SecurityFocus Linux Newsletter #122
Stephen Entwisle <[email protected]> Mon, 10 Mar 2003 12:12:20 -0700 (MST)
| Newsgroups | gmane.comp.security.news.linux |
|---|---|
| Message-ID | <[email protected]> |
SecurityFocus Linux Newsletter #122
-----------------------------------
I. FRONT AND CENTER
1. Cryptographic Filesystems: Design and Implementation
2. Windows Forensics - A Case Study: Part Two
3. An Analysis of Simile
4. Spam Wars Make Strange Bedfellows
5. SecurityFocus DPP Program
6. InfoSec World Conference and Expo/2003(March10-12,2003,Orlando,FL)
II. LINUX VULNERABILITY SUMMARY
1. Web-ERP Configuration File Remote Access Vulnerability
2. GTCatalog Remote File Include Vulnerability
3. File Local Stack Overflow Code Execution Vulnerability
4. PY-Livredor index.php HTML Injection Vulnerability
5. TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability
6. File Utility Local Memory Allocation Vulnerability
7. iPlanet 6.0 Log Viewing Utility Concealed Log Entry Vulnerability
8. Sn ort RPC Preprocessor Fragment Reassembly Buffer Overflow...
9. Typo3 Showpic.PHP File Enumeration Vulnerability
10. Apple QuickTime/Darwin Streaming Server parse_xml.cgi File...
11. Sendmail Header Processing Buffer Overflow Vulnerability
12. iPlanet Log Analyzer Logfile HTML Injection Vulnerability
13. Hypermail CGI Mail Open Relay Vulnerability
14. Typo3 Log HTML Injection Vulnerability
15. Typo3 Translations.PHP Remote File Include Vulnerability
16. Typo3 Translations.PHP File Disclosure Vulnerability
19. Hypermail Local Temporary File Race Condition Vulnerability
20. Ecartis Hidden Form Field Password Modification Vulnerability
22. Typo3 Runtime Error Page Information Disclosure Vulnerability
III. LINUX FOCUS LIST SUMMARY
1. Port 113 security (Thread)
2. Red Hat Network updates (Thread)
3. Reviewed the rhn code .. Red Hat Network updates (Thread)
4. Availability of Sendmail fix (Thread)
5. chroot, scp and security on RedHat 8.0 (Thread)
6. What Is hosts2-ns (Thread)
7. Article Announcement: Secure MySQL Database Design (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORM
1. N2H2 Sentian
2. iomart NetIntelligence
3. PureSight
V. NEW TOOLS FOR LINUX PLATFORMS
1. DiskZapper v1.0
2. pmacct v0.2.3
3. GPassGuard v0.01alpha
I. FRONT AND CENTER
-------------------
1. Cryptographic Filesystems: Design and Implementation
By Ido Dubrawsky
Cryptographic filesystems have recently come to the forefront of security.
This article will discuss some of the background and technology of
cryptographic filesystems and will then cover some example implementations
of these filesystems including Microsoft's Encrypting File System for
Windows 2000, the Linux CryptoAPI, and the Secure File System.
http://www.securityfocus.com/infocus/1673
2. Windows Forensics - A Case Study: Part Two
By Stephen Barish
This article is the second in a two-part series that will offer a case
study of forensics in a Windows environment. This article deals with
determining the scope of the compromise, and understanding what the
attacker is trying to accomplish at the network level. Along the way,
we'll be discussing some tools and techniques that are useful in this type
of detective work.
http://www.securityfocus.com/infocus/1672
3. An Analysis of Simile
by Adrian Marinescu
Virus writers have always tried to develop new methods to make malware
detection more difficult. For instance, encryption was a natural step in
virus evolution when scanners started to use databases with scan strings
for detection. When scanners started to handle encryption patterns
generically, first oligomorphism (a limited form of polymorphism - the
polymorphic decryptor can have a strictly limited, relatively small number
of shapes) and then polymorphism were introduced.
http://www.securityfocus.com/infocus/1671
4. Spam Wars Make Strange Bedfellows
By Jon Lasser
The open-source community is closer than ever to curing the spam problem,
but they'll have to hold their noses and help out Windows users to get
there.
http://www.securityfocus.com/columnists/146
5. SecurityFocus DPP Program
Attention Universities!! Sign-up now for preferred pricing on the only
global early-warning system for cyber attacks - SecurityFocus DeepSight
Threat Management System.
