Updates for the Ubuntu kernel and for the apache2 server have been released. The kernel update fixes multiple vulnerabilities whihc could result in the corruption of the file system, Denial of Service conditions, bypassing certain security restrictions and the disclosure of sensitive information. Versions 6.10, 7.04 and 7.10 are vulnerable. The apache2 update addresses Cross Site Scripting and Denial of Service vulnerabilities on versions 6.06, 6.10, 7.04 and 7.10.
First, a couple of new tools are available specifically geared at cracking Oracle 11g password hashes. These are specifically aimed at attacking the newest features that 11g introduces to better protect the passwords. They also have some short cuts for those folks still making the old style DES passwords available (likely for backwards compatibility with older apps or uses). Essentially, these new mechanisms are slower than old hash attacks, but are still effective. In today’s world of computational power and bot-net distributed password cracking capability, it is pretty darn safe to assume that if the attacker can get the hash – they can get the password.
Another issue that is likely to be an annoyance for some folks is that a new remote Denial of Service attack has been identified in Ubuntu 6.06 DHCP server. While the attacker can’t really gain access to the system using it, they can replace the dead DHCP server with their own, which could include malicious entries and other annoyances. This DHCP server is popular in many cyber cafes I have visited – particularly outside of the US. Just another reminder that you have to pay attention to network connectivity. It might seem like ubiquitous wireless access is a boon, but without the capability to trust the network you use, you have little reason to trust the content you receive! — Just a reminder!