxxxxxxxxxxx> |
+----------------------------------------------------------------------+
Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.
This week, advisories were released for no-ip, uw-imap, JasPer, Ruby,
Dovecot, POV-Ray, aview, Honeyd, firefox, drakx-net, enscript,
wireshark, java, seamonkey, pidgin, and cups. The distributors include
Debian, Gentoo, Mandriva, Red Hat, and Ubuntu.
---
Earn your MS in Info Assurance online
Norwich University's Master of Science in Information Assurance (MSIA)
program, designated by the National Security Agency as providing
academically excellent education in Information Assurance, provides
you with the skills to manage and lead an organization-wide
information security program and the tools to fluently communicate
the intricacies of information security at an executive level.
http://www.linuxsecurity.com/ads/adclick.php?bannerid=12
---
Review: Googling Security: How Much Does Google Know About You
--------------------------------------------------------------
If I ask "How much do you know about Google?" You may not take even a
second to respond. But if I may ask "How much does Google know about
you"? You may instantly reply "Wait... what!? Do they!?" The book
"Googling Security: How Much Does Google Know About You" by Greg Conti
(Computer Science Professor at West Point) is the first book to reveal
how Google's vast information stockpiles could be used against you or
your business and what you can do to protect yourself.
http://www.linuxsecurity.com/content/view/145939
---
A Secure Nagios Server
----------------------
Nagios is a monitoring software designed to let you know about problems
on your hosts and networks quickly. You can configure it to be used on
any network. Setting up a Nagios server on any Linux distribution is a
very quick process however to make it a secure setup it takes some
work. This article will not show you how to install Nagios since there
are tons of them out there but it will show you in detail ways to
improve your Nagios security.
http://www.linuxsecurity.com/content/view/144088
--> Take advantage of the LinuxSecurity.com Quick Reference Card! <--
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <--
------------------------------------------------------------------------
* EnGarde Secure Community 3.0.22 Now Available! (Dec 9)
------------------------------------------------------
Guardian Digital is happy to announce the release of EnGarde Secure
Community 3.0.22 (Version 3.0, Release 22). This release includes
many updated packages and bug fixes and some feature enhancements to
the EnGarde Secure Linux Installer and the SELinux policy.
http://www.linuxsecurity.com/content/view/145668
------------------------------------------------------------------------
* Debian: New Linux 2.6.18 packages fix several vulnerabilities (Dec 15)
----------------------------------------------------------------------
Tavis Ormandy reported a local DoS and potential privilege
escalation in the Virtual Dynamic Shared Objects (vDSO)
implementation.
http://www.linuxsecurity.com/content/view/145937
* Debian: New no-ip packages fix arbitrary code execution (Dec 14)
----------------------------------------------------------------
A buffer overflow has been discovered in the HTTP parser of the
No-IP.com Dynamic DNS update client, which may result in the
execution of arbitrary code.
http://www.linuxsecurity.com/content/view/145925
* Debian: New uw-imap packages fix multiple vulnerabilities (Dec 12)
------------------------------------------------------------------
It was discovered that several buffer overflows can be triggered via
a long folder extension argument to the tmail or dmail program. This
could lead to arbitrary code execution (CVE-2008-5005).
http://www.linuxsecurity.com/content/view/145812
------------------------------------------------------------------------
* Gentoo: JasPer User-assisted execution of arbitrary code (Dec 16)
-----------------------------------------------------------------
Multiple memory management errors in JasPer might lead to execution
of arbitrary code via jpeg2k files.
http://www.linuxsecurity.com/content/view/145947
* Gentoo: Ruby Multiple vulnerabilities (Dec 16)
----------------------------------------------
Multiple vulnerabilities have been discovered in Ruby that allow for
attacks including arbitrary code execution and Denial of Service.
http://www.linuxsecurity.com/content/view/145946
* Gentoo: Dovecot Multiple vulnerabilities (Dec 15)
-------------------------------------------------
Multiple vulnerabilities were found in the Dovecot mailserver.
