SecurityFocus Linux Newsletter #265
----------------------------------------
This Issue is Sponsored By: SpiDynamics
ALERT: Learn to Think Like a Hacker- Simulate a Hacker Breaking into Your Web Apps
The speed with which Web Applications are developed make them prime targets for attackers, often these applications were developed so quickly that they are not coded properly or subjected to any security testing. Hackers know this and use it as their weapon. Download this *FREE* test guide from SPI Dynamics to check for Web application vulnerabilities.
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003P6
V
------------------------------------------------------------------
I. FRONT AND CENTER
1. OpenSSH cutting edge
2. Demystifying Denial-Of-Service attacks, part one
II. LINUX VULNERABILITY SUMMARY
1. Positive Software Corporation CP+ Unspecified Perl Security Vulnerability
2. Opera Web Browser Long Title Element Bookmark Denial of Service Vulnerability
3. Opera Web Browser Download Dialog Manipulation File Execution Vulnerability
4. AppServ Open Project Remote Denial of Service Vulnerability
5. Macromedia Cold Fusion MX Multiple Vulnerabilities
6. Macromedia JRun Multiple Vulnerabilities
7. Libremail Pop.c Remote Format String Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. SF new article announcement: OpenSSH cutting edge
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. OpenSSH cutting edge
By Federico Biancuzzi
Federico Biancuzzi interviews OpenSSH developer Damien Miller to discuss features included in the upcoming version 4.3, public key crypto protocols details, timing based attacks and anti-worm measures.
http://www.securityfocus.com/columnists/375
2. Demystifying Denial-Of-Service attacks, part one
By Abhishek Singh, CISSP
This paper provides an introduction to Denial of Service (DoS) attacks, their methodologies, common prevention techniques, and how they differ from Distributed Denial of Service (DDoS) Attacks. This article is intended to be a broad overview for the beginner or intermediate-level administrator on the different types of DoS attacks.
http://www.securityfocus.com/infocus/1853
II. LINUX VULNERABILITY SUMMARY
------------------------------------
1. Positive Software Corporation CP+ Unspecified Perl Security Vulnerability
BugTraq ID: 15799
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15799
Summary:
CP+ is prone to an unspecified security vulnerability caused by a vulnerability in Perl.
Due to a lack of information, further details cannot be provided at the moment. This BID will be updated when more information becomes available.
2. Opera Web Browser Long Title Element Bookmark Denial of Service Vulnerability
BugTraq ID: 15813
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15813
Summary:
Opera Web browser is prone to a denial of service vulnerability when a Web page with a long title element is bookmarked. If this occurs, the browser will not be able to restart after it is closed.
This issue affects Opera running on Windows and Mac OS X. It also affects Japanese users and any users utilizing IME for text input.
3. Opera Web Browser Download Dialog Manipulation File Execution Vulnerability
BugTraq ID: 15835
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15835
Summary:
Opera Web Browser is prone to a remote code execution vulnerability through manipulation of dialog boxes.
An attacker can hide a 'File Download' dialog box underneath a new browser window and entice a user into double clicking a specific area in the window.
This may result in the execution of arbitrary files.
4. AppServ Open Project Remote Denial of Service Vulnerability
BugTraq ID: 15851
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15851
Summary:
AppServ Open Project is reportedly affected by a remote denial of service vulnerability.
AppServ 2.5.3 running on Microsoft Windows platforms was reported to be vulnerable. Other versions may be affected as well.
5. Macromedia Cold Fusion MX Multiple Vulnerabilities
BugTraq ID: 15904
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15904
Summary:
Macromedia ColdFusion MX is affect by multiple vulnerabilities.
The following four issues were reported:
- A security vulnerabilty related to the JRun clustered sandbox. This issue affects Macromedia ColdFusion MX 6.0, 6.1. 6.1 with JRun, and 7.0.
- An input validation vulnerability related to the CFMAIL tag. This issue affects Macromedia ColdFusion MX 6.0, 6.1. 6.1 with JRun, and 7.0.
- A security vulnerability related to the CFOBJECT/CreateObject sandbox security setting. This issue affects ColdFusion MX 7.0.
