Author: Benjamin D. Thomas
nasm, zip, pcal, tiff, namazu, imlib2, selinux, tetex, pcmcia, kernel, mysql,
gpdf, hotplug, linpopup, firefox, shoutcast, mit-kbr5, xine, phpgroupware, xzgv,
vilistextum, vim, mc, and fam. The distributors include Conectiva, Debian, Fedora,
Gentoo, Mandrake, and Red Hat.In order to keep yourself secure you must understand your enemy.
Prevention is the only protection from becoming the victim of a security
exploit. The first step in doing this is to determine what services
your servers offer, so you can secure them in the best manner possible.
Network scanning can be used to determine potential communication
channels. Mapping their existence facilitates the exchange of
information with the host, and thus is quite useful for anyone wishing
to explore their networked environment, including attackers.
Scanning, as a method for discovering exploitable communication channels,
has been around for ages. The idea is to probe as many listeners as
possible, and keep track of the ones that are receptive or useful. Once
these listeners are found, means to exploit the host can be developed.
Unnecessarily offering a particular service to a hacker means another
avenue to exploit the host.
Many different types of scanning are currently available. These range
from a simple ping test to see if the host is alive, network broadcasts,
and even performing a “stealth” attack by manipulating the ICMP, TCP, or
UDP information in a data packet, intentionally violating the protocol
definition in an attempt to trick a firewall.
Becoming familiar with the tools and techniques an attacker might use to
probe a network is the only way to know what information is available if
someone attempts to mount an attack against us. Among the things that
can be determined from port scanning a machine include:
- Services a host is offering which can then be used to construct the
appropriate attack based on information gathered from this process - If there is in fact a host at the IP address that is being scanned
- A topology map of our network, which can be used to determine where
firewalls and other hosts are positioned, trusted relationships between
those hosts, and routing and DNS information. - Operating system identification, vendor release and version, as well
as applications and their versions - Disclosure of the username and owner of any process connected via TCP,
which can then be used to determine, for example, the username of which
the web server is running
Linux Security Tip, by Ryan Maple:
http://www.linuxsecurity.com/content/view/117271/141/
LinuxSecurity.com
Feature Extras:
A 2005
Linux Security Resolution – Year 2000, the coming of the new millennium,
brought us great joy and celebration, but also brought great fear. Some believed
it would result in full-scale computer meltdown, leaving Earth as a nuclear
wasteland. Others predicted minor glitches leading only to inconvenience. The
following years (2001-2004) have been tainted with the threat of terrorism worldwide.
State
of Linux Security 2004 – In 2004, security continued to be a major
concern. The beginning of the year was plagued with several kernel flaws and
Linux vendor advisories continue to be released at an ever-increasing rate.
This year, we have seen the reports touting Window’s security superiority, only
to be debunked by other security experts immediately after release. Also, Guardian
Digital launched the new LinuxSecurity.com, users continue to be targeted by
automated attacks, and the need for security awareness and education continues
to rise.
Take advantage of our Linux Security discussion
list! This mailing list is for general security-related questions and comments.
To subscribe send an e-mail to security-discuss-request@linuxsecurity.com
with “subscribe” as the subject.
Thank you for reading the LinuxSecurity.com
weekly security newsletter. The purpose of this document is to provide our readers
with a quick summary of each week’s most relevant Linux security headline.
