SecurityFocus Linux Newsletter #104
John Boletta <[email protected]> Mon, 28 Oct 2002 13:34:24 -0700 (MST)
| Newsgroups | gmane.comp.security.news.linux |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Linux Newsletter #104
-----------------------------------
This Issue Is Sponsored By: CipherTrust
Choking on Spam? Protect your Sendmail, Exchange, Groupwise and Notes
servers against spam and other threats with IronMail, the secure gateway
appliance from CipherTrust.
Request our newest white paper, "The Top 10 Techniques To Control Spam For
The Enterprise."
http://www.ciphertrust.com/article/securityfocus_1028_02.htm
-------------------------------------------------------------------------------
I. FRONT AND CENTER
1. Reverse Engineering Hostile Code
2. Certifiably Certified
3. SecurityFocus DPP Program
4. InfoSec World Conference and Expo/2003
5. Proactive Network Security Guide from Qualys
II. LINUX VULNERABILITY SUMMARY
1. Multiple Linux Kernel 2.4.18 Security Vulnerabilities
2. Linux PCILynx FireWire Driver 2.4 Kernel Privilege Elevation...
3. Multiple Linux Kernel 2.2 Security Vulnerabilities
4. Multiple VBulletin Cross Site Scripting Vulnerabilities
5. Perlbot Remote Command Execution Vulnerability
6. PHP Arena PAFileDB Email To Friend Cross-Site Scripting...
7. PHP Arena PAFileDB Rate File Cross-Site Scripting Vulnerability
8. Linux IXJ Telephony Card Driver 2.4 Kernel Privilege Elevation...
9. Perlbot Email Sending Remote Command Execution Vulnerability
10. Fragrouter Trojan Horse Vulnerability
11. Mod_SSL Wildcard DNS Cross Site Scripting Vulnerability
12. Virgil CGI Scanner Remote Command Execution Vulnerability
13. Linux BTTV Video Capture Card Driver 2.4 Kernel Privilege...
14. Linux PAM Authentication Bypass Vulnerability
15. PHP Arena PAFileDB Download Cross-Site Scripting Vulnerability
16. YaBB Login Cross-Site Scripting Vulnerability
17. Hans Persson Molly Multiple Remote Command Execution...
18. Perlbot Text Variable Remote Command Execution Vulnerability
19. Perlbot Filename Variable Remote Command Execution Vulnerability
20. YPServ Remote Network Information Leakage Vulnerability
21. PHP Arena PAFileDB Search Cross-Site Scripting Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. Continuous medium traffic fake Syn packets (Thread)
2. iptables firewall and forwarding. (Thread)
3. Linux FTP/Firewall combo suggestion requested (Thread)
4. How to get rid of spoofed IP-Address responses (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. SMART Extractor
2. Immunix
V. NEW TOOLS FOR LINUX PLATFORMS
1. CRM114 v2002-10-24
2. Rule Set Based Access Control v1.2.1
3. ggsniff v1.1d
VI. SPONSORSHIP INFORMATION
I. FRONT AND CENTER
-------------------
1. Reverse Engineering Hostile Code
By Joe Stewart
This article outlines the process of reverse engineering hostile code.
Armed with this knowledge, even someone who is not an expert at assembly
language programming should be able to look at the internals of a hostile
program and determine what it is doing, at least on a surface level.
http://online.securityfocus.com/infocus/1637
2. Certifiably Certified
By Richard Forno
Despite impressive acronyms that look great on a resume, security
certifications don't guarantee that the holder is qualified to secure
vital information.
http://online.securityfocus.com/columnists/118
3. SecurityFocus DPP Program
Attention Organizations and Universities!! Sign-up now for preferred
pricing on the only global early-warning system for cyber attacks -
SecurityFocus DeepSight Threat Management System.
Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml
4. IIR's 3G Fraud & Security Forum (21-23 October, London)
A specialized conference designed specifically for Fraud and Security
Managers in the 3G and mobile commerce space. This year's agenda focuses
on technical strategies for detecting and minimizing the fraud risks in 3G
services: what will be the key vulnerabilities in 3G and how can you
manage the increased risks of content partner fraud, transaction-based
roaming and m-commerce fraud? We will also be devoting a whole day to 3G
network security - penetration testing, third party access risks, IDS,
with even a live hack demonstration of Internet fraud.
