[ISN] Linux Security Week - June 20th 2005
InfoSec News
isn at c4i.org
Tue Jun 21 01:55:58 EDT 2005
+---------------------------------------------------------------------+
| LinuxSecurity.com Weekly Newsletter |
| June 20th, 2005 Volume 6, Number 26n |
| |
| Editorial Team: Dave Wreski dave at linuxsecurity.com |
| Benjamin D. Thomas ben at linuxsecurity.com |
+---------------------------------------------------------------------+
Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.
This week, perhaps the most interesting articles include "Top
Open-Source Security Applications," "Cutting Through the Linux
Security Hype," and "Mobile & Wireless World to focus on Wi-Fi,
Security."
---
## Internet Productivity Suite: Open Source Security ##
Trust Internet Productivity Suite's open source architecture to
give you the best security and productivity applications available.
Collaborating with thousands of developers, Guardian Digital
security engineers implement the most technologically advanced
ideas and methods into their design.
Click to find out more!
http://store.guardiandigital.com/html/eng/products/software/ips_overview.shtml
---
LINUX ADVISORY WATCH
This week, advisories were released for mikmod, tcpdump, yum,
elinks, parted, system-config-securitylevel, checkpolicy,
spamassassin, gaim, libextractor, Ettercap, shtool, gedit,
MediaWiki, gzip, gftp, squid, rsh, sysreport, telnet, bz,
and mc. The distributors include Fedora, Gentoo, and Red
Hat.
http://www.linuxsecurity.com/content/view/119336/150/
---
Review: The Book of Postfix: State-of-the-Art Message Transport
I was very impressed with "The Book of Postfix" by authors Ralf
Hildebrandt and Pattrick Koetter and feel that it is an incredible
Postfix reference. It gives a great overall view of the operation
and management of Postfix in an extremely systematic and practical
format. It flows in a logical manner, is easy to follow and the
authors did a great job of explaining topics with attention paid
to real world applications and how to avoid many of the associated
pitfalls. I am happy to have this reference in my collection.
http://www.linuxsecurity.com/content/view/119027/49/
---
Introduction: Buffer Overflow Vulnerabilities
Buffer overflows are a leading type of security vulnerability. This
paper explains what a buffer overflow is, how it can be exploited,
and what countermeasures can be taken to prevent the use of buffer
overflow vulnerabilities.
http://www.linuxsecurity.com/content/view/118881/49/
---
Getting to Know Linux Security: File Permissions
Welcome to the first tutorial in the 'Getting to Know Linux Security'
series. The topic explored is Linux file permissions. It offers an
easy to follow explanation of how to read permissions, and how to set
them using chmod. This guide is intended for users new to Linux
security, therefore very simple.
http://www.linuxsecurity.com/content/view/118181/49/
--------
>> The Perfect Productivity Tools <<
WebMail, Groupware and LDAP Integration provide organizations with
the ability to securely access corporate email from any computer,
collaborate with co-workers and set-up comprehensive addressbooks to
consistently keep employees organized and connected.
http://ads.linuxsecurity.com/cgi-bin/newad_redirect.pl?id=gdn05
--> Take advantage of the LinuxSecurity.com Quick Reference Card!
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf
+---------------------+
| Security News: | <<-----[ Articles This Week ]----------
+---------------------+
* Talking with Richard Stallman
12th, June, 2005
1) Let's start. Can you explain to our readers why you started with
FSF in 1984? What did you need of? Why you created it?<br />
What I started in 1984 was the development of the GNU operating
system. All the operating systems for modern computers of the day
were proprietary; users were forbidden to share them, and could not
get the source code to change them. The only way to use computers in
freedom was to replace those systems with a free operating system.
That's what GNU was meant to do. The Free Software Foundation was
started in late 1985 to raise funds for GNU development, and more
generally to promote free software.
http://www.linuxsecurity.com/content/view/119289
* Book Review: "Apache Security" By O'Reilly
12th, June, 2005
I've just completed my review on "Apache Security" by O'Reilly."This
book was written by Ivan Ristic, the author of the popular Apache web
application firewall module mod_security. Naturally this book does
discuss how to use mod_security to harden your system, but I'm happy
to report it isn't his main area of focus. One of the first things
that I do while reviewing a book is to find all the things that the
text doesn't cover that it *really* should have and point them out in
my review. Simply put this book has everything, and I do mean
everything. Here's the low down on a per chapter basis."
http://www.linuxsecurity.com/content/view/119291
* O'Reilly Releases "SSH, The Secure Shell: The Definitive Guide,
Second Edition"
16th, June, 2005
The name looks like the sound you'd make to hush someone, which is
not inappropriate if you think of SSH, the secure shell, as a means
of silently sending information between computers. "SSH" is actually
pronounced by spelling it aloud "S-S-H," and isn't a shell at all,
but a protocol. The name was originally coined from the rsh utility,
a Unix program that also provides logins.
http://www.linuxsecurity.com/content/view/119319
* Top Open-Source Security Applications
15th, June, 2005
According to most security professionals, a top-tier, open-source
security tool must have sufficient history to allow a practitioner to
use it with confidence. And it must have a sufficiently large
developer base to ensure that fixes will be available in light of
discovered vulnerabilities. Pegasystems. Business Process Management
(BPM) solutions offer organizations the agility critical to managing
growth, productivity and compliance. Our solution unifies pure-play
BPM with a sophisticated Business Rules Engine. Pegasystems makes it
easy for people and systems to work
together.
http://www.linuxsecurity.com/content/view/119315
* Endian Firewall
15th, June, 2005
Endian Firewall is a turn-key Linux security distribution based on
IPCop that turns a system into a security appliance.