Click here for more information:
http://www.securityfocus.com/corporate/products/dpsection.shtml
6. InfoSec World Conference and Expo/2003 (March 10-12, 2003, Orlando, FL)
Optional Workshops March 8, 9, 12, 13, & 14 Vendor Expo March 10 & 11
Solutions to todays security concerns; hands-on experts; blockbuster
vendor expo; the CISO Executive Summit; invaluable networking
opportunities. InfoSec World has it all!
Go to: http://www.misti.com/10/os03nl37inf.html
II. BUGTRAQ SUMMARY
-------------------
1. Web-ERP Configuration File Remote Access Vulnerability
BugTraq ID: 6996
Remote: Yes
Date Published: Mar 01 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6996
Summary:
Web-ERP is a freely available, open source internationalized Enterprise
Resource Planning package. It is available for the Unix and Linux
operating systems.
A problem may make it possible for remote users to gain unauthorized
access to Web-ERP information.
It has been reported that Web-ERP does not sufficiently restrict access to
it's configuration information. Because of this, an attacker may be able
to remotely access Web-ERP information, and potentially gain access to
information that is sensitive in nature.
The problem is in the storage of the Web-ERP configuration file. By
default, configuration information is stored in the /logicworks.ini file.
This file is by default accessible to any user that has access to the web
server on which Web-ERP is hosted. An attacker could gain information
such as the MySQL username and password from this file.
2. GTCatalog Remote File Include Vulnerability
BugTraq ID: 6998
Remote: Yes
Date Published: Mar 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6998
Summary:
GTCatalog is software designed to maintain a catalog of products. It is
implemented in PHP and is available for a variety of platforms including
Microsoft Windows and Linux variant operating systems.
GTCatalog is prone to an issue that may allow remote attackers to include
files located on attacker-controlled servers.
This vulnerability is as a result of insufficient sanitization performed
on remote user supplied data. Specifically the PHP script file 'index.php'
is vulnerable to this issue.
Under some circumstances, it is possible for remote attackers to influence
the include path for files ending with '.custom.inc' to point to an
external file on a remote server by manipulating the '$function' and
'$custom' URI parameters.
If the remote file is a malicious file, this may be exploited to execute
arbitrary system commands in the context of the web server.
This vulnerability was reported for GTCatalog 0.9.1 and earlier.
3. File Local Stack Overflow Code Execution Vulnerability
BugTraq ID: 7008
Remote: No
Date Published: Mar 04 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7008
Summary:
file is a freely available, open source program available for Unix and
Linux operating systems.
A problem with the program may result in the execution of
attacker-supplied instructions.
It has been reported that a stack overflow exists the file program.
Although details of this issue are currently unavailable, it is likely
that this issue could be exploited to execute code as the user of the file
utility.
This vulnerability would require an attacker to create the malicious code
and place it in a critical portion of the file. Once a user executes the
file utility against this file, malicious code embedded in the ELF header
would likely be executed with the privileges of the file utility user.
It should also be noted that the file program may be executed by other
applications on the system, some of which execute with privileges. This
is true of LPRNG, which executes the file utility in the master-filter
script. Exploitation may also occur through applications such as less,
which execute the file utility when loading a file into the viewer.
4. PY-Livredor index.php HTML Injection Vulnerability
BugTraq ID: 6997
Remote: Yes
Date Published: Mar 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6997
Summary:
PY-Livredor is freely available guestbook software. It will run on most
Unix and Linux variants, as well as Microsoft Windows operating systems.
PY-Livredor does not adequately filter HTML tags from various fields on
the 'index.php' page. Specifically, an attacker may be able to insert
malicious HTML code into the "titre", "Votre pseudo", "Votre e-mail",
"Votre message" fields.
The attacker's code may be executed in the web client of users who view
the pages generated by the guestbook, in the security context of the
website hosting the software.
Attackers may potentially exploit this issue to hijack web content or to
steal cookie-based authentication credentials.
This vulnerability has been reported for PY-Livredor version 1.0.
5. TCPDump Malformed ISAKMP Packet Denial Of Service Vulnerability
BugTraq ID: 6974
Remote: Yes
Date Published: Feb 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6974
Summary:
tcpdump is a freely available, open source network monitoring tool. It is
available for the Unix, Linux, and Microsoft Windows operating systems.
A vulnerability in the processing of some packet types may result in an
inability to further use the tcpdump application.
