*** {02.27.012} Other - MacOSX SoftwareUpdate unauthenticated downloads
A released advisory indicates the MacOSX SoftwareUpdate component
downloads software updates over unauthenticated HTTP before executing
them with root privileges. It's possible for a malicious proxy server
or attacker who is capable of redirecting traffic to feed trojaned
updates to the system.This vulnerability is not confirmed. Source: SecurityFocus Bugtraq http://archives.neohapsis.com/archives/bugtraq/2002-07/0061.html ____________________________________________________________ \ / Scott Fosseen - Systems Engineer - Arrowhead AEA 5 \ www.aea5.k12.ia.us/aeaphone.nsf/Web/FosseenScott /____________________________________________________________ ----- Original Message ----- From: "Network Computing and The SANS Institute" <[EMAIL PROTECTED]> To: "Scott Fosseen (SD381534)" <[EMAIL PROTECTED]> Sent: Thursday, July 11, 2002 5:28 PM Subject: Security Alert Consensus #027 > To: Scott Fosseen (SD381534) > Re: Your personalized newsletter > > -- Security Alert Consensus -- > Number 027 (02.27) > Thursday, July 11, 2002 > Created for you by > Network Computing and the SANS Institute > Powered by Neohapsis > > ---------------------------------------------------------------------- > > Welcome to SANS' distribution of the Security Alert Consensus. > > ---------------------------------------------------------------------- > > The Center for Internet Security Will Soon Release Benchmark Security > Standards For Securing Apache Servers; SANS Will Launch A New Training > Program Based On The Benchmark on August 28 in DC. > See for course outline: http://www.sans.org/CIS_Apache > Register for the DC Course: > https://registration.sans.org/cgi-bin/SecuringApache_register > > ---------------------------------------------------------------------- > > This week's recap is not as grim as in weeks prior. While vendors > are still releasing patches for the previous DNS resolver, OpenSSH > and Apache vulnerabilities, the notable items this week include a > security update to the Squid proxy server (item {02.27.004}) and two > problems in the iPlanet Web Server search feature (items {02.27.009} > and {02.27.016}). > > On the lighter side of security, an advisory released this week > details various security problems in the new Sharp Zaurus PDA. If > you connect your Zaurus to a network of some sort, an attacker > can potentially access the FTP service -- and your files -- > unhindered. So, much like a laptop or a desktop, you need to be weary > when connecting other portable computing devices to public networks. > http://archives.neohapsis.com/archives/bugtraq/2002-07/0093.html > > Until next week, > --Security Alert Consensus Team > > ************************************************************************ > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > TABLE OF CONTENTS: > > {02.27.011} Win - Worldspan gateway malformed connection DoS > {02.27.013} Win - BEA Weblogic connection flood DoS > {02.27.015} Win - MyWebServer large URL DoS > {02.27.019} Win - Argosoft Mail Server Pro arbitrary file retrieval > {02.27.021} Win - KF Web Server %00 directory browsing > {02.27.012} Other - MacOSX SoftwareUpdate unauthenticated downloads > > > - --- Windows News ------------------------------------------------------- > > *** {02.27.011} Win - Worldspan gateway malformed connection DoS > > The Worldspan gateway daemon shipped with Worldspan for Windows > version 4.1 crashes when sent malformed data, leading to a denial of > service attack. > > This vulnerability is not confirmed. > > Source: SecurityFocus Bugtraq > http://archives.neohapsis.com/archives/bugtraq/2002-07/0048.html > > *** {02.27.013} Win - BEA Weblogic connection flood DoS > > BEA Weblogic versions 7.0 and prior that use the performance pack > (enabled by default) crash when a remote attacker causes a particular > connection flood, leading to a denial of service attack. > > The advisory indicates confirmation by the vendor, which released > a patch. > > Source: VulnWatch > http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0008.html > > *** {02.27.015} Win - MyWebServer large URL DoS > > MyWebServer version 1.02 crashes when a remote attacker submits a > large URL request, leading to a denial of service attack. > > This vulnerability is not confirmed. > > Source: SecurityFocus Bugtraq > http://archives.neohapsis.com/archives/bugtraq/2002-07/0073.html > > *** {02.27.019} Win - Argosoft Mail Server Pro arbitrary file retrieval > > The HTTP server included with Argosoft Mail Server Pro version > 