Microsoft should build its own Linux; Commands from 'Small Business Technology King for a Day'

My commands as 'Small Business Technology King for a Day'; Jury still out on federal CIO Vivek Kundra Voices of Networking NetworkWorld.com | Update Your Profile | Forward this to a Friend >>> Sponsored by HP_Avnet How's your State of Network Efficiency? Interested in driving operational efficiencies to keep information services and communications budgets down? Find out how one user reached these very goals while also improving network availability. Download Now. Spotlight Story Microsoft Linux: Why one free software advocate wants it A lot of open source advocates like to rage against the machine at Microsoft, but when a former Microsoft Research employee says that Windows 7 won't stop Linux from market domination, that's an opinion to note. Keith Curtis, author of the book After the Software Wars, says just that. But he goes further. He thinks Microsoft and its customers would be better off if the company ditched Windows and instead built its own version of the Linux operating system. Read full story Related News: My commands as 'Small Business Technology King for a Day' Not long ago, someone asked what I would do if I were a government czar on small business, like the czar on the auto industry. I'm taking this further and proclaiming myself Small Business Technology King for a Day. While I wish my edicts were the law of the land, sadly, I am without the dungeons necessary to enforce my rulings. So take these "edicts" as free consulting for best practices in how small businesses can get the most value for their technology dollar. Jury still out on federal CIO Vivek Kundra On a recent trip to Washington DC, I met with a number of IT professionals working for the federal government. I made sure to ask each person I met what he or she thought of federal CIO Vivek Kundra. Net Neutrality - Somebody Get John McCain A VoIP Clue Phone Party affiliations aside, anyone proposing we allow carriers to clamp down and determine what content we can run through our Internet and ISP connections probably still has their secretaries print out emails for them. Would you allow Verizon or AT&T to determine who you can make calls to on their wireless networks? No. Cisco ISR G2s - Just Another 3700-series? Almost a year ago, Cisco released a huge marketing blitz titled the "Data Center Big Bang". I commented at the time that this was a big YYYYYAAAAAWWWWNNNNN. Lots of hype, not much substance. Is it reality or is it augmented? Mark Gibbs discusses the how augmented reality works and chastises the U.S. Postal Service and General Electric for playing fast and loose with terminology. 12 mad science projects that could shake the world Some science projects once only conceivable by mad scientists are now becoming more mainstream as real money is being spent on everything from shape-shifting robots to artificial intelligence-based borgs. Here we take a look at 12 projects Dr. Frankenstein would have loved. Windows 7 installation nightmares: should you wait until SP1? Gartner declared that enterprises needn't wait for Windows 7 SP1. But then the Microsoft help forums were flooded with questions and complaints from users having installation problems. Networks and the Pandemic I was talking yesterday to a colleague about the potential impact of H1N1 and business continuity planning, and in particular the impact on network operations. Data center battle heats up for Cisco Oh, what a tangled web we weave. The server, storage and networking vendor partnerships and cross-pollination expanded again this week with word that Dell and Juniper will be teaming up for data center requirements. On Linux and random numbers Look, I hate to bring this up, but there's something we need to discuss: Why haven't I heard from you recently? (No, not you, you've been in touch. It's this guy over here … ) Really, is it too much to ask that you put pen to paper … oh, all right, fingers to keyboard … and tell me what's on your mind? Microsoft Subnet is giving away training from Global Knowledge and 15 copies of Microsoft Expression Web 3 In Depth. Cisco Subnet is giving away training from Global Knowledge and 15 copies of Building Service-Aware Networks. Google Subnet is hosting many new bloggers. Entry forms can be found on the Cisco Subnet and Microsoft Subnet home pages. Network World on Twitter? You bet we are Ethernet everywhere! Inside planes, trains, cars and spaceships, Ethernet is a morph master. Here's a look at some of Ethernet's cooler implementations. 7 tools to ease Windows 7 rollout These utilities help you plan, ensure app compatibility and manage images. Why SOA-based Date Services? Data. It's your organization's most proprietary asset. Whether it's in traditional IT systems or in the internet cloud, the ability to get to it, trust it, and use it to drive effective actions is your competitive advantage. Register for the launch of Informatica 9 today.   November 02, 2009 MOST-READ STORIES Microsoft Linux: Why one free software advocate wants it Happy 40th birthday, Internet! Will Smart Grid power IPv6? IPhone app translates between English and Spanish, and vice-versa Verizon's Motorola Droid arrives Nov. 6 Juniper's splash big on tech vision, short on specifics ICANN approves international domain names Juniper lays out the pieces of 'New Network' initiative Motorola Droid vs. Apple iPhone 3GS: finally, a contender? Growth of the China CCIE count goes negative by -9 10 Ways to Increase Power System Availability in Data Centers Data centers rely on a continuous supply of clean electricity. However, anything from a subtle power system design flaw to a failure in the electrical grid can easily bring down even the most modern and sophisticated data center. Fortunately, organizations can significantly mitigate their exposure to power-related downtime by adopting proven changes to their business processes and electrical power system management practices. This white paper discusses 10 such underutilized best practices for building and maintaining a highly available data center power infrastructure. Read Now EMO Labs: Better Sound Through Innovation at DEMOfall 09 EMO Labs' Invisible Speaker innovation takes People's Choice Award top honors at DEMO conference. Watch EMO Labs product launch.   This email was sent to security.world@gmail.com Complimentary Subscriptions Available for newsletter subscribers. Receive 50 issues of Network World Magazines, in print or electronic format, free of charge. Apply here. Terms of Service/Privacy   Subscription Services Update your profile To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here. Unsubscribe Network World, Inc., 492 Old Connecticut Path, Framingham, MA 01701 Copyright Network World, Inc., 2009 www.networkworld.com | Forward this to a Friend >>>