Key speakers include Radicchio, Orange, Optimus, Vodafone, Visa, BTexact,
CFCA, with a keynote from security guru Charles Brookson, Chair of the GSM
Association Security Group.
For more details please visit http://www.iir-conferences.com/3GFraud
5. Proactive Network Security: FREE Guide
Fight back against hackers-AUTOMATICALLY. New FREE Guide shows you how to
deploy full service vulnerability assessment solution for your NETWORK and
simplify your security audits--with anywhere, anytime, on-demand browser
access. Click here now to get a head-start on hackers!
https://www.qualys.com/forms/guide_228.php
II. BUGTRAQ SUMMARY
-------------------
1. Multiple Linux Kernel 2.4.18 Security Vulnerabilities
BugTraq ID: 5983
Remote: No
Date Published: Oct 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5983
Summary:
Red Hat has issued an advisory reporting the correction of several
vulnerabilities in version 2.4.18 of the Linux kernel. Some of the
security issues are related to the following device drivers:
ixj - telephony card driver
pcilynx - firewire driver
bttv - video capture card driver
It should be assumed that at the very least, local attackers may exploit
these vulnerabilities to elevate privileges.
SecurityFocus is currently completing analysis of the reported
vulnerabilities and will issue individual alerts for each.
2. Linux PCILynx FireWire Driver 2.4 Kernel Privilege Elevation Vulnerability
BugTraq ID: 5987
Remote: No
Date Published: Oct 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5987
Summary:
An unspecified vulnerability has been announced in the Linux 2.4 kernel
which may enable local attackers to gain elevated privileges.
This vulnerability is reported to exist in the pcilynx FireWire driver
that is included in affected versions of the Linux kernel. Since the
issue is at the kernel level, it would be possible for a local attacker to
gain root privileges if the vulnerability is successfully exploited.
It is also likely that an attacker could cause a denial of service by
exploiting this issue.
This record will be updated if further details become available.
** This issue was originally described in Bugtraq ID 5983 and is now being
assigned it's own Bugtraq ID.
3. Multiple Linux Kernel 2.2 Security Vulnerabilities
BugTraq ID: 5984
Remote: No
Date Published: Oct 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5984
Summary:
Red Hat has issued an advisory reporting the correction of several
vulnerabilities in version 2.2 of the Linux kernel.
It should be assumed that at the very least, local attackers may exploit
these vulnerabilities to elevate privileges. The vulnerabilities are
reported to be related to sign handling, maths overflows and casting
errors.
Since these issues exist at the kernel level, a local attacker could gain
root privileges through successful exploitation.
These vulnerabilities may be related to the vulnerabilities described in
BugTraq ID 5983.
4. Multiple VBulletin Cross Site Scripting Vulnerabilities
BugTraq ID: 5997
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5997
Summary:
vBulletin is commercial web forum software written in PHP and back-ended
by a MySQL database. It will run on most Linux and Unix variants, as well
as Microsoft operating systems.
vBulletin does not filter HTML tags from URI parameters, making it prone
to cross-site scripting attacks. The vulnerability exists due to
inadequate filtering of the '$scriptpath' and '$url' parameters. The
contents of these variables will be displayed in a few error pages.
As a result, it is possible for a remote attacker to create a malicious
link containing script code which will be executed in the browser of a
legitimate user, in the context of the website running vBulletin.
This issue may be exploited to steal cookie-based authentication
credentials from legitimate users of the website running the vulnerable
software. Cookie-based authentication credentials may be used by the
attacker to hijack the session of the legitimate user.
5. Perlbot Remote Command Execution Vulnerability
BugTraq ID: 5998
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5998
Summary:
Perlbot is an IRC bot written in Perl. It depends on Net::IRC and its
goals are simplicity and modularity. It is available for Linux and Unix
operating systems.
A remote command execution vulnerability has been discovered in Perlbot
v1.0 beta.
Reportedly, the script does not properly sanitize the input for the
'$word' variable. Additionally, this input is passed through a function
which invokes the shell directly. If a user enters a command into this
variable, the commands will executed on the host with the privileges of
Perlbot.