It has been reported that tcpdump is vulnerable to a denial of service
when some packet types are received. By sending a maliciously formatted
packet to a system using a vulnerable version of tcpdump, it is possible
for a remote user to cause tcpdump to ignore network traffic from the time
the packet is received until the application is terminated and restarted.
The problem is in the handling of ISAKMP packets. When tcpdump receives a
maliciously crafted ISAKMP packet, the application enters an infinite loop
and ceases to further monitor network traffic. This could allow the
passing of undetected network traffic that would typically be seen by
tcpdump.
6. File Utility Local Memory Allocation Vulnerability
BugTraq ID: 7009
Remote: No
Date Published: Mar 04 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7009
Summary:
file is a freely available, open source program available for Unix and
Linux operating systems.
A problem with the program may result in a denial of service, and may
potentially allow the execution of attacker-supplied instructions.
It has been reported that a memory allocation issue exists the file
program. Although details of this issue are currently unavailable, it is
likely that this issue could be exploited to cause a denial of service
condition, and potentially execute code as the user of the file utility.
This problem has been reported as a memory allocation problem. Though
unconfirmed, this vulnerability is likely either a heap overflow, or a
double-free problem. In either circumstance, it would require an attacker
to create the malicious code and place it in a critical portion of the
file. Once a user executes the file utility against this file, malicious
code embedded in the file would likely be executed with the privileges of
the file utility user.
It should also be noted that the file program may be executed by other
applications on the system, some of which execute with privileges. This
is true of LPRNG, which executes the file utility in the master-filter
script. Exploitation may also occur through applications such as less,
which execute the file utility when loading a file into the viewer.
7. iPlanet 6.0 Log Viewing Utility Concealed Log Entry Vulnerability
BugTraq ID: 7012
Remote: Yes
Date Published: Mar 04 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7012
Summary:
iPlanet is an HTTP server product. It is available for a number of
platforms, including Unix and Linux variants and Microsoft Windows
operating systems.
A vulnerability has been reported for iPlanet that may conceal malicious
log entries from the 'View Access Log' and 'View Error Log' utilities. The
problem occurs due to the utilities' parsing of the 'Format=' string,
which is typically used to specify log entry formatting.
An attacker can exploit this vulnerability by generating a log entry using
a hostname which is prepended with the 'Format=' string. Because the data
supplied as the 'Format' will not be recognized by the said utilities, the
log entry will be not be shown.
It should be noted that viewing the log data with other utilities, such as
a text-based editor, will disclose the malicious entries.
8. Snort RPC Preprocessor Fragment Reassembly Buffer Overflow Vulnerability
BugTraq ID: 6963
Remote: Yes
Date Published: Mar 03 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6963
Summary:
Snort is an open-source network intrusion detection system.
A vulnerability in the Snort network IDS has been discovered that may
allow for remote attackers to compromise hosts using the system. The
vulnerability is due to a programmatic flaw in the RPC preprocessor.
The condition is in the procedure "ConvertRPC()" and occurs during the
reassembly of fragmented records. This operation uses a loop that
iterates once for each fragment copied to a buffer.
A check put in place to ensure that the total amount of data copied is not
greater than the size of the buffer is flawed:
if(length > size)
{
DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "WARNING: rpc_decode
calculated bad "
"length: %d\n", length););
return;
}
else
{
total_len += length;
index += 4;
for (i=0; i < length; i++,rpc++,index++,hdrptr++)
*rpc = *index;
}
The expression, "if(length > size)", only verifies that the length of the
current fragment is not greater than the total buffer size. The amount of
data already written to the buffer is not checked. Consequently, it is
possible to write beyond the buffer and over potentially sensitive memory:
for (i=0; i < length; i++,rpc++,index++,hdrptr++)
*rpc = *index;
Attackers can exploit this vulnerability by transmitting malicious packets
across a network monitored by Snort. Successful attacks may result in the
execution of instructions on the IDS system with root privileges.
9. Typo3 Showpic.PHP File Enumeration Vulnerability
BugTraq ID: 6982
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6982
Summary:
TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.
TYPO3 is prone to a vulnerability that will allow remote attackers to
enumerate whether or not files exist on the system hosting the software.
This issue exists in the 'showpic.php' and 'thumbs.php' scripts and may be
exploited by submitting a malicious request for a file (including the
relative path). These scripts will return information about whether or
not a file exists.