- A security vulnerability that could expose the ColdFusion Administrator password hash to unauthorized parties. This issue affects ColdFusion MX 7.0.
6. Macromedia JRun Multiple Vulnerabilities
BugTraq ID: 15905
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15905
Summary:
Macromedia JRun is affected by multiple security vulnerabilities.
The following issues were reported:
- Multiple vulnerabilities that let remote users gain unauthorized access to Web application source code.
- A denial of service vulnerability in the JRun Web Server component.
7. Libremail Pop.c Remote Format String Vulnerability
BugTraq ID: 15906
Remote: Yes
Date Published: 2005-12-16
Relevant URL: http://www.securityfocus.com/bid/15906
Summary:
Libremail is susceptible to a remote format string vulnerability.
This issue presents itself in the 'pop.c' file, when the application processes specially crafted data from a POP server.
This issue allows remote attackers to execute arbitrary machine code in the context of the affected application. A denial of service condition may arise due to failed exploitation attempts as well.
Libremail 1.1.0 and prior versions are affected.
III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. SF new article announcement: OpenSSH cutting edge
http://www.securityfocus.com/archive/91/419888
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe (at) securityfocus (dot) com [email concealed] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email listadmin (at) securityfocus (dot) com [email concealed] and ask to be manually removed.
V. SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: SpiDynamics
ALERT: Learn to Think Like a Hacker- Simulate a Hacker Breaking into Your Web Apps
The speed with which Web Applications are developed make them prime targets for attackers, often these applications were developed so quickly that they are not coded properly or subjected to any security testing. Hackers know this and use it as their weapon. Download this *FREE* test guide from SPI Dynamics to check for Web application vulnerabilities.
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003P6
V
----------------------------------------
This Issue is Sponsored By: SpiDynamics
ALERT: Learn to Think Like a Hacker- Simulate a Hacker Breaking into Your Web Apps
The speed with which Web Applications are developed make them prime targets for attackers, often these applications were developed so quickly that they are not coded properly or subjected to any security testing. Hackers know this and use it as their weapon. Download this *FREE* test guide from SPI Dynamics to check for Web application vulnerabilities.
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003P6
V
------------------------------------------------------------------
I. FRONT AND CENTER
1. OpenSSH cutting edge
2. Demystifying Denial-Of-Service attacks, part one
II. LINUX VULNERABILITY SUMMARY
1. Positive Software Corporation CP+ Unspecified Perl Security Vulnerability
2. Opera Web Browser Long Title Element Bookmark Denial of Service Vulnerability
3. Opera Web Browser Download Dialog Manipulation File Execution Vulnerability
4. AppServ Open Project Remote Denial of Service Vulnerability
5. Macromedia Cold Fusion MX Multiple Vulnerabilities
6. Macromedia JRun Multiple Vulnerabilities
7. Libremail Pop.c Remote Format String Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. SF new article announcement: OpenSSH cutting edge
IV. UNSUBSCRIBE INSTRUCTIONS
V. SPONSOR INFORMATION
I. FRONT AND CENTER
---------------------
1. OpenSSH cutting edge
By Federico Biancuzzi
Federico Biancuzzi interviews OpenSSH developer Damien Miller to discuss features included in the upcoming version 4.3, public key crypto protocols details, timing based attacks and anti-worm measures.
http://www.securityfocus.com/columnists/375
2. Demystifying Denial-Of-Service attacks, part one
By Abhishek Singh, CISSP
This paper provides an introduction to Denial of Service (DoS) attacks, their methodologies, common prevention techniques, and how they differ from Distributed Denial of Service (DDoS) Attacks. This article is intended to be a broad overview for the beginner or intermediate-level administrator on the different types of DoS attacks.
http://www.securityfocus.com/infocus/1853
II. LINUX VULNERABILITY SUMMARY
------------------------------------
1. Positive Software Corporation CP+ Unspecified Perl Security Vulnerability
BugTraq ID: 15799
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15799
Summary:
CP+ is prone to an unspecified security vulnerability caused by a vulnerability in Perl.