This issue was reported for Perlbot v1.0 beta.
6. PHP Arena PAFileDB Email To Friend Cross-Site Scripting Vulnerability
BugTraq ID: 6018
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6018
Summary:
PHP Arena paFileDB is an application which allows webmasters to post files
for download on a website. It is implemented in PHP and is available for
Unix and Linux variants as well as Microsoft Windows operating systems.
paFileDB is prone to cross-site scripting attacks.
An attacker may construct a malicious link to the vulnerable script which
contains arbitrary HTML and script code. If this link is visited by a web
user, the attacker-supplied code will execute in their web client in the
security context of the paFileDB site.
This issue is in the "Email to Friend" function of the paFileDB script.
An attacker may potentially exploit this to steal cookie-based
authentication credentials. Other attacks are also possible.
7. PHP Arena PAFileDB Rate File Cross-Site Scripting Vulnerability
BugTraq ID: 6019
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6019
Summary:
PHP Arena paFileDB is an application which allows webmasters to post files
for download on a website. It is implemented in PHP and is available for
Unix and Linux variants as well as Microsoft Windows operating systems.
paFileDB is prone to cross-site scripting attacks.
An attacker may construct a malicious link to the vulnerable script which
contains arbitrary HTML and script code. If this link is visited by a web
user, the attacker-supplied code will execute in their web client in the
security context of the paFileDB site.
This issue is in the "Rate File" function of the paFileDB script.
An attacker may potentially exploit this to steal cookie-based
authentication credentials. Other attacks are also possible.
8. Linux IXJ Telephony Card Driver 2.4 Kernel Privilege Elevation Vulnerability
BugTraq ID: 5985
Remote: No
Date Published: Oct 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5985
Summary:
An unspecified vulnerability has been announced in the Linux 2.4 kernel
which may enable local attackers to gain elevated privileges.
This vulnerability is reported to exist in the ixj telephony card driver
that is included in affected versions of the Linux kernel. Since the
issue is at the kernel level, it would be possible for a local attacker to
gain root privileges if the vulnerability is successfully exploited.
It is also likely that an attacker could cause a denial of service by
exploiting this issue.
This record will be updated if further details become available.
** This issue was originally described in Bugtraq ID 5983 and is now being
assigned it's own Bugtraq ID.
9. Perlbot Email Sending Remote Command Execution Vulnerability
BugTraq ID: 5999
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5999
Summary:
Perlbot is an IRC bot written in Perl. It depends on Net::IRC and its
goals are simplicity and modularity. It is available for Linux and Unix
operating systems.
A remote command execution vulnerability has been discovered in Perlbot
v1.0 beta.
Reportedly, the script does not properly sanitize the input for the
'$recipient' variable. Additionally, this input is passed through the
open() function which invokes the shell directly. If a user enters a
command into this variable, the commands will executed on the host with
the privileges of Perlbot.
This issue was reported for Perlbot v1.0 beta.
10. Fragrouter Trojan Horse Vulnerability
BugTraq ID: 6022
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6022
Summary:
fragrouter is a freely available, open source intrusion detection evasion
tool. It is available for the Unix and Linux operating systems.
It has been announced that the server hosting fragrouter, www.anzen.com,
was compromised recently. It has been reported that the intruder made
modifications to the source code of fragrouter to include trojan horse
code. Downloads of the fragrouter source code from www.anzen.com between
October 18, 2002 and October 19, 2002 likely contain the trojan code.
Reports say that the trojan will run once upon compilation of fragrouter.
Once the trojan is executed, it attempts to connect to host
210.224.164.100 on port 6667.
Although unconfirmed, it has been reported that the service listening on
port 6667 of host 210.224.164.100 has been disabled.
It is not known whether, or what other sites are affected in addition to
www.anzen.com.
The maintainers of fragrouter have stated that the fragrouter source code
has not been maintained since release 1.6, a period of approximately 3
years, and that release 1.7 is bogus. The MD5 hash of the bogus release
is 8329c34704287a1fb1e5d6f1ba81f456.
The posting of the trojaned version of fragrouter was additionally
announced on the cisco-nsp and linux-kernel mailing lists. Additionally,
the trojan displays similarity to those found in irssi, fragroute, BitchX,
OpenSSH, and Sendmail.
