This week, advisories were released for named, bind, gnupg, tcsh, ncurses, telnetd, nss_ldap, openssh, cups, modutiles, pine, and imap. The vendors include Caldera, Debian, FreeBSD, Mandrake, Conectiva, Immunix, Trustix, Red Hat, Slackware and SuSE. It is critical that you update all vulnerable packages to reduce the risk of being compromised. Many of the vulnerabilites described are root compromises. Also, if you are running bind/named, make sure that you upgrade so you are not vulnerable to DoS attacks.

http://www.linuxsecurity.com/articles/forums_article-1952.html

Webmasters, our advisory and news feed is now available in RDF format. We invite you to use and customize our feed to provide up-to-date security content on your website.

http://www.linuxsecurity.com/linuxsecurity_articles.rdf http://www.linuxsecurity.com/linuxsecurity_advisories.rdf

** FREE Apache SSL Guide from Thawte ** Planning Web Server Security? Find out how to implement SSL! Get the free Thawte Apache SSL Guide and find the answers to all your Apache SSL security issues and more at: http://www.thawte.com/ucgi/gothawte.cgi?a=n055017540018000 Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines.

Host Security News:

November 16th, 2000 -- Python: Security Aspects -- Python is a versatile programming language with many applications in the Web environment. BYTE magazine comments that it is "a bridge between Unix shell programming and C programming. That is, Python is ideal for projects that are too complex for the normal shell tools to handle, but not so complex that they are worth writing in C or C++."

http://www.linuxsecurity.com/articles/host_security_article-1947.html

November 14th, 2000 -- Where the Log Files Live -- In today's article, I'd like to tie together some of the concepts we've learned so far from the previous articles in the series. Let's apply our newfound skills to see what we can find out about FreeBSD and system logs.

http://www.linuxsecurity.com/articles/host_security_article-1933.html

November 14th, 2000 -- Hackers' Tricks to Avoid Detection -- Hackers are not only clever in how they invade servers; they are also devious in how they disguise their attacks. Malicious attackers use a variety of evasive techniques, which we will examine in this column so that we, as administrators, can be better prepared to detect and respond to them.

http://www.linuxsecurity.com/articles/hackscracks_article-1938.html

November 14th, 2000 -- How Companies Can Enhance Web Security -- With the peak online holiday buying season just around the corner, Internet security experts are urging U.S. companies to enhance their security posture in light of recent threats made by hacker groups in the Middle East to launch an electronic holy war against companies with ties to Israel.

http://www.linuxsecurity.com/articles/server_security_article-1935.html

November 13th, 2000 -- SSL In The Driver's Seat -- E-commerce is driving the Internet economy; e-commerce wouldn't be driving anything if users didn't purchase items online; overcoming users fears while shopping online has been the major hurdle in growing e-commerce; a single Internet protocol has almost single handedly increased e-commerce by making secured transactions possible. Introducing SSL

http://www.linuxsecurity.com/articles/cryptography_article-1925.html

Network Security News:

November 18th, 2000 -- Building Linux and OpenBSD Firewalls -- Just because your paranoid does not mean they are not really after you. It is an old saying but one that applies equally well to network security, just because you have not been attacked does not mean someone is not trying. The subject of firewalls used to be the domain of network security administrators running large networks connected to the Internet.

http://www.linuxsecurity.com/articles/documentation_article-1963.html

November 16th, 2000 -- Paranoia Vs. Transparency And Their Effects On Internet Security -- Lately, reactions to non-intrusive probes and network activity that is merely unexpected are becoming increasingly hostile; a result from increasing amounts of incidents and security threats. From my perspective of security, overreactions to activities not crossing authorization and legal boundaries, are leading to a scenario where anyone acquiring basic information about a system needs to be afraid about potential consequences.

http://www.linuxsecurity.com/articles/network_security_article-1948.html

November 14th, 2000 -- The ABCs of IDSs (Intrusion Detection Systems) -- The basic function of an IDS is to record signs of intruders at work inside and to give alerts. Depending on the product, how it is deployed and its network configuration, an IDS may only scan for attacks coming from outside one's network or it may also monitor activities inside the network.

http://www.linuxsecurity.com/articles/intrusion_detection_article-1932.html

Cryptography News:

November 17th, 2000 -- Will the Future Be Anonymous? -- The work of David Chaum and Stefan Brands on protocols, such as blind signatures, that provide anonymity has attracted a great deal of interest among people interested in cryptography. In the RSA algorithm, given a public key consisting of an encryption exponent, e, and a modulus M, and a private key consisting of the decryption exponent d:

http://www.linuxsecurity.com/articles/cryptography_article-1955.html

November 15th, 2000 -- Encryption system for govt bosses -- Top bureaucrats will be able to swap classified material on the Net with the launch this week of a "Secure Electronic Environment" linking Treasury, the State Services Commission and the Department of Prime Minister and Cabinet.

http://www.linuxsecurity.com/articles/cryptography_article-1941.html

November 15th, 2000 -- Crypto-Gram November -- Crypto-gram is a free monthly newsletter providing summaries, analyses, insights, and commentaries on computer security and cryptography. This month's issue includes topics on digital certificates, more on Secrets and Lies, the recent Microsoft hacks, and just how meaningless the SDMI challenge really is. Must read.

http://www.linuxsecurity.com/articles/cryptography_article-1945.html

November 14th, 2000 -- US unlocks encryption market -- Australia is said to be at least two years behind the United States when it comes to the internet, so the two-year communication blackout between the US and Australian branches of encryption developer RSA Security seems entirely appropriate.

http://www.linuxsecurity.com/articles/cryptography_article-1940.html

Vendor/Product/Tools News:

November 17th, 2000 -- Freeware Port Scanners: Plug the Holes -- It doesn't take long to figure out the security problem with these port technologies: If a port lets data flow out, it also lets data flow in. A port is essentially an opening into your computer, and it can be hacked. Someone can infect your machine with a Trojan horse in this way, and that's only one of a host of distressing possibilities.

http://www.linuxsecurity.com/articles/network_security_article-1960.html

General News:

November 17th, 2000 -- Questions arise about access to personal data on Web -- As more individuals build their own Web sites, some privacy advocates now question requirements that the site owners disclose their personal contact information. Names, e-mail addresses, postal addresses and telephone numbers for more than 24 million domain names are stored in databases called Whois. The information is available to anyone with an Internet connection. It's like a global phone directory -- without the option for an unlisted number.

http://www.linuxsecurity.com/articles/privacy_article-1958.html