The features include a stateful packet inspection firewall,
application-level proxies for various protocols (HTTP, POP3, SMTP)
with anti-virus support, virus and spam filtering for E-mail traffic
(POP and SMTP), content filtering of Web traffic and VPN (based on
OpenVPN).
http://www.linuxsecurity.com/content/view/119314
* Intrusion Protection Systems get hot
13th, June, 2005
Taxed with providing an ever-expanding range of complex security
functions, IPS vendors are rising to the challenge, transforming
their wares to go beyond simply identifying and stopping attacks
based on updated threat profiles.
http://www.linuxsecurity.com/content/view/119304
* McAfee Aims to Prevent Linux Attacks
14th, June, 2005
McAfee is looking to help protect against what it calls a dramatic
increase of attacks on Linux systems. The company's Entercept
intrusion prevention system -- already available for Windows and
Solaris -- uses a combination of behavioral rules, signatures and a
firewall to protect IT infrastructure from attack.
http://www.linuxsecurity.com/content/view/119311
* Cutting Through the Linux Security Hype
17th, June, 2005
Do you think there are security benefits businesses could reap by
simply switching to open source solutions?<p>
Greenberg: Yes. A great number of security holes are because of
Windows having glaring security holes in its browser and mail agent.
Use Windows and Firefox, for example, instead of Windows and IE, and
80 percent of the security concerns vanish. The number of security
threats in an OS-to-OS face off is about equal, from what I see. As .
and if . Linux usage increases, the Linux threat level may
increase.
http://www.linuxsecurity.com/content/view/119337
* Java flaws open door to hackers
15th, June, 2005
Sun Microsystems has fixed a pair of security bugs in Java that could
be exploited by attackers to take over computers running Windows,
Linux and Solaris.
http://www.linuxsecurity.com/content/view/119318
* Security Best Practices
13th, June, 2005
Centralization, automation, problem prioritization--many IT-security
professionals are embracing those concepts as they fight off the
never-ending onslaught of threats. Security products can help
businesses stem the flood of vulnerabilities, but IT teams also have
to put in place processes to ensure that they're responding
appropriately and being proactive in warding off potential dangers.
Fact is, some companies spend too much on some parts of their
organization and not enough on more-vulnerable areas.
http://www.linuxsecurity.com/content/view/119294
* Easier controls improve security
14th, June, 2005
Computer Associates and RSA Security have released products to
centralise security management and make policies easier to define and
deploy. The aim is to make it simpler to implement complex data
security measures.
http://www.linuxsecurity.com/content/view/119307
* Is IPsec on borrowed time?
14th, June, 2005
For proof that hunger is growing in the information security
community for Secure Sockets Layer-based virtual private networks,
look at the latest offerings from Check Point Software and Juniper
Networks. For insight on what the big deal is, ask Steve Smith,
network manager for Erie, Pa.-based Saint Vincent Health System.
http://www.linuxsecurity.com/content/view/119309
* Stealthy Trojan horses, modular bot software dodging defenses
14th, June, 2005
Software attack tools that turn PCs into remotely controlled zombies
are getting better, but defenses are not keeping up, say security
experts. The latest threats are tailored to attack specific
companies, foregoing rapid spread and avoiding notice. Others use
modular components, such as an infector that can be changed to defeat
the latest antivirus software and a second-stage component that turns
off PC defenses.
http://www.linuxsecurity.com/content/view/119310
* Hashing exploit threatens digital security
15th, June, 2005
Cryptographers have found a way to snip a digital signature from one
document and attach it to a fraudulent document without invalidating
the signature and giving the fraud away.
http://www.linuxsecurity.com/content/view/119316
* The State Of Internet Security
15th, June, 2005
While the scams that daily flood our e-mail in-boxes show no signs of
abating, there is some good news for the users who have to sort
through them all. So says VeriSign, in its latest "State of Internet
Security" address covering the first three months of 2005.
http://www.linuxsecurity.com/content/view/119317
* BindView Presents IT Security Compliance Best Practices for the C&A
Process
16th, June, 2005
The C&A process is well-known by federal agencies as a highly manual
process that artificially increases costs and delays, and isolates
resulting data from other systems that might benefit from its use.
The webinar will cover new methodologies and technologies for
integrating the C&A process with an organization's IT security
compliance and automation efforts to achieve success in meeting
regulatory mandates and significantly reduce costs and
delays.
http://www.linuxsecurity.com/content/view/119320
* Top Open-Source Security Applications
17th, June, 2005
Those responsible for enterprise security are increasingly turning to
open-source applications in lieu of security products based on
proprietary code -- and for many good reasons.
http://www.linuxsecurity.com/content/view/119340
* Most want government to make Internet safe
16th, June, 2005
Most Americans believe the government should do more to make the
Internet safe, but they don't trust the federal institutions that are
largely responsible for creating and enforcing laws online, a new
industry survey says.
http://www.linuxsecurity.com/content/view/119326
* Your ISP as Net watchdog
17th, June, 2005
The U.S. Department of Justice is quietly shopping around the
explosive idea of requiring Internet service providers to retain
records of their customers' online activities.
http://www.linuxsecurity.com/content/view/119362
* Computer viruses become hacker informants
13th, June, 2005
An emerging breed of computer virus that keeps hackers informed about
the latest weaknesses in computer networks has been discovered by
security experts.
http://www.linuxsecurity.com/content/view/119293
* Mobile & Wireless World to focus on Wi-Fi, security, RFID
14th, June, 2005
John Wade, CIO of the Saint Luke's Health System in Kansas City, Mo.,
said he faces many of the same problems confronting other CIOs when
it comes to supporting mobile and wireless technology in a large
organization.
http://www.linuxsecurity.com/content/view/119308
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email newsletter-request at linuxsecurity.com
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
More information about the ISN
mailing list