11. Mod_SSL Wildcard DNS Cross Site Scripting Vulnerability
BugTraq ID: 6029
Remote: Yes
Date Published: Oct 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6029
Summary:
Mod_SSL is an implementation of SSL (Secure Socket Layer) for the Apache
webserver. The Apache HTTP Server is a popular open-source HTTP server for
multiple platforms, including Windows and Unix.
A cross site scripting vulnerability has been discovered in mod_ssl.
It has been reported that Apache v1.x, when using the mod_ssl module will
return an unescaped server name in response to HTTP requests on SSL ports.
When Apache must construct a self-referencing URL, it will behave in one
of two manners, depending on the value of the 'UseCanonicalName' option.
With the option enabled, Apache will use the ServerName and Port values to
form a canonical name. With this option turned off, Apache will attempt to
use the hostname and port supplied by the client.
It should be noted that the existance of this vulnerability is limited to
configurations with both the 'UseCanonicalName' option turned off and
wildcard DNS enabled.
If all of these circumstances are met, an attacker may be able to exploit
this issue via a malicious link containing arbitrary HTML and script code
as part of the hostname. When the malicious link is clicked by an
unsuspecting user, the attacker-supplied HTML and script code will be
executed by their web client. This will occur because the server will echo
back the malicious hostname supplied in the client's request, without
sufficiently escaping HTML and script code.
An attacker may exploit this vulnerability by enticing a victim user to
follow a malicious link. Attacker-supplied HTML and script code may be
executed on a web client visiting the malicious link in the context of the
webserver.
Attacks of this nature may make it possible for attackers to manipulate
web content or to steal cookie-based authentication credentials. It may be
possible to take arbitrary actions as the victim user.
12. Virgil CGI Scanner Remote Command Execution Vulnerability
BugTraq ID: 6031
Remote: Yes
Date Published: Oct 22 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6031
Summary:
Virgil CGI Scanner is a remote vulnerability auditing tool written in the
Bash Scripting language. It is available for the Linux and Unix operating
systems.
A vulnerability has been discovered in Virgil CGI Scanner.
It has been reported that the Virgil CGI Scanner fails to sufficiently
sanitize user-supplied input in the $TARGET and $ZIELPORT variables. The
software passes these variables as part of a command line argument,
potentially allowing characters to be passed, which could cause arbitrary
commands to be executed.
By exploiting this issue, a remote attacker may be able to cause arbitrary
commands to be executed on the system, with the privileges of the
webserver process.
13. Linux BTTV Video Capture Card Driver 2.4 Kernel Privilege Elevation Vulnerability
BugTraq ID: 5989
Remote: No
Date Published: Oct 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5989
Summary:
An unspecified vulnerability has been announced in the Linux 2.4 kernel
which may enable local attackers to gain elevated privileges.
This vulnerability is reported to exist in the bttv video capture card
driver that is included in affected versions of the Linux kernel. Since
the issue is at the kernel level, it would be possible for a local
attacker to gain root privileges if the vulnerability is successfully
exploited.
It is also likely that an attacker could cause a denial of service by
exploiting this issue.
This record will be updated if further details become available.
** This issue was originally described in Bugtraq ID 5983 and is now being
assigned it's own Bugtraq ID.
14. Linux PAM Authentication Bypass Vulnerability
BugTraq ID: 5994
Remote: Yes
Date Published: Oct 17 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/5994
Summary:
Debian has reported a vulnerability in Linux PAM that may result in remote
intruders gaining unauthorized access to systems. According to the
report, vulnerable versions of PAM treat "locked" passwords (value of "*"
in /etc/passwd) as no password. Consequently, remote users may login as
blocked users without supplying any credentials. Provided that a
functional shell is designated for the user, remote attackers may exploit
this vulnerability to gain local access to target systems.
It may be that only version 0.76 is vulnerable, however this is not
confirmed. Administrators who have users that have "locked" password
values are advised to also set non-functional shells for the users.
15. PHP Arena PAFileDB Download Cross-Site Scripting Vulnerability
BugTraq ID: 6020
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6020
Summary:
PHP Arena paFileDB is an application which allows webmasters to post files
for download on a website. It is implemented in PHP and is available for
Unix and Linux variants as well as Microsoft Windows operating systems.
paFileDB is prone to cross-site scripting attacks.