Due to a lack of information, further details cannot be provided at the moment. This BID will be updated when more information becomes available.
2. Opera Web Browser Long Title Element Bookmark Denial of Service Vulnerability
BugTraq ID: 15813
Remote: Yes
Date Published: 2005-12-12
Relevant URL: http://www.securityfocus.com/bid/15813
Summary:
Opera Web browser is prone to a denial of service vulnerability when a Web page with a long title element is bookmarked. If this occurs, the browser will not be able to restart after it is closed.
This issue affects Opera running on Windows and Mac OS X. It also affects Japanese users and any users utilizing IME for text input.
3. Opera Web Browser Download Dialog Manipulation File Execution Vulnerability
BugTraq ID: 15835
Remote: Yes
Date Published: 2005-12-13
Relevant URL: http://www.securityfocus.com/bid/15835
Summary:
Opera Web Browser is prone to a remote code execution vulnerability through manipulation of dialog boxes.
An attacker can hide a 'File Download' dialog box underneath a new browser window and entice a user into double clicking a specific area in the window.
This may result in the execution of arbitrary files.
4. AppServ Open Project Remote Denial of Service Vulnerability
BugTraq ID: 15851
Remote: Yes
Date Published: 2005-12-14
Relevant URL: http://www.securityfocus.com/bid/15851
Summary:
AppServ Open Project is reportedly affected by a remote denial of service vulnerability.
AppServ 2.5.3 running on Microsoft Windows platforms was reported to be vulnerable. Other versions may be affected as well.
5. Macromedia Cold Fusion MX Multiple Vulnerabilities
BugTraq ID: 15904
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15904
Summary:
Macromedia ColdFusion MX is affect by multiple vulnerabilities.
The following four issues were reported:
- A security vulnerabilty related to the JRun clustered sandbox. This issue affects Macromedia ColdFusion MX 6.0, 6.1. 6.1 with JRun, and 7.0.
- An input validation vulnerability related to the CFMAIL tag. This issue affects Macromedia ColdFusion MX 6.0, 6.1. 6.1 with JRun, and 7.0.
- A security vulnerability related to the CFOBJECT/CreateObject sandbox security setting. This issue affects ColdFusion MX 7.0.
- A security vulnerability that could expose the ColdFusion Administrator password hash to unauthorized parties. This issue affects ColdFusion MX 7.0.
6. Macromedia JRun Multiple Vulnerabilities
BugTraq ID: 15905
Remote: Yes
Date Published: 2005-12-15
Relevant URL: http://www.securityfocus.com/bid/15905
Summary:
Macromedia JRun is affected by multiple security vulnerabilities.
The following issues were reported:
- Multiple vulnerabilities that let remote users gain unauthorized access to Web application source code.
- A denial of service vulnerability in the JRun Web Server component.
7. Libremail Pop.c Remote Format String Vulnerability
BugTraq ID: 15906
Remote: Yes
Date Published: 2005-12-16
Relevant URL: http://www.securityfocus.com/bid/15906
Summary:
Libremail is susceptible to a remote format string vulnerability.
This issue presents itself in the 'pop.c' file, when the application processes specially crafted data from a POP server.
This issue allows remote attackers to execute arbitrary machine code in the context of the affected application. A denial of service condition may arise due to failed exploitation attempts as well.
Libremail 1.1.0 and prior versions are affected.
III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. SF new article announcement: OpenSSH cutting edge
http://www.securityfocus.com/archive/91/419888
IV. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe (at) securityfocus (dot) com [email concealed] from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.
If your email address has changed email listadmin (at) securityfocus (dot) com [email concealed] and ask to be manually removed.
V. SPONSOR INFORMATION
------------------------
This Issue is Sponsored By: SpiDynamics
ALERT: Learn to Think Like a Hacker- Simulate a Hacker Breaking into Your Web Apps
The speed with which Web Applications are developed make them prime targets for attackers, often these applications were developed so quickly that they are not coded properly or subjected to any security testing. Hackers know this and use it as their weapon. Download this *FREE* test guide from SPI Dynamics to check for Web application vulnerabilities.
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003P6
V
[ reply ]