This type of information may be useful in mounting further attacks against
the host system, since the scripts will reveal information about the
layout of the host's filesystem.
10. Apple QuickTime/Darwin Streaming Server parse_xml.cgi File Disclosure Vulnerability
BugTraq ID: 6990
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6990
Summary:
QuickTime/Darwin Streaming Administration Server is server technology
which allows you to send streaming QuickTime data to clients across the
Internet.
A file retrieval vulnerability has been reported for QuickTime/Darwin
Streaming Server (SS). The vulnerability exists due to insufficient
sanitization of some parameters given to the parse_xml.cgi script.
Specifically, directory traversal sequences are not sanitized from the
value supplied to the 'filename' URI parameter. Information obtained in
this manner may be used by an attacker to launch more organinzed attacks
against a vulnerable system.
An attacker may exploit this vulnerability by making a request to the
parse_xml.cgi script containing dot-dot-slash ('../') sequences followed
by a filename. When the malicious request is processed, the Streaming
Server will disclose the contents of the file to an attacker.
This vulnerability was tested on SS for Microsoft Windows systems. Linux
versions of Darwin SS are reportedly not vulnerable to this issue.
11. Sendmail Header Processing Buffer Overflow Vulnerability
BugTraq ID: 6991
Remote: Yes
Date Published: Mar 02 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6991
Summary:
Sendmail is a widely used MTA for Unix and Microsoft Windows systems.
A remotely exploitable vulnerability has been discovered in Sendmail.
The vulnerability is due to a buffer overflow condition in the SMTP header
parsing component. Remote attackers may exploit this vulnerability by
connecting to target SMTP servers and transmitting to them malformed SMTP
data.
The overflow condition occurs when Sendmail processes addresses or lists
of addresses in fields such as "From:" or "CC:". One of the checks to
ensure that the addresses are valid is flawed, resulting in a buffer
overflow condition. Successful attackers may exploit this vulnerability
to gain root privileges on affected servers remotely.
It has been reported that this vulnerability may possibly be locally
exploitable if the sendmail binary is setuid/setgid.
Versions 5.2 to 8.12.7 are affected. Administrators are advised to
upgrade to 8.12.8 or apply available patches to prior versions of the 8.x
tree.
12. iPlanet Log Analyzer Logfile HTML Injection Vulnerability
BugTraq ID: 7017
Remote: Yes
Date Published: Mar 04 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/7017
Summary:
iPlanet is an enterprise web server software package with a built-in tool
for viewing webserver logs. It is available for Microsoft Windows, Unix,
and Linux operating systems.
iPlanet does not sufficiently sanitize HTML when logging requests. If
malicious data containing HTML and script code is logged and then viewed
using the log viewing software, exploitation will occur. Through
exploitation of this issue, it will be possible to falsify log information
and execute arbitrary script code in the web client of the user viewing
the logs.
This issue has been demonstrated when the log analysis software renders a
malicious hostname which contains hostile HTML or script code, which was
logged when the server did an inverse lookup of hostname data. This is
only one possible scenario, and it is likely that data other than the
hostname is not sufficiently filtered.
This issue occurs when viewing logs in both HTML and text mode.
13. Hypermail CGI Mail Open Relay Vulnerability
BugTraq ID: 6973
Remote: Yes
Date Published: Feb 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6973
Summary:
Hypermail is a freely available tool that converts email into HTML format.
It has been reported that Hypermail's CGI-based mail program is prone to a
condition that may allow attackers to abuse the service as an open mail
relay.
This may allow attackers to send mass mails through the vulnerable
software. It may also be possible to forge a source address to masquerade
as a trusted email user in an attempt to gather information that may be
useful in further attacks against the vulnerable system.
Full details of this vulnerability are not currently known. BID will be
updated as further details are disclosed.
14. Typo3 Log HTML Injection Vulnerability
BugTraq ID: 6983
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6983
Summary:
TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.
TYP03 logs all system and access related errors in the TYPO3 database and
provides a facility for administrators to view this information from the
web. However, data is not sanitized of HTML before being logged. As a
result, remote attackers may inject malicious HTML and script code into
log files. When these logs are viewed, the hostile code will be
interpreted in the web client of the user viewing the logs.
This may allow for theft of administrative cookie-based authentication
credentials and other attacks.
15. Typo3 Translations.PHP Remote File Include Vulnerability
BugTraq ID: 6984
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6984
Summary:
TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.