| Conectiva | ||
| Conectiva: mplayer vulnerabilities fix | ||
5th, January, 2005
|
||
| Conectiva: Samba vulnerabilities fix | ||
6th, January, 2005
|
||
| Conectiva: wxgtk2 library vulnerabilities fix |
||
6th, January, 2005
|
||
| Debian | ||
| Debian: CUPS arbitrary code execution fix |
||
31st, December, 2004
|
||
| Debian: htmlheadline insecure temporary files fix |
||
3rd, January, 2005
|
||
| Debian: nasm arbitrary code execution fix |
||
4th, January, 2005
|
||
| Debian: zip arbitrary code execution fix |
||
5th, January, 2005
|
||
| Debian: pcal arbitrary code execution fix |
||
5th, January, 2005
|
||
| Debian: tiff denial of service fix | ||
6th, January, 2005
|
||
| Debian: namazu2 cross-site scripting vulnerability fix |
||
6th, January, 2005
|
||
| Debian: imlib2 arbitrary code execution fix |
||
6th, January, 2005
|
||
| Fedora | ||
| Fedora: selinux-policy-targeted-1.17.30-2.62 update |
||
31st, December, 2004
|
||
| Fedora: tetex-2.0.2-14FC2.1 update | ||
3rd, January, 2005
|
||
| Fedora: tetex-2.0.2-21.2 update | ||
3rd, January, 2005
|
||
| Fedora: pcmcia-cs-3.2.7-2.1 update | ||
3rd, January, 2005
|
||
| Fedora: pcmcia-cs-3.2.7-1.8.2.2 update | ||
3rd, January, 2005
|
||
| Fedora: kernel-2.6.9-1.11_FC2 update | ||
3rd, January, 2005
|
||
| Fedora: kernel-2.6.9-1.724_FC3 update | ||
3rd, January, 2005
|
||
| Fedora: mysql-3.23.58-14 update | ||
5th, January, 2005
|
||
| Fedora: man-pages-ja-20041215-1.FC3.0 update |
||
6th, January, 2005
|
||
| Fedora: ruby-1.8.2-1.FC3.0 update | ||
6th, January, 2005
|
||
| Fedora: man-pages-ja-20041215-1.FC2.0 update |
||
6th, January, 2005
|
||
| Fedora: tetex-2.0.2-14FC2.1 update | ||
6th, January, 2005
|
||
| Fedora: tetex-2.0.2-21.2 update | ||
6th, January, 2005
|
||
| Fedora: gpdf-2.8.0-8.2 update | ||
6th, January, 2005
|
||
| Fedora: gpdf-2.8.0-4.2.fc2 update | ||
6th, January, 2005
|
||
| Fedora: hotplug-2004_04_01-8.1 update | ||
6th, January, 2005
|
||
| Gentoo | ||
| Gentoo: LinPopUp Buffer overflow in message reply |
||
4th, January, 2005
|
||
| Gentoo: a2ps Insecure temporary files handling |
||
4th, January, 2005
|
||
| Gentoo: Mozilla, Firefox, Thunderbird Various vulnerabilities |
||
5th, January, 2005
|
||
| Gentoo: shoutcast Remote code execution | ||
5th, January, 2005
|
||
| Gentoo: mit-kbr5 Heap overflow in libkadm5srv | ||
5th, January, 2005
|
||
| Gentoo: tiff New overflows in image decoding | ||
5th, January, 2005
|
||
| Gentoo: xine-lib Multiple overflows | ||
6th, January, 2005
|
||
| Gentoo: phpGroupWare Various vulnerabilities | ||
6th, January, 2005
|
||
| Gentoo: xzgv Multiple overflows | ||
6th, January, 2005
|
||
| Gentoo: vilistextum Buffer overflow vulnerability | ||
6th, January, 2005
|
||
| Mandrake | ||
| Mandrake: libtiff multiple vulnerabilities fix |
||
6th, January, 2005
|
||
| Mandrake: wcGTK2 vulnerabilities fix | ||
6th, January, 2005
|
||
| Mandrake: vim modeline vulnerabilities fix |
||
6th, January, 2005
|
||
| Mandrake: nasm buffer overflow vulnerability fix |
||
6th, January, 2005
|
||
| Mandrake: libtiff multiple vulnerabilities fix |
||
6th, January, 2005
|
||
| Red Hat |
||
| Red Hat: mc security vulnerabilities fix |
||
5th, January, 2005
|
||
| Red Hat: fam security issue fix | ||
5th, January, 2005
|
||
| Red Hat: VIM security vulnerability fix | ||
5th, January, 2005
|
||
| Red Hat: samba security issue fix | ||
5th, January, 2005
|
||
