Ubuntu Security Notice 4294-1 - It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could use this vulnerability to execute arbitrary shell commands as any non-root user. It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An unprivileged local attacker could read the first line of any file on the filesystem.

Russia remains fDi’s most diversified commodity economy, while second ranked Brazil has displaced Ukraine into third place. Cathy Mullan reports.

DA-WIN, a wireless IDS, provides an organization a continuous wireless scanning capability that is light touch and simple. It utilizes compact and discreet sensors that can easily be deployed reducing the total cost of protection and simplifying the effort required for absolute, categoric regulatory compliance. This archive includes a dd image to be used on a Raspberry Pi and a user manual.

DA-WIN, a wireless IDS, provides an organization a continuous wireless scanning capability that is light touch and simple. It utilizes compact and discreet sensors that can easily be deployed reducing the total cost of protection and simplifying the effort required for absolute, categoric regulatory compliance. This archive includes a dd image to be used on a Raspberry Pi and a user manual.

man-cgi versions prior to 1.16 suffer from a local file inclusion vulnerability.

Telus Actiontec WEB6000Q with firmware 1.1.02.22 suffers from a denial of service vulnerability. By querying CGI endpoints with empty (GET/POST/HEAD) requests causes a Segmentation Fault of the uhttpd webserver. Since there is no watchdog on this daemon, a device reboot is needed to restart the webserver to make any modification to the device.

Ubuntu Security Notice 4059-1 - It was discovered that Squid incorrectly handled certain SNMP packets. A remote attacker could possibly use this issue to cause memory consumption, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that Squid incorrectly handled the cachemgr.cgi web module. A remote attacker could possibly use this issue to conduct cross-site scripting attacks. Various other issues were also addressed.

(Please visit the site to view this video)

What does it take to make a city greener? In San Francisco, it took a small group of motivated people to come together to create a nonprofit. After the city cut funding for urban forestry 36 years ago, seven individuals decided to take matters into their own hands. They created a nonprofit, Friends of the Urban Forest (FUF).

Starting with a Small Budget, FUF Plants Nearly Half San Francisco's Street Trees

The organization started off with just a small budget from a leftover city grant. Then it used grassroots efforts to rally neighborhoods throughout the city around urban trees. By empowering and supporting communities and homeowners to plant and care for their own trees, FUF has successfully planted 60,000 of the 125,000 trees in San Francisco. The group eventually even worked with the city to create San Francisco's first ever Urban Forest Plan.

FUF Harnesses the Power of Many Volunteers to Plant and Advocate for Trees

FUF is a member of TechSoup, and TechSoup's staffers were very excited to reach out for an interview to hear more about the group's impact. My team joined FUF early on a Saturday morning for its volunteer tree planting event in the Portola neighborhood, a part of the city that is lacking street trees. It was cold even by San Francisco standards, but there was an impressive turnout of volunteers present and ready to plant.

The executive director of FUF, Dan Flanagan, joined us and told us about his work. "We get to get out in the city and make it greener. We advocate for trees; I always call ourselves the Lorax of San Francisco. We are the only organization in San Francisco that is speaking for the trees."

FUF Gets the Chance to Plant Even More Trees … in Neighborhoods That Really Need Them

Dan was excited about a recent accomplishment for the organization. San Francisco just passed Proposition E, which opens up major opportunities for the nonprofit. As he said, "It changes the responsibility from street trees and sidewalks away from the homeowners and to the city. As a result, homeowners are no longer responsible, and now we actually get a chance to make the city more green than ever before by planting more trees in neighborhoods that couldn't afford it before."

This policy makes the city responsible for maintenance, but it will still require FUF to continue its work of planting the trees. FUF hopes to plant 1,700 trees this year and ultimately hopes to plant 3,000 trees every year.

FUF Puts Technology from TechSoup to Work

I was curious to find out how FUF was using technology to further its mission. Jason Boyce, individual gifts manager, said: "Here at Friends of the Urban Forest, a lot of our field staff tend to be out in the field all day; technology really needs to be out of the way to allow us to plant. So, as a result, the relationships we build with our community tend to be stronger because we use technology to enable our work, but it doesn't get in the way of our work."