1.8.1.5 allows remote attackers to view/download arbitrary files > located outside the Webroot by using reverse directory traversal > ('..') notation in URL requests. > > This vulnerability is confirmed; a patch is available at: > http://www.argosoft.com/applications/mailserver/ > > Source: SecurityFocus Bugtraq > http://archives.neohapsis.com/archives/bugtraq/2002-07/0029.html > > *** {02.27.021} Win - KF Web Server %00 directory browsing > > KF Web Server version 1.0.2 displays directory indexes regardless > of the existence of a default HTML document (index.html). This > vulnerability is triggered by appending '%00' to the URL request. > > This vulnerability is confirmed by the vendor, which released version > 1.0.3. It is available at: > http://www.keyfocus.net/kfws/download/ > > Source: VulnWatch > http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0007.html > > > - --- Other News --------------------------------------------------------- > > *** {02.27.012} Other - MacOSX SoftwareUpdate unauthenticated downloads > > A released advisory indicates the MacOSX SoftwareUpdate component > downloads software updates over unauthenticated HTTP before executing > them with root privileges. It's possible for a malicious proxy server > or attacker who is capable of redirecting traffic to feed trojaned > updates to the system. > > This vulnerability is not confirmed. > > Source: SecurityFocus Bugtraq > http://archives.neohapsis.com/archives/bugtraq/2002-07/0061.html > > ************************************************************************ > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (BSD/OS) > Comment: For info see http://www.gnupg.org > > iD8DBQE9LeLz+LUG5KFpTkYRAo3kAJ4gvWpkEFpcvtRCnYt1HF5Rig2DOgCfQols > GTKAYd9HKULR5/4bwU3zsfo= > =cmMh > -----END PGP SIGNATURE----- > ------------------------------------------------------------------------ > > The Center for Internet Security Will Soon Release Benchmark Security > Standards For Securing Apache Servers; SANS Will Launch A New Training > Program Based On The Benchmark on August 28 in DC. > See for course outline: http://www.sans.org/CIS_Apache > Register for the DC Course: > https://registration.sans.org/cgi-bin/SecuringApache_register > > ---------------------------------------------------------------------- > > Become a Security Alert Consensus member! If this e-mail was passed > to you and you would like to begin receiving our security e-mail > newsletter on a weekly basis, we invite you to subscribe today. > http://www.sans.org/sansnews/ > > We are signing the Consensus newsletter > with PGP. The new SANS PGP key is posted at: > http://www.pgp.net:11371/pks/lookup?op=get&search=0xA1694E46 and can > also be accessed from the SANS Web site (http://www.sans.org). > > Special Note: To better secure your confidential information, > we will no longer include personal URLs in our Consensus > newsletter mailings. Instead, we have created a new form > (http://www.sans.org/sansurl). On this form you can enter the SD > number located near your name at the top of the newsletter. When you > submit this form, an e-mail containing a URL will be sent to you at > the e-mail address on record. With this URL you can make changes to > your account (edit the content of your Consensus mailing, for example) > without endangering the security of your personal URL. If you'd like > to change your e-mail address or other information, please visit your > new URL as described above. If you have any problems or questions, > e-mail us at <[EMAIL PROTECTED]>. > > If you would like to unsubscribe from this newsletter, grab your SD > number (next to your name at the top of this message) and visit the > URL below. You will be sent a personal URL via E-mail, from which > you can unsubscribe. http://www.sans.org/sansurl > > Missed an issue? You can find all back issues of > Security Alert Consensus (and Security Express) online. > http://archives.neohapsis.com/ > > Your opinion counts. We'd like to hear your thoughts on Security Alert > Consensus. E-mail any questions or comments to <[EMAIL PROTECTED]>. > > Copyright (c) 2002 Network Computing, a CMP Media LLC > publication. All Rights Reserved. Distributed by Network > Computing (http://www.networkcomputing.com) and The SANS Institute > (http://www.sans.org). Powered by Neohapsis Inc., a Chicago-based > security assessment and integration services consulting group > ([EMAIL PROTECTED] | http://www.neohapsis.com/). > > > > --- > [This E-mail scanned for viruses by Declude Virus] > >
smime.p7s
Description: application/pkcs7-signature
