SecurityFocus Linux Newsletter #442

SecurityFocus Linux Newsletter #442
----------------------------------------

This issue is sponsored by VeriSign

VeriSign EV SSL Certificates for your sites' security turn the address ba=
r in high security browsers green which helps your customers know they ar=
e safe on your site.

http://ad.doubleclick.net/clk;215510135;37701660;s


------------------------------------------------------------------
I.   FRONT AND CENTER
       1. Hacker-Tool Law Still Does Little
       2. A Botnet by Any Other Name
II.  LINUX VULNERABILITY SUMMARY
       1. Computer Associates ARCserve Backup Message Engine Denial of Se=
rvice Vulnerability
       2. RETIRED: Sun Java Runtime Environment Aqua Look and Feel Privil=
ege Escalation Vulnerability
       3. Multiple Sophos Products CAB File Scan Evasion Vulnerability
       4. Multiple Browsers Cached Certificate HTTP Site Spoofing Vulnera=
bility
       5. Multiple F-PROT Products RAR/ARJ/LHA/LZH File Scan Evasion Vuln=
erability
       6. PHP 'exif_read_data()' JPEG Image Processing Denial Of Service =
Vulnerability
       7. PCSC-Lite Local Insecure File Permissions Vulnerability
       8. strongSwan Crafted X.509 Certificate Multiple Remote Denial Of =
Service Vulnerabilities
       9. Mozilla Thudnerbird/Seamonkey Multipart Alternative Message Mem=
ory Corruption Vulnerability
       10. Samba Format String And Security Bypass Vulnerabilities
       11. Net-SNMP GETBULK Divide By Zero Remote Denial of Service Vulne=
rability
       12. Gizmo5 for Linux MSN Authentication SSL Certificate Validation=
 Security Bypass Vulnerability
III. LINUX FOCUS LIST SUMMARY
       1. CHASE - 2009 Lahore Pakistan | Call for Papers
       2. Hardening CentOS
IV.  UNSUBSCRIBE INSTRUCTIONS
V.   SPONSOR INFORMATION

I.   FRONT AND CENTER
---------------------
1. Hacker-Tool Law Still Does Little
By Mark Rasch
On August 10, 2007, a new section of the German Penal code went into effe=
ct. The statute, intended to implement certain provisions of the Council =
of Europe Treaty on Cybercrime, could be interpreted to make the creation=
 or distribution of computer security software a criminal offense.=20
http://www.securityfocus.com/columnists/502

2. A Botnet by Any Other Name
By Gubter Ollmann
The news has been awash the last few weeks with fears over globe-spanning=
 botnets and their criminal intent: Conficker managed to hog the limeligh=
t for well over a month, and then came Finjan's disclosure of a previousl=
y unknown - and currently unnamed - botnet consisting of some 1.9 million=
 malicious agents.=20
http://www.securityfocus.com/columnists/501


II.  LINUX VULNERABILITY SUMMARY
------------------------------------
1. Computer Associates ARCserve Backup Message Engine Denial of Service V=
ulnerability
BugTraq ID: 35396
Remote: Yes
Date Published: 2009-06-16
Relevant URL: http://www.securityfocus.com/bid/35396
Summary:
Computer Associates ARCserve Backup is prone to multiple denial-of-servic=
e vulnerabilities.=20

Attackers can exploit these issues to crash the affected application, den=
ying service to legitimate users.

The following applications are affected:
=20
CA ARCserve Backup r12.0 Windows
CA ARCserve Backup r12.0 SP 1 Windows

2. RETIRED: Sun Java Runtime Environment Aqua Look and Feel Privilege Esc=
alation Vulnerability
BugTraq ID: 35401
Remote: Yes
Date Published: 2009-06-16
Relevant URL: http://www.securityfocus.com/bid/35401
Summary:
Sun Java Runtime Environment (JRE) is prone to a privilege-escalation vul=
nerability.

Successful exploits may allow attackers to execute arbitrary code with el=
evated privileges on affected computers.=20

This issue affects JRE 1.5 running on Mac OS X 10.5.

NOTE: This BID is being retied because the vulnerability was previously d=
ocumented in BID 35381 (Sun Java Runtime Environment Aqua Look and Feel P=
rivilege Escalation Vulnerability).

3. Multiple Sophos Products CAB File Scan Evasion Vulnerability
BugTraq ID: 35402
Remote: Yes
Date Published: 2009-06-16
Relevant URL: http://www.securityfocus.com/bid/35402
Summary:
Multiple Sophos products are prone to a vulnerability that may allow cert=
ain compressed archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing m=
alicious code that the antivirus application will fail to detect.

 Versions prior to the following are vulnerable:
=20
 Sophos Anti-Virus for Windows 7.6.8
 Sophos Anti-Virus for Windows 4.7.23
 Sophos Anti-Virus for OS X 4.9.23/7.02
 Sophos Anti-Virus for Linux 6.6.3
 Sophos Anti-Virus for UNIX 7.0.10
 Sophos Anti-Virus for Unix 4.42.0
 Sophos Anti-Virus for Netware 4.42.0
 Sophos Email Appliance 3.1.4.1
 Sophos Web Appliance 3.0.0
 Pure Message for Unix 5.5.5

4. Multiple Browsers Cached Certificate HTTP Site Spoofing Vulnerability
BugTraq ID: 35411
Remote: Yes
Date Published: 2009-06-17
Relevant URL: http://www.securityfocus.com/bid/35411
Summary:
Multiple browsers are prone to a vulnerability that may allow attackers t=
o spoof arbitrary HTTPS sites.