TYPO3 is prone to an issue that may allow remote attackers to include
files located on attacker-controlled servers.
This vulnerability is as a result of insufficient sanitization performed
on remote user supplied data used by a URI parameter of the
'translations.php' PHP page.
Under some circumstances, it is possible for remote attackers to influence
the path for an include file to point to an external file by manipulating
the '$ONLY' URI parameter.
If the remote file is a malicious file, this may be exploited to execute
arbitrary system commands in the context of the web server.
16. Typo3 Translations.PHP File Disclosure Vulnerability
BugTraq ID: 6985
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6985
Summary:
TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.
TYPO3 does not sufficiently sanitize input submitted via URI parameters of
potentially malicious data. This issue exists in the 'translations.php'
script. Specifically, variations of directory traversal sequences and
null characters (%00) may be specified as a value for the 'ONLY' URI
parameter. By submitting a malicious web request to this script that
contains a relative path to a resource and a null character (%00), it is
possible to retrieve arbitrary files that are readable by the web server
process.
Successful exploitation will permit the attacker to gain access to
sensitive information that may aid in mounting further attacks against the
system hosting the software.
17. Typo3 Webroot Folders Information Disclosure Weakness
BugTraq ID: 6988
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6988
Summary:
TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.
It has been reported that TYPO3 installs, by default, several directories
into the TYPO3 webroot. These directories are reportedly readable or
lacking sufficient authentication mechanisms and contain log,
configuration and script files. This weakness may result in the disclosure
of sensitive system based information to malicious web users.
The following directories and files have been reported to be prone to this
issue: /install /fileadmin/ /typo3conf/
The information gathered as a result of this weakness may be used in
further attacks against the system.
18. Typo3 HTML Hidden Form Field Information Disclosure Weakness
BugTraq ID: 6993
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6993
Summary:
TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.
Clients of TYPO3 systems may access potentially sensitive data that have
been obfuscated through hidden form fields. Such fields may contain
potentially sensitive information which may provide determined attackers
with valuable information which may be useful in exploiting other known
issues in the software.
This vulnerability was reported for TYPO3 3.5b5.
19. Hypermail Local Temporary File Race Condition Vulnerability
BugTraq ID: 6975
Remote: No
Date Published: Feb 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6975
Summary:
Hypermail is a freely available tool that converts email into HTML format.
A problem with Hypermail may make local symbolic link attacks possible.
It has been reported that Hypermail is vulnerable to a race condition
error. Under some circumstances, Hypermail creates files in the temporary
directory. However, it may be possible to create a symbolic link in a
crucial point of program execution that would result in the overwriting of
files pointed to by the link. This will only occur if the files are
writeable by the Hypermail process.
Successful exploitation may cause local files to be corrupted. If files
can be corrupted with custom data, this may result in privilege elevation.
Full details of this vulnerability are not currently known. The BID will
be updated as further details are disclosed.
20. Ecartis Hidden Form Field Password Modification Vulnerability
BugTraq ID: 6971
Remote: Yes
Date Published: Feb 27 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6971
Summary:
Ecartis is a mailing list management package for Linux, BSD, and other
Unix variant operating systems.
A vulnerability has been reported for Ecartis that may allow attackers to
modify passwords.
An attacker can exploit this vulnerability by first saving a form locally
and modifying hidden fields in the saved HTML pages and submitting them.
This will allow an attacker to authenticate as a privileged user of
Ecartis and modify passwords.
It is also possible to use tools such as curl to post arbitrary form data.
This vulnerability was reported for Ecartis 1.0.0-snap20021013. It is
likely that other version are affected.
21. Netscape Communicator Password Disclosure Weakness
BugTraq ID: 6981
Remote: No
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6981
Summary:
Netscape Communicator is a combined web browser and e-Mail Client
developed for a variety of platforms including Microsoft Windows, Linux
and Unix variant operating environments.
It has been reported that the Netscape Communicator roaming profile
function may store sensitive user credentials in the 'prefs.js'
configuration file using plaintext or easily disclosed format.
This weakness may result in an attacker accessing sensitive user
credentials that may be used in further attacks launched against the
system.
Conflicting details have been reported suggesting that perhaps this issue
may be due to a user initiated configuration change and that password data
may be encrypted using a trivial XOR based encryption algorithm by
default.
This report is closely related to the issue described in BID 6215.