WindowSecurity.com - Monthly Article Update

WindowSecurity.com - Monthly Article Update

Hi Security World,

New articles added to WindowSecurity.com last month:

Title: Nessus Security Scanner - Voted WindowSecurity.com Readers' Choice Award Winner - Security Scanner Software
Author: The Editor
Link: http://www.WindowSecurity.com/news/WindowSecurity-Readers-Choice-Award-Security-Scanner-Nessus-Security-Scanner-Sep09.html
Summary: Nessus Security Scanner was selected the winner in the Security Scanner Software category of the WindowSecurity.com Readers' Choice Awards. GFI LANguard and AW Security Port Scanner were first runner-up and second runner-up respectively.

Title: Buffer Overflows, Data Execution Prevention, and You
Author: Chris Sanders
Link: http://www.WindowSecurity.com/articles/Buffer-Overflows-Data-Execution-Prevention-You.html
Summary: What a buffer overflow is, how it can allow a potential attacker to execute a code on your system and how data execution can be employed in order to safeguard against this threat.

Title: Microsoft Security Essentials: Does it have a Place in the Business World?
Author: Deb Shinder
Link: http://www.WindowSecurity.com/articles/Microsoft-Security-Essentials-Does-have-Place-Business-World.html
Summary: Is deploying Microsoft's Security Essentials a great way to save money, an invitation to disaster, or something in between?

Title: VIDEO: Using Advanced Auditing to Troubleshoot Group Policy Security Settings
Author: Derek Melber
Link: http://www.WindowSecurity.com/articles/VIDEO_Using_Advanced_Auditing_Troubleshoot_Group_Policy_Security_Settings.html
Summary: Using Advanced Auditing to troubleshoot Group Policy security settings.

Title: Top 10 Windows Security Configurations: Where and How! (Part 2)
Author: Derek Melber
Link: http://www.WindowSecurity.com/articles/Top-10-Windows-Security-Configurations-Where-How-Part2.html
Summary: Part two of three articles to complete Derek Melber's top 10 Windows Security configurations.

Visit the Subscription Management (http://www.techgenix.com/newsletter/) section to unsubscribe.
WindowSecurity.com is in no way affiliated with Microsoft Corp.
For sponsorship information, contact us at advertising@windowsecurity.com

Copyright © WindowSecurity.com 2009. All rights reserved.