Attackers may exploit this vulnerability via a malicious webpage to spoof=
 the origin of an HTTPS site. Successful exploits will lead to a false se=
nsitive security since the victim is visiting a site that is assumed to b=
e legitimate.

5. Multiple F-PROT Products RAR/ARJ/LHA/LZH File Scan Evasion Vulnerabili=
ty
BugTraq ID: 35427
Remote: Yes
Date Published: 2009-06-18
Relevant URL: http://www.securityfocus.com/bid/35427
Summary:
Multiple F-PROT products are prone to a vulnerability that may allow cert=
ain compressed archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing m=
alicious code that the antivirus application will fail to detect.

6. PHP 'exif_read_data()' JPEG Image Processing Denial Of Service Vulnera=
bility
BugTraq ID: 35440
Remote: Yes
Date Published: 2009-06-18
Relevant URL: http://www.securityfocus.com/bid/35440
Summary:
PHP is prone to a denial-of-service vulnerability in its 'exif_read_data(=
)' function.

Successful exploits may allow remote attackers to cause denial-of-service=
 conditions in applications that use the vulnerable function.
=20
 Versions prior to PHP 5.2.10 are affected.

7. PCSC-Lite Local Insecure File Permissions Vulnerability
BugTraq ID: 35444
Remote: No
Date Published: 2009-06-19
Relevant URL: http://www.securityfocus.com/bid/35444
Summary:
PCSC-Lite is prone to a local insecure-file-permissions vulnerability.

A local attacker can exploit this issue to gain unauthorized access to ce=
rtain files. This may lead to denial-of-service conditions; other attacks=
 may also be possible.

8. strongSwan Crafted X.509 Certificate Multiple Remote Denial Of Service=
 Vulnerabilities
BugTraq ID: 35452
Remote: Yes
Date Published: 2009-06-18
Relevant URL: http://www.securityfocus.com/bid/35452
Summary:
strongSwan is prone to multiple remote denial-of-service vulnerabilities.

Attackers can exploit these issues to crash the application, denying acce=
ss to legitimate users.

Versions prior to strongSwan 2.8.10,  4.3.2, and 4.2.16 are vulnerable.

9. Mozilla Thudnerbird/Seamonkey Multipart Alternative Message Memory Cor=
ruption Vulnerability
BugTraq ID: 35461
Remote: Yes
Date Published: 2009-06-22
Relevant URL: http://www.securityfocus.com/bid/35461
Summary:
Mozilla Thunderbird and Seamonkey are prone to a vulnerability when handl=
ing malformed multipart/alternative email messages with a text/enhanced p=
art. This can cause an application crash. The issue may also be exploitab=
le to execute arbitrary code.

10. Samba Format String And Security Bypass Vulnerabilities
BugTraq ID: 35472
Remote: Yes
Date Published: 2009-06-19
Relevant URL: http://www.securityfocus.com/bid/35472
Summary:
Samba is prone to multiple vulnerabilities.

Attackers can leverage these issues to execute arbitrary code within the =
context of the vulnerable application or to bypass certain security restr=
ictions.

Samba 3.0.31 through 3.3.5 are affected.

11. Net-SNMP GETBULK Divide By Zero Remote Denial of Service Vulnerabilit=
y
BugTraq ID: 35492
Remote: Yes
Date Published: 2009-06-25
Relevant URL: http://www.securityfocus.com/bid/35492
Summary:
Net-SNMP is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue allows remote attackers to cause denia=
l-of-service conditions. To exploit this issue, an attacker must have rea=
d access to an SNMP community.

This issue affects Net-SNMP as distributed with Red Hat Enterprise Linux =
3. Other distributions may also be affected.

12. Gizmo5 for Linux MSN Authentication SSL Certificate Validation Securi=
ty Bypass Vulnerability
BugTraq ID: 35508
Remote: Yes
Date Published: 2009-06-26
Relevant URL: http://www.securityfocus.com/bid/35508
Summary:
Gizmo5 for Linux is prone to a security-bypass vulnerability because the =
application fails to properly validate SSL certificates from a server.

Successfully exploiting this issue allows attackers to perform man-in-the=
-middle attacks or impersonate trusted servers. This will aid in further =
attacks.

Gizmo5 for Linux 3.1.0.79 is vulnerable; other versions may also be affec=
ted.

III. LINUX FOCUS LIST SUMMARY
---------------------------------
1. CHASE - 2009 Lahore Pakistan | Call for Papers
http://www.securityfocus.com/archive/91/504511

2. Hardening CentOS
http://www.securityfocus.com/archive/91/493893

IV.  UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securi=
tyfocus.com from the subscribed address. The contents of the subject or m=
essage body do not matter. You will receive a confirmation request messag=
e to which you will have to answer. Alternatively you can also visit http=
://www.securityfocus.com/newsletters and unsubscribe via the website.=20

If your email address has changed email [email protected] and a=
sk to be manually removed.

V.   SPONSOR INFORMATION
------------------------
This issue is sponsored by VeriSign

VeriSign EV SSL Certificates for your sites' security turn the address ba=
r in high security browsers green which helps your customers know they ar=
e safe on your site.

http://ad.doubleclick.net/clk;215510135;37701660;s