22. Typo3 Runtime Error Page Information Disclosure Vulnerability
BugTraq ID: 6986
Remote: Yes
Date Published: Feb 28 2003 12:00AM
Relevant URL:
http://www.securityfocus.com/bid/6986
Summary:
TYPO3 is a web-based content management system. It is available for
Microsoft Windows operating systems and Unix and Linux variants.
An information disclosure vulnerability has been reported for TYPO3. The
vulnerability exists in several 'test', 'class' and 'library' scripts that
are included with TYPO3.
These scripts may be forced to execute and generate runtime errors. When
these errors occur, the scripts will output path information.
Information obtained in this manner may be used by an attacker to launch
further attacks against a vulnerable system.
IV. LINUX FOCUS LIST SUMMARY
----------------------------
1. Port 113 security (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/314192
2. Red Hat Network updates (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/314193
3. Reviewed the rhn code .. Red Hat Network updates (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/314126
4. Availability of Sendmail fix (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/314058
5. chroot, scp and security on RedHat 8.0 (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/314036
6. What Is hosts2-ns (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/313811
7. Article Announcement: Secure MySQL Database Design (Thread)
Relevant URL:
http://online.securityfocus.com/archive/91/313541
IV. NEW PRODUCTS FOR LINUX PLATFORM
-----------------------------------
1. N2H2 Sentian
by N2H2
Platforms: Linux, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL:
http://www.n2h2.com/products/sentian_home.php
Summary:
Sentian filtering software works with a wide variety of implementations to
meet the needs of organizations both large and small. Whichever device you
prefer, every Sentian product uses the categorized filtering database
recognized as the most effective available.
2. iomart NetIntelligence
by iomart
Platforms: AIX, Linux, Netware, Solaris, Windows 2000, Windows 95/98,
Windows NT, Windows XP
Relevant URL:
http://www.netintelligence.com/
Summary:
The NetIntelligence product consists of a main reports interface which is
supported by easy to use administration tools. NetIntelligence has a
deployment application which is purpose built for straightforward rollout
of the product. Thereafter the main technical interface is via the
administration console which allows the administrator to establish
policies, user and machine groups- and delegate reporting authority to
specified users within the organisation. Custom content allows bespoke
fingerprinting as required. Web-blocking gives policy control over
Internet Usage.
3. PureSight
by iCognito
Platforms: Linux, Solaris, Windows 2000, Windows NT
Relevant URL:
http://www.icognito.com/Products/PureSightHomeDescription.shtml
Summary:
PureSight Home is a powerful tool that helps parents and other concerned
users embrace technology in their homes while safeguarding the family from
intentional or accidental viewing of inappropriate content. PureSight Home
provides maximal protection from objectionable materials on the web
without the need for costly and time-consuming updates. Easily installed
and customized, the password-protected tool can be readily set and
modified according to parental preferences.
V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. DiskZapper v1.0
by Phil Howard
Relevant URL:
http://diskzapper.com/
Platforms: N/A
Summary:
DiskZapper is a Linux-based bootable (floppy or CD-ROM) tool intended to
wipe all hard drives on the machine it runs on to binary zero. This is
intended for uses such as making sure old computers or hard drives being
sold or trashed are clear of any confidential data, and to be sure certain
computers are clear of any unlicensed software in the event the software
piracy police visit. It comes in the form of a floppy image (ready to dd
or rawrite) or a CD ISO image (ready to burn to CDR). No other software or
OS required. This is a dangerous tool. Please store out of reach of
children.
2. pmacct v0.2.3
by Paolo Lucente
Relevant URL:
http://www.ba.cnr.it/~paolo/pmacct/
Platforms: Linux, OpenBSD
Summary:
pmacct is a network tool to gather IP traffic information (source address,
bytes counter, and number of packets). Data is stored in an in-memory
table whose content could be retrieved by a client program via a local
stream-oriented connection. Gathering packets off the wire is done using
the pcap library and one or more network interfaces in promiscuous mode.
3. GPassGuard v0.01alpha
by RUAUDEL Frédéric
Relevant URL:
http://passguard.sourceforge.net/
Platforms: Linux, POSIX
Summary:
GPassguard is a GTK+ frontend to the *PassGuard suite, which manages
passwords in an encrypted file so that you only have to remember one. It
uses the PassGuard Framework and can be interfaced with any kind of
encryption via a plugin system. It allows you to copy passwords to the
clipboard.