An attacker may construct a malicious link to the vulnerable script which
contains arbitrary HTML and script code. If this link is visited by a web
user, the attacker-supplied code will execute in their web client in the
security context of the paFileDB site.
This issue is in the "Download" function of the paFileDB script.
An attacker may potentially exploit this to steal cookie-based
authentication credentials. Other attacks are also possible.
16. YaBB Login Cross-Site Scripting Vulnerability
BugTraq ID: 6004
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6004
Summary:
YaBB (Yet Another Bulletin Board) is freely available web forum software
that is written in Perl. YaBB will run on most Unix/Linux variants, MacOS,
and Microsoft Windows 9x/ME/NT/2000/XP platforms.
A cross-site scripting vulnerability has been reported in the YaBB forum
login script. When a user enters an erroneous username/password, the YaBB
forum login script will display an error page containing the values the
user entered. However, HTML tags or script code are not sanitized from
the password error output.
As a result, it is possible for a remote attacker to create a malicious
link to the login page of a site hosting the web forum. The malicious
link may contain arbitrary HTML and script code in the password field.
When this link is visited by an unsuspecting web user, the
attacker-supplied code will be executed in their browser in the security
context of the vulnerable website.
It has been demonstrated that this vulnerability may be exploited to steal
cookie-based authentication credentials. Furthermore, once an attacker
has hijacked a user's session with the credentials it is possible to
change that user's password without needing to further authenticate.
17. Hans Persson Molly Multiple Remote Command Execution Vulnerabilities
BugTraq ID: 6007
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6007
Summary:
Molly is a small IRC bot that is intended for use in intra-office
environments. It is written in Perl and is maintained by Hans Persson. It
is available for Unix and Linux variant operating systems.
Several remote command execution vulnerabilities have been discovered in
Molly v0.5.
The script 'plugins/nslookup.pl' does not adequately sanitize the input
for the '$host' variable. Additionally, this variable is passed, without
any checks, through the script and invokes the shell directly. If a user
enters a command into this variable, the commands will executed on the
host with the privileges of Molly.
Other script files that exist in the unsupported 'unusedplugins' folder
are also vulnerable to similar attacks. The files are called 'sms.pl',
'pop.pl', and 'hpled.pl'.
18. Perlbot Text Variable Remote Command Execution Vulnerability
BugTraq ID: 6008
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6008
Summary:
Perlbot is an IRC bot written in Perl. It depends on Net::IRC and its
goals are simplicity and modularity. It is available for Linux and Unix
operating systems.
A remote command execution vulnerability has been discovered in Perlbot
v1.0 beta.
Reportedly, the Plugins/Misc/SpelCheck/SpelCheck.pm script fails to
properly sanitize the input for the '$text' variable. Additionally, this
input is passed through a function which invokes the shell directly. If a
user enters a semi-colon (;) followed by a command into this variable,
attacker-supplied commands will executed on the host with the privileges
of Perlbot.
This issue was reported for Perlbot v1.9.2.
19. Perlbot Filename Variable Remote Command Execution Vulnerability
BugTraq ID: 6009
Remote: Yes
Date Published: Oct 18 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6009
Summary:
Perlbot is an IRC bot written in Perl. It depends on Net::IRC and its
goals are simplicity and modularity. It is available for Linux and Unix
operating systems. A remote command execution vulnerability has been
discovered in Perlbot v1.0 beta.
Reportedly, the 'Plog.pl' script does not properly sanitize the input for
the '$filename variable. Additionally, this input is passed through the
open() function which invokes the shell directly. If a user enters a
command into this variable, the commands will executed on the host with
the privileges of Perlbot.
This issue was reported for Perlbot v1.0 beta.
20. YPServ Remote Network Information Leakage Vulnerability
BugTraq ID: 6016
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6016
Summary:
The ypserv daemon is a component of the Network Information Service (NIS),
and is available for Linux and Unix operating systems.
A remotely exploitable information leakage vulnerablity has been
discovered in the ypserv daemon. Versions prior to 2.5 are affected.