Whitepapers Download Alert: November 02, 2009

Whitepapers Download Alert NetworkWorld.com | Resource Library | Update Your Profile November 02, 2009 Check out Network World's comprehensive library of whitepapers for IT professionals, which includes carefully selected topics that matter most to your organization. Each week you will receive updates sent straight to your inbox. You can see all of the available whitepapers at: www.networkworld.com/resourcelibrary/?type=whitepaper 3COM Comprehensive NAC Read this whitepaper on improving endpoint defense, control and visibility through integrated management and enforcement. Sunbelt Software ITIC Research Paper: VIPRE Takes Bite out of Bloatware The remedy to bloatware is a better, more efficient and economical product that is specifically engineered to scan, detect and remove myriad security threats without impacting performance. Read this white paper to learn how a new antivirus technology platform reduces bloat and high resource usage. Akamai Akamai and Cisco on App Delivery Akamai and Cisco have teamed up to offer a complete set of application delivery solutions addressing delivery over the Internet and private WAN. These solutions can help your organization manage application delivery challenges and provide you with optimal application performance, scalability, availability, and security. VMWare Total Cost Comparison: IT Decision-Maker Perspectives Review research done by Oliver Wyman to determine the total cost of acquiring, deploying, operating, and managing storage environments from various vendors to support VMware server virtualization solutions. Tripwire FISMA Prescriptive Guide Learn how Tripwire helps federal agencies, as well as the organizations and contractors that store, process or transmit federal information. The FISMA Prescriptive Guide contains case studies from three fictional federal agencies, each capturing the perspective of a key stakeholder in the FISMA compliance process.   This email was sent to security.world@gmail.com Complimentary Subscriptions Available for newsletter subscribers. Receive 50 issues of Network World Magazines, in print or electronic format, free of charge, Apply here. Terms of Service/Privacy   Subscription Services Update your profile To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here. Unsubscribe Network World, Inc., 492 Old Connecticut Path, Framingham, MA 01701 Copyright Network World, Inc., 2009 www.networkworld.com