http://www.linuxsecurity.com/content/view/145928
* Gentoo: POV-Ray User-assisted execution of arbitrary (Dec 14)
-------------------------------------------------------------
POV-Ray includes a version of libpng that might allow for the
execution of arbitrary code when reading a specially crafted PNG file
http://www.linuxsecurity.com/content/view/145926
* Gentoo: aview Insecure temporary file usage (Dec 13)
----------------------------------------------------
An insecure temporary file usage has been reported in aview, leading
to symlink attacks.
http://www.linuxsecurity.com/content/view/145924
* Gentoo: OpenOffice.org Multiple vulnerabilities (Dec 12)
--------------------------------------------------------
Multiple vulnerabilities in OpenOffice.org might allow for
user-assisted execution of arbitrary code or symlink attacks.
http://www.linuxsecurity.com/content/view/145816
* Gentoo: Honeyd Insecure temporary file creation (Dec 12)
--------------------------------------------------------
An insecure temporary file usage has been reported in Honeyd,
possibly leading to symlink attacks.
http://www.linuxsecurity.com/content/view/145814
------------------------------------------------------------------------
* Mandriva: Subject: [Security Announce] [ MDVSA-2008:245 ] firefox (Dec 17)
--------------------------------------------------------------------------
Security vulnerabilities have been discovered and corrected in the
latest Mozilla Firefox 3.x, version 3.0.5 This update provides the
latest Mozilla Firefox 3.x to correct these issues.
http://www.linuxsecurity.com/content/view/146051
* Mandriva: Subject: [Security Announce] [ MDVA-2008:202 ] drakx-net (Dec 17)
---------------------------------------------------------------------------
Drakfirewall, as shipped with Mandriva Linux 2009.0, was not able to
save the firewall configuration after changing port selection. This
update fixes the issue.
http://www.linuxsecurity.com/content/view/146050
* Mandriva: Subject: [Security Announce] [ MDVSA-2008:244 ] mozilla-firefox (Dec 17)
----------------------------------------------------------------------------------
Security vulnerabilities have been discovered and corrected in the
latest Mozilla Firefox 2.x, version 2.0.0.19
http://www.linuxsecurity.com/content/view/145953
* Mandriva: Subject: [Security Announce] [ MDVSA-2008:243 ] enscript (Dec 15)
---------------------------------------------------------------------------
Two buffer overflow vulnerabilities were discovered in GNU enscript,
which could allow an attacker to execute arbitrary commands via a
specially crafted ASCII file, if the file were opened with the -e or
--escapes option enabled (CVE-2008-3863, CVE-2008-4306). The updated
packages have been patched to prevent these issues.
http://www.linuxsecurity.com/content/view/145938
* Mandriva: Subject: [Security Announce] [ MDVSA-2008:242 ] wireshark (Dec 15)
----------------------------------------------------------------------------
Two vulnerabilities were discovered in Wireshark. The first is a
vulnerability in the SMTP dissector that could cause it to consume
excessive CPU and memory via a long SMTP request (CVE-2008-5285). The
second is an issue with the WLCCP dissector that could cause it to go
into an infinite loop.
http://www.linuxsecurity.com/content/view/145936
------------------------------------------------------------------------
* RedHat: Important: java-1.4.2-bea security update (Dec 18)
----------------------------------------------------------
java-1.4.2-bea as shipped in Red Hat Enterprise Linux 3 Extras, Red
Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5
Supplementary, contains security flaws and should not be used. This
update has been rated as having important security impact by the Red
Hat Security Response Team.
http://www.linuxsecurity.com/content/view/146053
* RedHat: Important: java-1.5.0-bea security update (Dec 18)
----------------------------------------------------------
java-1.5.0-bea as shipped in Red Hat Enterprise Linux 4 Extras and
Red Hat Enterprise Linux 5 Supplementary, contains security flaws and
should not be used. This update has been rated as having important
security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/146054
* RedHat: Important: java-1.6.0-bea security update (Dec 18)
----------------------------------------------------------
java-1.6.0-bea as shipped in Red Hat Enterprise Linux 4 Extras and
Red Hat Enterprise Linux 5 Supplementary, contains security flaws and
should not be used.This update has been rated as having important
security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/146055
* RedHat: Important: kernel security and bug fix update (Dec 17)
--------------------------------------------------------------
Updated kernel packages that resolve several security issues and fix
various bugs are now available for Red Hat Enterprise Linux 3. This
update has been rated as having important security impact by the Red
Hat Security Response Team.