The 'lib/yp_db.c' file fails to verify whether a request map exists before
allocating memory for needed space, resulting in memory leakage. It has
been reported that by passing a malicious reqest for a non-existing map to
the ypserv daemon, a remote attacker could potentially access information
from an old domainname and mapname.
Information obtained through exploiting this issue may aid an attacker in
launching further attacks against the target network.
It should be noted that this issue may be similar to the issue described
in bid 5914.
21. PHP Arena PAFileDB Search Cross-Site Scripting Vulnerability
BugTraq ID: 6021
Remote: Yes
Date Published: Oct 21 2002 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6021
Summary:
PHP Arena paFileDB is an application which allows webmasters to post files
for download on a website. It is implemented in PHP and is available for
Unix and Linux variants as well as Microsoft Windows operating systems.
paFileDB is prone to cross-site scripting attacks.
An attacker may construct a malicious link to the vulnerable script which
contains arbitrary HTML and script code. If this link is visited by a web
user, the attacker-supplied code will execute in their web client in the
security context of the paFileDB site.
This issue is reported to be exploitable by providing HTML and script code
as a search string.
An attacker may potentially exploit this to steal cookie-based
authentication credentials. Other attacks are also possible.
III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. Continuous medium traffic fake Syn packets (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/296849
2. iptables firewall and forwarding. (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/296618
3. Linux FTP/Firewall combo suggestion requested (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/296614
4. How to get rid of spoofed IP-Address responses (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/296452
IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. SMART Extractor
by WetStone Technologies
Platforms: Linux
Relevant URL:
http://www.wetstonetech.com/extractor.html
WetStone Technologies, SM&A, the Computer Forensics Research and
Development Center (CFRDC), and the New York State Police Forensic
Investigation Center (NYSPFIC) have developed the Extractor, a Linux
RedHat® deleted file recovery tool. The technology can assist law
enforcement, government and commercial organizations in retrieving
maliciously or accidentally deleted files within the increasingly poplular
Linux operating system environment.
2. Immunix
by WireX
Platforms: Linux
Relevant URL:
http://online.securityfocus.com/products/1317
"Immunix" is a family of tools designed to enhance system integrity by
hardening system components and platforms against security attacks. The
Immunix OS is a Linux platform hardened with the Immunix tool set.
V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. CRM114 v2002-10-24
by Crah the Merciless
Relevant URL:
http://crm114.sourceforge.net/
Platforms: Linux, POSIX
Summary:
CRM114 is a Controllable Regex Mutilator and Smart Filter, designed for
easy creation of filters for things like incoming mail, system logs, or
monitoring processes. Filtering rules can be either hard-coded (such as
regexes), soft-coded (calculated at runtime or read from an external file
or process), or learned dynamically by phrase matching (by SBPH hashing).
This makes it possible to create very accurate filters with very little
actual work.
2. Rule Set Based Access Control v1.2.1
by Amon Ott [email protected]
Relevant URL:
http://www.rsbac.org/
Platforms: Linux
Summary:
Rule Set Based Access Control (RSBAC) is a Free Software security
extension for current Linux kernels. It is based on the Generalized
Framework for Access Control (GFAC) by Abrams and LaPadula and provides a
flexible system of access control based on several modules. All security
relevant system calls are extended by security enforcement code. This code
calls the central decision component, which in turn calls all active
decision modules and generates a combined decision. This decision is then
enforced by the system call extensions.
3. ggsniff v1.1d
by Ryba
Relevant URL:
http://sourceforge.net/projects/ggsniff/
Platforms: Linux, POSIX
Summary:
ggsniff is a sniffer that allows you to record Gadu-Gadu messages. It is
not currently a standalone application. Rather, it is a patch for dsniff
that adds the ability to record Gadu-Gadu messages to msgsnarf.
VI. SPONSORSHIP INFORMATION
---------------------------
This Issue Is Sponsored By: CipherTrust
Choking on Spam? Protect your Sendmail, Exchange, Groupwise and Notes
servers against spam and other threats with IronMail, the secure gateway
appliance from CipherTrust.
Request our newest white paper, "The Top 10 Techniques To Control Spam For
The Enterprise."
http://www.ciphertrust.com/article/securityfocus_1028_02.htm
-------------------------------------------------------------------------------