+---------------------------------------------------------------------+
| LinuxSecurity.com Weekly Newsletter |
| August 12th, 2005 Volume 6, Number 33a |
+---------------------------------------------------------------------+
Editors: Dave Wreski Benjamin D. Thomas
dave@private ben@private
Linux Advisory Watch is a comprehensive newsletter that outlines the
security vulnerabilities that have been announced throughout the
week. It includes pointers to updated packages and descriptions of
each vulnerability.
This week, advisories were released for yaboot, ttmkfdir, Netpbm,
ruby, squirrelmail, sysreport, xpdf, kdegraphics, cups, ucd-snmp,
gaim, ethereal, and gpdf. The distributors include Fedora, Gentoo,
and Red Hat.
---
## Internet Productivity Suite: Open Source Security ##
Trust Internet Productivity Suite's open source architecture to
give you the best security and productivity applications available.
Collaborating with thousands of developers, Guardian Digital
security engineers implement the most technologically advanced
ideas and methods into their design.
Click to find out more!
http://store.guardiandigital.com/html/eng/products/software/ips_overview.shtml
---
Hacks From Pax: PHP Web Application Security
By: Pax Dickinson
Today on Hacks From Pax we'll be discussing PHP web application
security. PHP is a great language for rapidly developing web
applications, and is very friendly to beginning programmers, but
some of its design can make it difficult to write web apps that
are properly secure. We'll discuss some of the main security
"gotchas" when developing PHP web applications, from proper
user input sanitization to avoiding SQL injection
vulnerabilities.
Many PHP application vulnerabilities are caused by not properly
initializing variables. This is an example of how PHP, by not
requiring the developer to initialize a variable before using
it, sacrifices security for ease of use. For example, the
following code is easily exploitable.
if (user_auth()) {
$access = true;
}
if ($access) {
do_sensitive_things();
}
This could be exploited by tacking an ?access=true to the
end of the url, and the if ($access) test would be passed
despite the user_auth() function returning false. This hole
could be closed easily by adding a $access = false; at the
top of the script, but not all security holes are this easy
to spot.
Thankfully, PHP now defaults the register_globals option to
off. This setting would pass the access variable sent by the
url to the script as $_GET[access] rather than just $access.
This closes off many of these types of vulnerabilities, but
when writing PHP code, especially code for distribution,
you should never assume that this option will be set
correctly, and always initialize your PHP variables. Users
in a shared hosting environment may not have the ability to
set these options to their most secure setting.
* Always initialize PHP variables before using them.
* Always set register_globals to off, but never write code
that assumes this setting.
* You can use the ini_get() function to determine if
register_globals is set at runtime.
Read Entire Article:
http://www.linuxsecurity.com/content/view/120043/49/
----------------------
Linux File & Directory Permissions Mistakes
One common mistake Linux administrators make is having file and directory
permissions that are far too liberal and allow access beyond that which
is needed for proper system operations. A full explanation of unix file
permissions is beyond the scope of this article, so I'll assume you are
familiar with the usage of such tools as chmod, chown, and chgrp. If
you'd like a refresher, one is available right here on linuxsecurity.com.
http://www.linuxsecurity.com/content/view/119415/49/
---
Buffer Overflow Basics
A buffer overflow occurs when a program or process tries to store more
data in a temporary data storage area than it was intended to hold. Since
buffers are created to contain a finite amount of data, the extra
information can overflow into adjacent buffers, corrupting or overwriting
the valid data held in them.
http://www.linuxsecurity.com/content/view/119087/49/
---
Review: The Book of Postfix: State-of-the-Art Message Transport
I was very impressed with "The Book of Postfix" by authors Ralf
Hildebrandt and Pattrick Koetter and feel that it is an incredible
Postfix reference. It gives a great overall view of the operation
and management of Postfix in an extremely systematic and practical
format. It flows in a logical manner, is easy to follow and the
authors did a great job of explaining topics with attention paid
to real world applications and how to avoid many of the associated
pitfalls. I am happy to have this reference in my collection.
http://www.linuxsecurity.com/content/view/119027/49/
--------
--> Take advantage of the LinuxSecurity.com Quick Reference Card!
