___________________________________________________________________________

                        Turbolinux Security Announcement

        Package : wu-ftpd
        Vulnerable Packages: Versions previous to wu-ftpd-2.6.1-10
        Date: Wed Jan 23 12:26:21 PST 2002

        Affected Turbolinux versions: previous to wu-ftpd-2.6.1-10

        Turbolinux Advisory ID#:  TLSA2002002

   Credits: http://www.debian.org/security/2001/dsa-087
___________________________________________________________________________

A security hole was discovered in the package mentioned above.
Please update the package in your installation as soon as possible.
___________________________________________________________________________

1. Problem Summary

   CORE ST reports that an exploit has been found for a bug in the wu-ftpd

   glob code. This is the code that handles filename wild card expansion.

2. Impact

   Any logged in user (including anonymous FTP users) can exploit the bug

   gain root privileges on the server.

3. Solution

  This has been  corrected in version  wu-ftpd-2.6.1-10

  Update the package from our ftp server by running the following command:

  rpm -Uvh ftp://ftp.turbolinux.com/pub/updates/6.0/security/<rpm>

  Where <rpm> are the following:

  wu-ftpd-2.6.1-10.i386.rpm

  The source RPM can be downloaded from:

  ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/wu-ftpd-2.6.1-10.src.rpm

  **Note: You must rebuild and install the RPM if you choose to download
  and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
  THE SECURITY HOLE.

 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
---------------------------------------------------------------------------
  370d61d7c3a74180a1532bf462a460de  wu-ftpd-2.6.1-10.i386.rpm
  1d259c40e1c744d72d8bb8724f9ebe47  wu-ftpd-2.6.1-10.src.rpm
___________________________________________________________________________

Our PGP KEY is available here:


 http://www.turbolinux.com/security/tlgpgkey2002-01-09.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 rpm --checksig --nogpg name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

___________________________________________________________________________
You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ for TL6.0 Workstation
   and Server security updates
   ftp://ftp.turbolinux.com/pub/updates/7.0/security/ for TL7.0 Workstation
   and Server security updates

Our web page for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
___________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.
  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security updates
  and alerts.
  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce
___________________________________________________________________________

The CSO perspective on healthcare security and compliance

Posted on 20 May 2013.  |  Randall Gamby is the CSO of the Medicaid Information Service Center of New York. In this interview he discusses healthcare security and compliance challenges and offers a variety of tips.

Cyber espionage campaign uses professionally-made malware

Posted on 20 May 2013.  |  A massive cyber espionage campaign has been hitting government ministries, IT companies, academic research institutions, and more.

Ransomware adds password stealing to its arsenal

Posted on 17 May 2013.  |  Microsoft researchers are warning about a new variant of the well-known Reveton ransomware doing rounds.

IT security jobs: What's in demand and how to meet it

Posted on 15 May 2013.  |  Let's say you want a career in information security, where do you start? What credentials do you need? What are employers looking for? Read on to find some answers.

Hacking charge stations for electric cars

Posted on 15 May 2013.  |  Ofer Shezaf talks about what charge stations really are, why they have to be ‘smart’ and the potential risks created to the grid, to the car and most importantly to its owner’s privacy and safety.