SecurityFocus Linux Newsletter #370

SecurityFocus Linux Newsletter #370
----------------------------------------

This issue is Sponsored by: Black Hat DC

Attend Black Hat DC, February 18-21, the Washington, DC version of the wo=
rld's premier technical event for ICT security experts. Featuring hands-o=
n training courses and Briefings presentations with lots of new content-i=
ncluding a focus on wireless security and offensive attack analysis.  Net=
work with 400+ delegates and review products from leading vendors in a re=
laxed setting, including Diamond sponsor Microsoft.=20
www.blackhat.com


SECURITY BLOGS
SecurityFocus has selected a few syndicated sources that stand out as con=
veying topics of interest for our community. We are proud to offer conten=
t from Matasano at this time and will be adding more in the coming weeks.
http://www.securityfocus.com/blogs

------------------------------------------------------------------
I.   FRONT AND CENTER
       1.Real Flaws in Virtual Worlds
       2.Copyrights and Wrongs
II.  LINUX VULNERABILITY SUMMARY
       1. Bitflu StorageFarabDb Module '.torrent' File Handling Security =
Bypass Vulnerability
       2. ClamAV BZ_GET_FAST Bzip2 Decompression Vulnerability
III. LINUX FOCUS LIST SUMMARY
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1.Real Flaws in Virtual Worlds
By Federico Biancuzzi
Massively multiplayer online role playing games (MMORPGs), such as World =
of Warcraft, have millions of subscribers interacting online, which makes=
 security tricky business.=20
http://www.securityfocus.com/columnists/461

2.Copyrights and Wrongs
By Mark Rasch
On October 1, 2007, Jammie Thomas -- a single mother living in Brainerd, =
Minnesota -- was sued in civil court for copyright infringement by the Re=
cording Industry Association of America. Three days later, the jury retur=
ned the verdict; Ms. Thomas was liable for willfully infringing the copyr=
ights on 24 songs. The fine: $222,000.=20
http://www.securityfocus.com/columnists/460


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Bitflu StorageFarabDb Module '.torrent' File Handling Security Bypass =
Vulnerability
BugTraq ID: 27043
Remote: Yes
Date Published: 2007-12-26
Relevant URL: http://www.securityfocus.com/bid/27043
Summary:
Bitflu is prone to a security-bypass vulnerability.

An attacker can exploit this issue to append to or create arbitrary files=
.

This issue affects versions of Bitflu prior to 0.42.

2. ClamAV BZ_GET_FAST Bzip2 Decompression Vulnerability
BugTraq ID: 27063
Remote: Yes
Date Published: 2007-12-29
Relevant URL: http://www.securityfocus.com/bid/27063
Summary:
ClamAV is prone to a vulnerability due to a flaw in its Bzip2 decompressi=
on support.

Successful exploits of this vulnerability may potentially allow remote at=
tackers to execute arbitrary code in the context of the vulnerable applic=
ation or to trigger denial-of-service conditions. These affects have not =
been confirmed.

Further information is not currently available; this BID will be updated =
as more information is disclosed.

ClamAV 0.91.2 is vulnerable to this issue; other versions may also be aff=
ected.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securi=
tyfocus.com from the subscribed address. The contents of the subject or m=
essage body do not matter. You will receive a confirmation request messag=
e to which you will have to answer. Alternatively you can also visit http=
://www.securityfocus.com/newsletters and unsubscribe via the website.=20

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is Sponsored by: Black Hat DC

Attend Black Hat DC, February 18-21, the Washington, DC version of the wo=
rld's premier technical event for ICT security experts. Featuring hands-o=
n training courses and Briefings presentations with lots of new content-i=
ncluding a focus on wireless security and offensive attack analysis.  Net=
work with 400+ delegates and review products from leading vendors in a re=
laxed setting, including Diamond sponsor Microsoft.=20
www.blackhat.com