http://www.linuxsecurity.com/content/view/145950
* RedHat: Critical: seamonkey security update (Dec 16)
----------------------------------------------------
Updated seamonkey packages that fix security issues are now available
for Red Hat Enterprise Linux 2.1, Red Hat Enterprise Linux 3, and Red
Hat Enterprise Linux 4. This update has been rated as having critical
security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/145949
* RedHat: Critical: firefox security update (Dec 16)
--------------------------------------------------
An updated firefox package that fixes various security issues is now
available for Red Hat Enterprise Linux 4 and 5. This update has been
rated as having critical security impact by the Red Hat Security
Response Team.
http://www.linuxsecurity.com/content/view/145948
* RedHat: Important: kernel security and bug fix update (Dec 16)
--------------------------------------------------------------
Updated kernel packages that resolve several security issues and fix
various bugs are now available for Red Hat Enterprise Linux 5. This
update has been rated as having important security impact by the Red
Hat Security Response Team.
http://www.linuxsecurity.com/content/view/145942
* RedHat: Moderate: pidgin security and bug fix update (Dec 15)
-------------------------------------------------------------
Updated Pidgin packages that fix several security issues and bugs are
now available for Red Hat Enterprise Linux 4 and 5. This update has
been rated as having moderate security impact by the Red Hat Security
Response Team.
http://www.linuxsecurity.com/content/view/145932
* RedHat: Moderate: cups security update (Dec 15)
-----------------------------------------------
Updated cups packages that fix a security issue are now available for
Red Hat Enterprise Linux 3. This update has been rated as having
moderate security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/145933
* RedHat: Moderate: cups security update (Dec 15)
-----------------------------------------------
Updated cups packages that fix a security issue are now available for
Red Hat Enterprise Linux 5. This update has been rated as having
moderate security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/145934
* RedHat: Moderate: enscript security update (Dec 15)
---------------------------------------------------
An updated enscript packages that fixes several security issues is
now available for Red Hat Enterprise Linux 5. This update has been
rated as having moderate security impact by the Red Hat Security
Response Team.
http://www.linuxsecurity.com/content/view/145930
* RedHat: Moderate: enscript security update (Dec 15)
---------------------------------------------------
An updated enscript packages that fixes several security issues is
now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update
has been rated as having moderate security impact by the Red Hat
Security Response Team.
http://www.linuxsecurity.com/content/view/145931
------------------------------------------------------------------------
* Slackware: mozilla-firefox (Dec 18)
-------------------------------------
New mozilla-firefox packages are available for Slackware 10.2, 11.0,
12.0, 12.1, 12.2, and -current to fix security issues.
http://www.linuxsecurity.com/content/view/146060
------------------------------------------------------------------------
* Ubuntu: Firefox vulnerabilities (Dec 17)
-----------------------------------------
Several flaws were discovered in the browser engine. These problems
could allow an attacker to crash the browser and possibly execute
arbitrary code with user privileges.
http://www.linuxsecurity.com/content/view/145954
* Ubuntu: Firefox vulnerabilities (Dec 17)
-----------------------------------------
Several flaws were discovered in the browser engine. These problems
could allow an attacker to crash the browser and possibly execute
arbitrary code with user privileges. (CVE-2008-5500)
http://www.linuxsecurity.com/content/view/145955
* Ubuntu: Ruby vulnerability (Dec 16)
------------------------------------
Laurent Gaffie discovered that Ruby did not properly check for memory
allocation failures. If a user or automated system were tricked into
running a malicious script, an attacker could cause a denial of
service. (CVE-2008-3443)
http://www.linuxsecurity.com/content/view/145944
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
[Fedora Announce]
[Linux Crypto]
[Kernel]
[Netfilter]
[Video for Linux]
[Bugtraq]
[USB]
[Fedora Security]
