Kdelibs Update for Mandrake 8.x

Security 10929 Published by Philipp Esselbach 0

MandrakeSoft has released a security update for Kdelibs under Mandrake Linux 8.1 & 8.2

"A vulnerability was discovered in Konqueror's cross site scripting protection, in that it fails to initialize the domains on sub-(i)frames correctly. Because of this, java script may access any foreign subframe which is defined in the HTML source, which can be used to steal cookies from the client and allow other cross-site scripting attacks. This also affects other KDE software that uses the KHTML rendering engine."

Read more

Group warns of hacked Sendmail programs

Security 10929 Published by Philipp Esselbach 0

CNET News reports that some copies of Sendmail are implanted with a back door that could allow access to Internet attackers:

"The source code files of Sendmail 8.12.6 were apparently modified as far back as Sept. 28, according to the advisory. The Sendmail Consortium removed file transfer protocol (FTP) access to the server on Sunday. A safe version of the file can still be downloaded via the Web."

Read more

phpWebSite XSS Vulnerability

Security 10929 Published by Philipp Esselbach 0

A new security patch for phpWebSite has been released:

"A Cross-Site Scripting vulnerability found in phpWebSite that would allow attackers to inject script codes into the page and executing it on the clients browser as if it were provided by the site."

Read more

Virus writers get Slapper happy

Security 10929 Published by Philipp Esselbach 0

CNET News reports that new variants of the Slapper Worm are out:

"The newest variant, dubbed "Mighty," exploits the same Linux Web server flaw that other versions of the Slapper worm have used to slice through the security on vulnerable servers. Russian antivirus company Kaspersky Labs said in a release Friday that more than 1,600 servers had been infected by this latest variant as of Friday morning and are now controlled by the worm via special channels on the Internet relay chat system."

Read more

New Slapper worm variants spread

Security 10929 Published by Philipp Esselbach 0

InfoWorld reports that two new variants of the Slapper worm have appeared

"The latest variants of the original Slapper.A worm use different UDP ports to communicate with other infected servers, and have different names from the original worm. While Slapper.A uses the name "bugtraq" and relies on UDP port 2002, Slapper.B is called "cinik" and uses port 1978 while Slapper.C is named "unlock" and uses port 4156, according to an advisory published by F-Secure."

Read more

New Security Updates for Mandrake

Security 10929 Published by Philipp Esselbach 0

MandrakeSoft has released two security updates:

Security Advisory MDKSA-2002:060 : tcltk
Some problems were discovered with the Tcl/Tk development environment. The expect application would search for its libraries in /var/tmp prior to searching in other directories, which could allow a local user to gain root privilege by writing a trojan library and waiting for the root user to run the mkpasswd utility. This is fixed in version 5.32 of expect. A similiar vulnerability has been fixed in the tcltk package which searched for its libraries in the current working directory prior to searching in other directories. This could be used to execute arbitrary code by local users through the use of a trojan library.

Read more

Security Advisory MDKSA-2002:061 : glibc
A heap buffer overflow exists in the XDR decoder in glibc version 2.2.5 and earlier. XDR is a mechanism for encoding data structures for use with RPC, which is derived from Sun's RPC implementation which is likewise vulnerable to a heap overflow. Depending on the application, this vulnerability may be exploitable and could lead to arbitrary code execution. Thanks to Solar Designer for the patches used to correct this vulnerability.

Read more

Slapper worm smarting less

Security 10929 Published by Philipp Esselbach 0

CNET News has posted another article about the Slapper Worm

"Known as Linux.Slapper.Worm, Slapper and Apache/mod_ssl, the worm's spread has fallen far short of the biggest attackers in recent times. For example, Code Red infected 400,000 servers last summer. And according to the "National Strategy to Secure Cyberspace," the Nimda virus compromised 86,000 systems last fall.

Perhaps most telling, security experts are already talking about Slapper in the past tense."

Read more

Previous Page

Next Page

Windows

Linux

macOS

Community

  • SeveG
    need some help here... situationPC= Packard BellOS= win1 ...
  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...
  • StephanX
    Hi friends, i am new in the Linux universe but i try to ...