released for mailman, kde, MySQL, mc, Apache, Heimdal, utempter, and LHA. The
distributors include Conectiva, FreeBSD, Gentoo, Mandrake, Red Hat, and SuSE.
One of the most overlooked
aspects of information security is incident response. Often system administrators
and management only take action after a compromise or critical failure. Incident
response includes much more than sorting out problems after they occur. It includes
incident preparation, detection mechanisms, containment, eradication, restoration,
In preparation for a security
incident, it is important to establish a security policy & plan of action and
identify a security response team that is available 24 hours. Software to be
used during an incident should be installed, tested, and configured during the
preparation phase. During the adrenaline rush of an incident, it is impossible
to learn new software.
Administrators should also
take appropriate steps to ensure event detection. This includes scanning and
reviewing system log files, installing host and network based intrusion detection
systems, and implementing a remote notification system to notify members of
the security response team via pager or mobile phone.
Upon detection of an incident,
it is important to have containment procedures. Is the threat a network user?
It is important that the staff has the knowledge and tools necessary to address
the problem at the firewall level. If there is a system compromise, is tripwire
configured properly to report exactly what files were modified? After containment,
the next step is eradication. How can the problem be eliminated? The primary
purpose of containment and eradication is limiting damage and stopping the problem
from further damage.
After an incident has commenced,
the next step is system restoration. It is important to assess the actual damage
that took place and restore the system to its original condition. This may only
include fixing a few files, or restoring completely from a tape-backup. Finally,
after restoration is important to review how well the incident was handled.
Until next time, cheers!
Benjamin D. Thomas
Digital Security Solutions Win Out At Real World Linux
- Enterprise Email and Small Business Solutions Impres at Linux Exposition.
Internet and network security was a consistent theme and Guardian Digital
was on hand with innovative solutions to the most common security issues.
Attending to the growing concern for cost-effective security, Guardian Digital's
enterprise and small business applications were stand-out successes.
with Siem Korteweg: System Configuration Collector
- In this interview we learn how the System Configuration Collector (SCC)
project began, how the software works, why Siem chose to make it open source,
and information on future developments.
MySQL and PHP
- This is the second installation of a 3 part article on LAMP (Linux Apache
MySQL PHP). In order to safeguard a MySQL server to the basic level, one has
to abide by the following guidelines.
Linux Advisory Watch
is a comprehensive newsletter that outlines the security vulnerabilities that
have been announced throughout the week. It includes pointers to updated packages
and descriptions of each vulnerability.
Fixes cross site scripting and remote password retrieval vulnerabilities,
The telnet, rlogin, ssh and mailto URI handlers in KDE do not check for
Buffer cache invalidation vulnerability
In some situations, a user with read access to a file may be able to prevent
Two MySQL utilities create temporary files with hardcoded paths, allowing
Multiple security issues have been discovered in Midnight Commander including
| 1.3 Multiple
Several security vulnerabilites have been fixed in the latest release of
A possible buffer overflow in the Kerberos 4 component of Heimdal has been
Mailman versions >= 2.1 have an issue where 3rd parties can retrieve member
Plain text passwords
The affected versions store OpenLDAP passwords in plain text.
An updated utempter package that fixes a potential symlink vulnerability
Ulf Harnhammar discovered two stack buffer overflows and two directory traversal
Denial of service vulnerability
Upon receiving specially crafted ISAKMP packets, TCPDUMP would crash.
Insufficient input sanitation
The URI handler of the kdelibs3 and kdelibs class library contains a flaw