Moving Wi-Fi complexity into the cloud; Motorola Droid vs. Apple iPhone 3GS

Slideshow: Motorola Droid vs. Apple iPhone 3GS; New look Juniper opens up, readies for next decade Wireless Alert NetworkWorld.com | Update Your Profile | Forward this to a Friend >>> Sponsored by Aruba Networks 802.11n for an a/b/g price. Seriously. You've been told time and again that you have to pay a premium for high-performance 802.11n. But you know better. There shouldn't be a price penalty for speed. Aruba Networks' new AP-105 802.11n access point delivers best-in-class performance, reliability, security and manageability...at a fraction of the price. 802.11n for the price of 802.11a/b/g. Seriously. Click to continue Spotlight Story Moving Wi-Fi complexity into the cloud There are now at least three companies moving enterprise Wi-Fi control functions, management functions or both into the cloud. Read full story Related News: Slideshow: Motorola Droid vs. Apple iPhone 3GS Motorola's new Droid 3G smartphone could have what it takes to grab a chunk of the cellular data market and rival the iPhone's success: big touchscreen coupled with a sliding Qwerty keyboard, robust Web browser, the improved Android 2.0 operating system, and tight integration with Google services. The exclusive carrier, Verizon Wireless, is making a full-court press with Droid.This slideshow looks at both phones, based on their specifications. New look Juniper opens up, readies for next decade Juniper Networks' wide-ranging announcements last week, billed as the most significant since its founding in 1996, included a sweeping array of software, silicon, systems and partnerships designed to take the company and its customers into the next decade of networking. GPS tracking system unveiled for Alzheimer's patients The Alzheimer's Association has unveiled a Web-based application that allows Alzheimer's patients to roam within a pre-established area. If they leave that area, a GPS tracking system alerts loved ones or caregivers who can then locate them. Mobile phone shipments show signs of improvement in Q3 The mobile phone market globally turned a corner in the third quarter, with shipments by manufacturers increasing by 5.6% over the previous quarter, market research firm IDC reported. Android 2.0: The iPhone killer at last? Get past the hype: Here's the real deal on Android's chances to unseat the iPhone Sprint improving even if financial numbers don't show it, says analyst Sprint Nextel CEO Dan Hesse laid out a number of strides his company has made in such area as customer satisfaction, pricing plans and new smartphone models, but preliminary third-quarter results still showed a 9% decline in revenues and a 48% loss in profit compared to a year ago. Want to bone up on wireless tech? Try ham radio John D. Hays, an IT manager in Edmonds, Wash., devotes most of his spare time these days to helping develop a communications system that's designed to integrate portable two-way radios with the global telephone network. The project's goal is to create a failure-proof voice communications infrastructure that can immediately connect first responders with the outside world. Will Droid gain iPhone's tech 'lust' factor? Comparisons have already been made between the iPhone and the Droid smartphones, but one telling difference that might matter more is something less tangible, involving Apple fanaticism and the iPhone's two-year-plus market lead over the Droid. Unfinished Windows 7 feature turns laptops into Wi-Fi hotspots A Philadelphia developer has rooted out an unfinished feature of Windows 7 that turns any laptop into a wireless access point, allowing other Wi-Fi-enabled devices to share the connection without special software. ARM vs. Atom: The battle for the next digital frontier Small, inexpensive, power-efficient new chips from Intel and ARM are enabling the new wave of mobile devices -- and setting the two companies on a collision course Apple to ink Verizon-iPhone deal next year, analyst says Apple will probably drop its exclusive deal with AT&T next year and offer its iPhone to Verizon subscribers as well, a Wall Street analyst said today. Google drives into new market with Maps Navigation beta Google unveiled the beta version of Google Maps Navigation for Android 2.0 devices. Sprint plans open app store Sprint Nextel next year will introduce a new, more open application store on its feature phones, turning to a third party to manage it with the goal of getting new offerings out to consumers in an average of one week. Microsoft Subnet is giving away training from Global Knowledge and 15 copies of Microsoft Expression Web 3 In Depth. Cisco Subnet is giving away training from Global Knowledge and 15 copies of Building Service-Aware Networks. Google Subnet is hosting many new bloggers. Entry forms can be found on the Cisco Subnet and Microsoft Subnet home pages. Network World on Twitter? You bet we are Ethernet everywhere! Inside planes, trains, cars and spaceships, Ethernet is a morph master. Here's a look at some of Ethernet's cooler implementations. 7 tools to ease Windows 7 rollout These utilities help you plan, ensure app compatibility and manage images. Bolster your Unified Communications Know-How Do you know the business value of unified communications? Get the answer to this and many other UC questions at this Solution Center. Learn how your peers are lowering costs and improving collaboration. Get your most pressing UC queries answered from industry experts and read the very latest UC news. Access this site. Rapid Replication for Virtual Servers What's the connection between virtualization and acceleration? It's deeper than you might think. See how these two hot technologies complement each other to consolidate servers, enhance DR and simplify the IT infrastructure. Learn more.   November 02, 2009 MOST-READ STORIES Microsoft Linux: Why one free software advocate wants it Happy 40th birthday, Internet! Will Smart Grid power IPv6? IPhone app translates between English and Spanish, and vice-versa Verizon's Motorola Droid arrives Nov. 6 Juniper's splash big on tech vision, short on specifics ICANN approves international domain names Juniper lays out the pieces of 'New Network' initiative Motorola Droid vs. Apple iPhone 3GS: finally, a contender? Growth of the China CCIE count goes negative by -9 Comparing Research In Motion and Microsoft Mobile Solutions The concept of working "any time and anywhere" has become popular. To support this concept, many organizations are adopting mobile solutions. As employees use these solutions, their expectations are increasing. This paper compares the Research In Motion BlackBerry solution with the Microsoft mobile solution by analyzing features of the user experience and the administrator experience. Read about their findings. EMO Labs: Better Sound Through Innovation at DEMOfall 09 EMO Labs' Invisible Speaker innovation takes People's Choice Award top honors at DEMO conference. Watch EMO Labs product launch.   This email was sent to security.world@gmail.com Complimentary Subscriptions Available for newsletter subscribers. Receive 50 issues of Network World Magazines, in print or electronic format, free of charge. Apply here. Terms of Service/Privacy   Subscription Services Update your profile To subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here. Unsubscribe Network World, Inc., 492 Old Connecticut Path, Framingham, MA 01701 Copyright Network World, Inc., 2009 www.networkworld.com | Forward this to a Friend >>>

WindowsNetworking.com - Monthly Article Update

WindowsNetworking.com - Monthly Article Update

Hi Security World,

New articles and tutorials added to WindowsNetworking.com last month:

Title: Introduction to BranchCache - Part 1: Overview of BranchCache Features and Capabilities
Author: Thomas Shinder
Link: http://www.WindowsNetworking.com/articles_tutorials/Introduction-BranchCache-Part1.html
Summary: An overview of BranchCache's features and capabilities.

Title: Cisco IronPort S660 - Voted WindowsNetworking.com Readers' Choice Award Winner - Anti Virus Hardware Category
Author: The Editor
Link: http://www.WindowsNetworking.com/news/WindowsNetworking-Readers-Choice-Award-Anti-Virus-Hardware-Cisco-IronPort-S660-Sep09.html
Summary: Cisco IronPort S660 was selected the winner in the Anti Virus Hardware category of the WindowsNetworking.com Readers' Choice Awards. Abaca Email Protection Gateway and SpamTitan ISO were first runner-up and second runner-up respectively.