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf
+---------------------------------+
| Distribution: Fedora | ----------------------------//
+---------------------------------+
* Fedora Core 4 Update: yaboot-1.3.12-10
4th, August, 2005
Updated package.
http://www.linuxsecurity.com/content/view/120028
* Fedora Core 4 Update: ttmkfdir-3.0.9-16.1
5th, August, 2005
This update fixes a problem with ttmkfdir not including native
encodings of Asian TrueType fonts in fonts.scale files used by the X
font server. Users of Chinese, Japanese, and Korean fonts are
recommended to reinstall the font packages for these languages after
updating ttmkfdir.
http://www.linuxsecurity.com/content/view/120037
* Fedora Core 3 Update: ttmkfdir-3.0.9-14.1
5th, August, 2005
This update fixes a problem with ttmkfdir not including native
encodings of Asian TrueType fonts in fonts.scale files used by the X
font server. Users of Chinese, Japanese, and Korean fonts are
recommended to reinstall the font packages for these languages after
updating ttmkfdir.
http://www.linuxsecurity.com/content/view/120038
* Fedora Core 4 Update: selinux-policy-targeted-1.25.3-12
5th, August, 2005
Updated package.
http://www.linuxsecurity.com/content/view/120040
+---------------------------------+
| Distribution: Gentoo | ----------------------------//
+---------------------------------+
* Gentoo: Netpbm Arbitrary code execution in pstopnm
5th, August, 2005
The pstopnm utility, part of the Netpbm tools, contains a
vulnerability which can potentially result in the execution of
arbitrary code.
http://www.linuxsecurity.com/content/view/120031
* Gentoo: Heartbeat Insecure temporary file creation
7th, August, 2005
Heartbeat is vulnerable to symlink attacks, potentially allowing a
local user to overwrite arbitrary files.
http://www.linuxsecurity.com/content/view/120041
+---------------------------------+
| Distribution: Red Hat | ----------------------------//
+---------------------------------+
* RedHat: Moderate: ruby security update
5th, August, 2005
Updated ruby packages that fix an arbitrary command execution issue
are now available. This update has been rated as having moderate
security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120035
* RedHat: Moderate: squirrelmail security update
5th, August, 2005
An updated squirrelmail package that fixes two security issues is now
available. This update has been rated as having moderate security
impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120036
* RedHat: Low: sysreport security update
9th, August, 2005
An updated sysreport package that fixes an insecure temporary file
flaw is now available. This update has been rated as having low
security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120049
* RedHat: Moderate: xpdf security update
9th, August, 2005
An updated xpdf package that fixes a security issue is now available
for Red Hat Enterprise Linux 4. This update has been rated as having
moderate security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120050
* RedHat: Moderate: kdegraphics security update
9th, August, 2005
Updated kdegraphics packages that resolve a security issue in kpdf
are now available. This update has been rated as having moderate
security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120051
* RedHat: Important: cups security update
9th, August, 2005
Updated CUPS packages that fix a security issue are now available for
Red Hat Enterprise Linux. This update has been rated as having
important security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120052
* RedHat: Low: ucd-snmp security update
9th, August, 2005
Updated ucd-snmp packages that a security issue are now available for
Red Hat Enterprise Linux 2.1. This update has been rated as having
low security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120053
* RedHat: Critical: gaim security update
10th, August, 2005
An updated gaim package that fixes a buffer overflow security issue
is now available. This update has been rated as having critical
security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120055
* RedHat: Critical: gaim security update
10th, August, 2005
An updated gaim package that fixes multiple security issues is now
available. This update has been rated as having critical security
impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120056
* RedHat: Moderate: ethereal security update
10th, August, 2005
Updated Ethereal packages that fix various security vulnerabilities
are now available. This update has been rated as having moderate
security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120061
* RedHat: Moderate: gpdf security update
10th, August, 2005
An updated gpdf package that fixes a security issue is now available
for Red Hat Enterprise Linux 4. This update has been rated as having
moderate security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/120062
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request@private
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
_________________________________________
Attend ToorCon
Sept 16-18th, 2005
Convention Center
San Diego, California
www.toorcon.org
This archive was generated by hypermail 2.1.3 : Mon Aug 15 2005 - 03:30:25 PDT