Linux Security Week - March 18th 2002

[InfoSec News <isn () c4i org>]

+---------------------------------------------------------------------+
|  LinuxSecurity.com                            Weekly Newsletter     |
|  March 18th, 2002                             Volume 3, Number 11n  |
|                                                                     |
|  Editorial Team:  Dave Wreski             dave () linuxsecurity com    |
|                   Benjamin Thomas         ben () linuxsecurity com     |
+---------------------------------------------------------------------+
 
Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.
 
This week, perhaps the most interesting articles include "Increasing
Performance in High Speed NIDS," "Going to the Source: Reporting Security
Incidents to ISPs," "Design the best security topology for y our
firewall," and "Hardening Sendmail."

FEATURE: Linux Data Hiding and Recovery - Just when you thought your data
was removed forever, Anton Chuvakin shows us how to recover data and even
how data can surruptitiously be hidden within space on the filesystem.
 
http://www.linuxsecurity.com/feature_stories/data-hiding-forensics.html 


This week, advisories were released for zlib, mod_ssl, xtel, pam_pgsql,
cyrus-sasl, netscape, mod_frontpage, openssh, rsync, gzip, NetBSD kernel,
php, fileutils, and cvs.  The vendors include Conectiva, Debian, EnGarde,
FreeBSD, Immunix, Mandrake, NetBSD, Red Hat, Slackware, SuSE, Trustix, and
Yellow Dog Linux.

http://www.linuxsecurity.com/articles/forums_article-4608.html


Security & Simplicity, Finally! - Are you looking for a solution that
provides the applications necessary to easily create thousands of virtual
Web sites, manage e-mail, DNS, firewalling database functions for an
entire organization, and supports high-speed broadband connections all
using a Web-based front-end? EnGarde Secure Professional provides those
features and more!
 
  --> http://store.guardiandigital.com 
 
 
Find technical and managerial positions available worldwide.  Visit the
LinuxSecurity.com Career Center: http://careers.linuxsecurity.com
 
 
+---------------------+
| Host Security News: | <<-----[ Articles This Week ]-------------
+---------------------+

* Hosting email for virtual domains using Postfix and Cyrus
March 16th, 2002

This document makes a humble attempt in explaining how to get Cyrus to
work. I am by no mean an expert in Cyrus IMAP or SASL or Postfix or
whatever for that matter so please send me any feedback you may have.

http://www.linuxsecurity.com/articles/server_security_article-4618.html



* Hardening Sendmail
March 15th, 2002

Ah, sendmail. You either love it for being so versatile and ubiquitous, or
you hate it for being bloated, complicated and insecure. Or perhaps you're
a complete newcomer to the e-mail server game and would like to give
sendmail a try (after all, sendmail is arguably the most popular
open-source software package on the Internet).

http://www.linuxsecurity.com/articles/server_security_article-4611.html


* Definitive guide to writing a Linux virus
March 15th, 2002

Following on from this week's discovery of the Jac Linux virus, an open
source hacker from the University of Linz, Austria, has released a
definitive guide to writing Linux viruses. The Jac virus was discovered on
Tuesday and quickly dismissed by the Linux community for its inability to
spread effectively - a common occurrence in Linux viruses.

http://www.linuxsecurity.com/articles/security_sources_article-4610.html



* UK study: Passwords often easy to crack
March 14th, 2002

Computer passwords are supposed to be secret. But psychologists say it is
possible to predict a password based on the personalities of users or even
what is on their desks.

http://www.linuxsecurity.com/articles/hackscracks_article-4602.html





+------------------------+
| Network Security News: |
+------------------------+

* Increasing Performance in High Speed NIDS
March 15th, 2002

This PDF document is a very technical overview of the Snort NIDS, and
discusses efforts currently underway to improve the performance of Snort.

http://www.linuxsecurity.com/articles/intrusion_detection_article-4617.html


* Design the best security topology for your firewall
March 12th, 2002

At its most basic level, a firewall is some sort of hardware or software
that filters traffic between your company's network and the Internet. With
the large number of hackers roaming the Internet today and the ease of
downloading hacking tools, every network should have a security policy
that includes a firewall design.

http://www.linuxsecurity.com/articles/firewalls_article-4585.html




+------------------------+
|  Cryptography:         |
+------------------------+

* Crypto-Gram March 15, 2002
March 15th, 2002

In this issue SNMP vulnerabilities, "Responsible Disclosure" by the IETF,
Terrorists, Cryptography and Export Laws, and info on Bernstein's
Factoring Breakthrough. Schneier writes, "The so-called "Responsible
Disclosure" IETF document has been released as a draft. cyber-terrorism,
and I will explain them in terms of everyday network security.

http://www.linuxsecurity.com/articles/cryptography_article-4615.html


* Factoring gains won't break strong crypto - Schneier
March 13th, 2002

Concerns that improvements in factoring technology might make it easier to
break large key length encryption codes are misplaced, according to noted
cryptographer Bruce Schneier.

http://www.linuxsecurity.com/articles/cryptography_article-4596.html



+------------------------+
|  General News:         |
+------------------------+

* Analysts: Security flaws won't undermine Linux
March 15th, 2002

Although two potential security vulnerabilities affecting the Linux
operating system have surfaced in the past three weeks, analysts and two
users say the incidents won't erode confidence in Linux as a secure and
economical alternative to Windows and Unix.

http://www.linuxsecurity.com/articles/hackscracks_article-4614.html


* The Myth of Open Source Security Revisited v2.0
March 15th, 2002

This article is a followup to an article entitled The Myth of Open Source
Security Revisited. The original article tackled the common misconception
amongst users of Open Source Software(OSS) that OSS is a panacea when it
comes to creating secure software.

http://www.linuxsecurity.com/articles/general_article-4613.html


* Security: Oh, that vulnerable feeling
March 14th, 2002

There is no doubt that the Internet has brought unparalleled connectivity
to computers, especially in the last few years. But ironically, this very
advantage has also been the bane of hundreds of corporations, all of which
critically depend on these connections to conduct their daily business.

http://www.linuxsecurity.com/articles/network_security_article-4603.html


* Significant Vulnerability Afflicts Linux Systems
March 14th, 2002

Today in a coordinated effort between all major Linux vendors, a
vulnerability in the zlib library was announced, potentially affecting
every installed Linux system in existance.

http://www.linuxsecurity.com/articles/security_sources_article-4582.html


* Going to the Source: Reporting Security Incidents to ISPs
March 13th, 2002

My interest in abuse notifications began when Warez pirates started using
my trustingly anonymous FTP server as their personal playground. I
realized that my system needed to be locked against this type of intrusion
and that I had failed to provide adequate safeguards.

http://www.linuxsecurity.com/articles/security_sources_article-4592.html


* Flaw weakens Linux computers
March 11th, 2002

A flaw in a software-compression library used in all versions of Linux
could leave the lion's share of systems based on the open-source operating
system open to attack, said sources in the security community on Monday.  
Several other operating systems that use open-source components could be
vulnerable as well.

http://www.linuxsecurity.com/articles/network_security_article-4583.html

------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc.                LinuxSecurity.com

     To unsubscribe email newsletter-request () linuxsecurity com
         with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY
of the mail.