Title: Exploring Windows 7's New Search Feature (Part 2)
Author: Brien M. Posey
Link: http://www.WindowsNetworking.com/articles_tutorials/Exploring-Windows-7s-New-Search-Features-Part2.html
Summary: This article continues the discussion of Windows 7's search feature by explaining how to customize the way in which files are indexed.

Title: Deploying Windows 7 - Part 11: Capturing an Existing Installation
Author: Mitch Tulloch
Link: http://www.WindowsNetworking.com/articles_tutorials/Deploying-Windows-7-Part11.html
Summary: This series of articles on deploying Windows 7 continues with a walkthrough of how to use MDT 2010 to capture an image of an existing installation.

Title: An Introduction to AppLocker (Part 3)
Author: Brien M. Posey
Link: http://www.WindowsNetworking.com/articles_tutorials/Introduction-AppLocker-Part3.html
Summary: The tasks that must be completed before creating rules in AppLocker; Which system services must be enabled and how to avoid accidentally locking yourself out of Windows.

Title: Managing your network remotely with Cellular Routers
Author: David Davis
Link: http://www.WindowsNetworking.com/articles_tutorials/Managing-network-remotely-Cellular-Routers.html
Summary: How to use cellular Internet routers to manage your network remotely; how it is done and the technology used.

Title: Deploying Windows 7 - Part 10: Capturing and Deploying an Image of a Reference Computer
Author: Mitch Tulloch
Link: http://www.WindowsNetworking.com/articles_tutorials/Deploying-Windows-7-Part10.html
Summary: This series of articles on deploying Windows 7 continues with a walkthrough of how to capture and deploy an image of a reference computer.

Title: The evolution and future of Wi-Fi (Part 2)
Author: Russell Hitchcock
Link: http://www.WindowsNetworking.com/articles_tutorials/Evolution-future-Wi-Fi-Part2.html
Summary: Discussing the present state of Wi-Fi technology, 802.11n.

Title: Deploying Windows 7 - Part 9: Deploying 32-bit vs. 64-bit Windows
Author: Mitch Tulloch
Link: http://www.WindowsNetworking.com/articles_tutorials/Deploying-Windows-7-Part9.html
Summary: This series of articles on deploying Windows 7 continues with examining the pros and cons of deploying 32-bit vs. 64-bit Windows using MDT 2010.

Visit the Subscription Management (http://www.techgenix.com/newsletter/) section to unsubscribe.
WindowsNetworking.com is in no way affiliated with Microsoft Corp.
For sponsorship information, contact us at advertising@WindowsNetworking.com

Copyright © WindowsNetworking.com 2009. All rights reserved.

[SECURITY] [DSA 1925-1] New proftpd-dfsg packages fix SSL certificate verification weakness

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1925-1 security@debian.org
http://www.debian.org/security/ Steffen Joeris
October 31, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : proftpd-dfsg
Vulnerability : insufficient input validation
Problem type : remote
Debian-specific: no
CVE Id : CVE-2009-3639

It has been discovered that proftpd-dfsg, a virtual-hosting FTP daemon,
does not properly handle a '\0' character in a domain name in the
Subject Alternative Name field of an X.509 client certificate, when the
dNSNameRequired TLS option is enabled.

For the stable distribution (lenny), this problem has been fixed in
version 1.3.1-17lenny4.

For the oldstable distribution (etch), this problem has been fixed in
version 1.3.0-19etch3.

Binaries for the amd64 architecture will be released once they are
available.

For the testing distribution (squeeze) and the unstable distribution
(sid), this problem has been fixed in version 1.3.2a-2.

