As expected, this has been a slow week for advisories. Were there less vulnerabilities this week, or did people just decide to take time off? Probably the latter. One observation that I made yesterday is that the amount of spam in my junk box was extremely low. What could it be? Are the new US spam laws starting to make a difference, or do spammers celebrate Christmas too? Again, probably the latter.
Face it, the amount of spam that you received in 2003 is almost at an unbearable point. It is only going to get worse in 2004. Its now time to do something about it, rather than just perpetually holding down the delete key. Spam is costing you time, and your organization money. Luckily (or unluckily), the rest of the Linux community is in the same boat as you. There are many open source solutions available to address the problem.
When in thinking in terms of security, spam can affect a network's availability. Having a considerable amount of spam traffic can slow down or in fact prevent legitimate traffic from reaching the intended destination. Like all security problems, it is important to address the problem at multiple levels. One of the best places to confront spam is at the client level. Today, many mail clients available for the Linux operating
system have sophisticated spam filtering abilities. Most notably, the mail client included with Mozilla does an excellent job.
Spam should also be taken on at the server level. One of the mostly widely used spam management packages is SpamAssassin. It is highly flexible software that uses several techniques for identifying illegitimate messages. Because it such a widely used set of software, there are many guides and configuration documentation available. More information on SpamAssassin can be found at: http://spamassassin.org/
For those of you who do not have the time and resources to properly configure a mail server with spam protection but need to address the problem, there are several solutions available. Guardian Digital offers a mail server and spam/virus protection package that can be setup in literally minutes. Rather than spending endless hours in vi editing .conf files, the Guardian Digital Secure Mail suite will allow you to setup a mail server, set spam filtering options, and enable virus protection with several clicks of a mouse in your browser. To find out more about Guardian Digital's solution, visit the following website:
Until next time, cheers!
Benjamin D. Thomas
OSVDB - An Independent and Open Source Vulnerability Database
- This article outlines the origins, purpose, and future of the Open Source
Vulnerability Database project. Also, we talk to with Tyler Owen, a major
Digital Launches the First Secure Small Business Internet Productivity Solution
- Guardian Digital, the world's premier open source Internet security company,
announced the availability of Internet Productivity Suite, a comprehensive
productivity and security management system. Focused on the increasing requirements
of small and medium organizations, this cohesive and highly-secure suite of
applications combine to protect users from Internet threats while providing
the features necessary to operate a complete Internet presence.
An Introduction and Interview with Founder, James Yonan
- In this article, Duane Dunston gives a brief introduction to OpenVPN and
interviews its founder James Yonan.
Linux Advisory Watch
is a comprehensive newsletter that outlines the security vulnerabilities that
have been announced throughout the week. It includes pointers to updated packages
and descriptions of each vulnerability.
malformed packet vulerabilities
Both vulnerabilities will make the Ethereal application crash. The Q.931
A vulnerability was discovered in the XDM display manager that ships with
on negative cache poisoning vulernability
The following excerpts show that include/arpa/inet.h must be updated from
buffer overflow vulnerability
A carefully-crafted configuration file can cause an exploitable buffer overflow