We recommend that you upgrade your proftpd-dfsg packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-dfsg_1.3.0-19etch3.tar.gz
Size/MD5 checksum: 1905969 38528feb0ffb9bd88db6f175d6020b8d
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-dfsg_1.3.0-19etch3.dsc
Size/MD5 checksum: 872 0bd9359e5bf664360be0c144225649b2

Architecture independent packages:

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mysql_1.3.0-19etch3_all.deb
Size/MD5 checksum: 162748 5608f61ea367720d306635309b85d6bc
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ldap_1.3.0-19etch3_all.deb
Size/MD5 checksum: 162748 e16562c92cdc0f0c344ded50f5916d36
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pgsql_1.3.0-19etch3_all.deb
Size/MD5 checksum: 162752 98b538acf18e6c6a7fedfcaab1a35dee
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-doc_1.3.0-19etch3_all.deb
Size/MD5 checksum: 492828 eb6950dbd7f5a48fea262fa373224d01

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.0-19etch3_alpha.deb
Size/MD5 checksum: 997748 b6db8df62a1a19529b8a75cd3965c61c

arm architecture (ARM)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.0-19etch3_arm.deb
Size/MD5 checksum: 803396 01f586c57a9df10f764b1250182aaf4a

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.0-19etch3_hppa.deb
Size/MD5 checksum: 936038 662b6032362df105994979458344e4c5

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.0-19etch3_i386.deb
Size/MD5 checksum: 798022 44f0f80e230c4f86e12daf20129ec636

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.0-19etch3_ia64.deb
Size/MD5 checksum: 1188390 9e68db2aa07f4f477e050f961e766bd5

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.0-19etch3_mips.deb
Size/MD5 checksum: 856696 0a9f117d838b1b612d05c88ac76caed4

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.0-19etch3_mipsel.deb
Size/MD5 checksum: 856038 3b04229098a901c9b4de298443af7aff

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.0-19etch3_sparc.deb
Size/MD5 checksum: 830844 08971c1104010e23c01d52b343b11f56

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-dfsg_1.3.1-17lenny4.dsc
Size/MD5 checksum: 1349 825576201541f76cbc1dcab44bae9e61
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-dfsg_1.3.1-17lenny4.diff.gz
Size/MD5 checksum: 103691 8b4252ad95f772b66b7dd06d60a1bfa6
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-dfsg_1.3.1.orig.tar.gz
Size/MD5 checksum: 2662056 da40b14c5b8ec5467505c98b4ee4b7b9

Architecture independent packages:

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-doc_1.3.1-17lenny4_all.deb
Size/MD5 checksum: 1256500 001a1754365940758a4ec97ead34fb34
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.1-17lenny4_all.deb
Size/MD5 checksum: 195088 1951485bf96a4a688495c5ebfa050749

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny4_alpha.deb
Size/MD5 checksum: 215366 e95e97a49984acf80828d18da59c72e9
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny4_alpha.deb
Size/MD5 checksum: 783554 921f2efef6cc2fc8688bcbb6ca9d8b59
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny4_alpha.deb
Size/MD5 checksum: 204746 ab8e55b37a646a496bb122e32d90b067
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny4_alpha.deb
Size/MD5 checksum: 204640 5e3dc3781500c2c5a577e39ec4446d75

arm architecture (ARM)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny4_arm.deb
Size/MD5 checksum: 214036 187789bcd2eb7d18e6ff207b296011db
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny4_arm.deb
Size/MD5 checksum: 203356 c6ac828e324d4cd79675d893b2b9af4c
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny4_arm.deb
Size/MD5 checksum: 203202 465de4f3bc6b6532208a22ba96a2a7f9
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny4_arm.deb
Size/MD5 checksum: 699814 f463140d95df55d8cd301c567878e397

armel architecture (ARM EABI)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny4_armel.deb
Size/MD5 checksum: 213884 8b1501c1cfa5a61c6af8ca3c121dddda
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny4_armel.deb
Size/MD5 checksum: 705542 f03e97c4a517b1b44af58eeba70d9db3
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny4_armel.deb
Size/MD5 checksum: 203634 68c067db2619d26b9544688d1e9e7e8b
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny4_armel.deb
Size/MD5 checksum: 203526 43efcc97292d5d0545748c6210a32689

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny4_hppa.deb
Size/MD5 checksum: 216732 a718ff67e4b488ef3052e6a1045c89f5
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny4_hppa.deb
Size/MD5 checksum: 764824 fe6033f5797b6a163ed8ce552eb7182a
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny4_hppa.deb
Size/MD5 checksum: 205296 a675af7ef1807e1e7f8cdacabf28a9c9
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny4_hppa.deb
Size/MD5 checksum: 205144 3644789a8d2e181cfdac74a2a80ac85e

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny4_i386.deb
Size/MD5 checksum: 203274 aaebf117359a3d9da24ad44d54b92370
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny4_i386.deb
Size/MD5 checksum: 203216 0b22db02bddba0d783049e83311526a5
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny4_i386.deb
Size/MD5 checksum: 688914 f7088094d696ab673f9e91631adc3bb6
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny4_i386.deb
Size/MD5 checksum: 212408 262af8522ecd16b57c11af409db528cb

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny4_ia64.deb
Size/MD5 checksum: 980974 8ab9bfd7088b9740a27a54760059b3e9
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny4_ia64.deb
Size/MD5 checksum: 222164 3ac1225c263d2678563fe0fa63a37cde
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny4_ia64.deb
Size/MD5 checksum: 207428 c2a8edc2d5f2943034ccadf0c6d67c21
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny4_ia64.deb
Size/MD5 checksum: 207274 0c4d9685cfe8479fcb24ef7eb86f301d

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny4_mips.deb
Size/MD5 checksum: 212246 f90b614ab734af4e75cb15d45d7571bd
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny4_mips.deb
Size/MD5 checksum: 691796 c2caa9adce6dd3d44c53a91e6c7b7e88
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny4_mips.deb
Size/MD5 checksum: 203262 f4947609b2a1e3b1016ff6a9b7c21d4c
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny4_mips.deb
Size/MD5 checksum: 203344 27701f545ffd35ec7fccf456a91a34ce

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny4_mipsel.deb
Size/MD5 checksum: 203266 566d885e4619eae83a3986cac1a28ad7
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny4_mipsel.deb
Size/MD5 checksum: 203412 62a1ae565c42e326ae2a129add355155
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny4_mipsel.deb
Size/MD5 checksum: 689126 f87ca4149400a5ac5bc3e17f149170b8
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny4_mipsel.deb
Size/MD5 checksum: 211804 6a32fca4e5b5cb68821670a0f59aa5ad

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny4_sparc.deb
Size/MD5 checksum: 203744 e11aedfb13f8c65a7866b3aa35a35780
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny4_sparc.deb
Size/MD5 checksum: 701992 1bb07d6070f54a0f84d237bb353c1149
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny4_sparc.deb
Size/MD5 checksum: 203486 583c76972206a115b83c6af5f700727a
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny4_sparc.deb
Size/MD5 checksum: 213718 59f82a39914654ba2a32ce50613dc83a

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkrta9wACgkQ62zWxYk/rQeDUgCfdLL9M9AYk3FihGSfLQxT5sGK
gcAAoLdYCFgKXMySMt5m7+4Gu0zH9sVE
=4qQL
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

[SECURITY] [DSA 1924-1] New mahara packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1924-1 security@debian.org
http://www.debian.org/security/ Steffen Joeris
October 31, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : mahara
Vulnerability : several vulnerabilities
Problem type : remote
Debian-specific: no
CVE IDs : CVE-2009-3298 CVE-2009-3299

Two vulnerabilities have been discovered in, an electronic portfolio,
weblog, and resume builder. The Common Vulnerabilities and Exposures
project identifies the following problems:

CVE-2009-3298

Ruslan Kabalin discovered a issue with resetting passwords, which could
lead to a privilege escalation of an institutional administrator
account.

CVE-2009-3299

Sven Vetsch discovered a cross-site scripting vulnerability via the
resume fields.

For the stable distribution (lenny), these problems have been fixed in
version 1.0.4-4+lenny4.

The oldstable distribution (etch) does not contain mahara.

For the testing distribution (squeeze) and the unstable distribution
(sid), this problem will be fixed soon.

We recommend that you upgrade your mahara packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny4.dsc
Size/MD5 checksum: 1304 a89de002e60d1435fe9c7375cdd353b3
http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4.orig.tar.gz
Size/MD5 checksum: 2383079 cf1158e4fe3cdba14fb1b71657bf8cc9
http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny4.diff.gz
Size/MD5 checksum: 40473 61fa7821c6637801a3f7a22ed5993233

Architecture independent packages:

http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1.0.4-4+lenny4_all.deb
Size/MD5 checksum: 7908 ce0748a7b83729e5f987529b871f9428
http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny4_all.deb
Size/MD5 checksum: 1637754 cf0bdb218c9fbd5723f1be19ac4b84a6

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkrsvj4ACgkQ62zWxYk/rQdqEgCfYUqtPnoTGmAOhw8j1OZFmdQv
1gAAoJWYH98HT5jkEJsRYSYvrFrNvnB/
=etyf
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org