Jason explained, "We have been working with ArcMap for years, ... GIS software that TechSoup has provided for us. We use it to plant trees, to figure out where we are going to plant. When we do our plantings, we actually dole out the maps that our volunteers use to do the plantings, and all that comes through ArcMap. We use Adobe Acrobat to put together our tree manuals for our new tree owners and volunteer manuals. We use AutoCAD to put together the permit drawings for our sidewalk gardens. Technology plays a really important role in doing our plantings and making San Francisco more green."

FUF Partners with the City to Calculate the Environmental Benefits of Trees

Jason also recently worked with the city on the Urban Forest Map, which is an interactive online map that tracks every tree in San Francisco. The map helps calculate the environmental benefits the trees provide, including stormwater mitigation, air pollutants captured, and carbon dioxide removed from the atmosphere. This platform has increased the visibility of the city's urban forest.

As Jason said, "We are now at the forefront of cities worldwide that are building software to manage their urban forests. … [This] really gives a lot of benefit to the people living in San Francisco."

TechSoup is proud to support organizations like Friends of the Urban Forest by enabling them with the technology they need. That support gives them more time to focus on their impact, like planting trees, or to build the communities that help them thrive.

spanhidden

In this age of increasing hacks and cybercrime, the Norman Rockwell Museum has a lot of digital assets, museum operations data, and private patron data that need to be protected. Find out why Frank Kennedy, IT manager at the Rockwell museum, chose Veritas Backup Exec to be a key part of the museum's security strategy.

About the Museum

Norman Rockwell is one of the great iconic painters and illustrators of American life in the 20th century. His hundreds of covers for the Saturday Evening Post magazine alone are a national treasure. The Norman Rockwell Museum is located in Stockbridge, Massachusetts, where Rockwell spent the last part of his celebrated life. The museum started two years before Rockwell's death in 1978 and houses over 100,000 of his works and also those of other illustrators.

The museum now has 140,000 annual visitors, and 220,000 people view its traveling exhibitions each year. It also has an active website with more than 600,000 worldwide unique visitors per year.

The Museum's IT System

IT Manager Frank Kennedy is an IT department of one (plus an occasional contractor). He supports 90 staff and volunteers and is responsible for critical information security and data protection for the museum.

The museum's IT network consists of several large physical servers and many single-purpose virtual machines. The single-purpose virtual machines allow for emergency service without disrupting other departments.

Frank says, "Most of our enterprise software is procured via TechSoup, which makes it affordable to license so many servers! We do not have to make do with weak, low-budget software."

Digital Assets: Preserving Art over the Long Term

Frank Kennedy explains that digital assets are of increasing importance in the work of museums. There are high-resolution images or copies of art works that must be carefully stored to preserve work in its best condition. He says that digital versions are often irreplaceable, as when the original object is disintegrating or would be damaged by further handling.

The digital versions keep a faithful record of the art in its best state. The most sensitive objects of this museum include a collection of Rockwell's cellulose nitrate film negatives, which deteriorate over time.

The museum also has analog audio and video tape and motion picture film that deteriorates, as well as works on paper that degrade with exposure to light. Other crucial data for the museum includes databases for collection management, point of sale records, donor management, and email.

Frank's backup system is designed to be redundant on purpose. He says, "Protecting this data means keeping many copies in many places. Doing so becomes a big challenge when the size of the data becomes several terabytes. I use many layers of redundancy."

The Backup Crisis

As the museum's data got bigger and bigger, and server patches piled on, the museum's previous backup solution eventually became unstable. Frank reports that his backups were failing constantly and causing him stress in his careful, risk-based management approach. When he first went to get a new backup solution from TechSoup, he discovered that what he needed was not available.

He says, "The cost for the options I use would have been over $4,000 per year, unbudgeted. TechSoup responded to users' desperate cry and worked with Veritas to bring Backup Exec back to TechSoup! I can't even describe my relief. Veritas Backup Exec is better than ever. It is so stable that I get suspicious and have to go look just to be sure it's really working!"

Why the Norman Rockwell Museum Chose Backup Exec over Other Options

Frank told me that the license he gets from TechSoup includes every option his museum needs. These options and features include

• Exchange Server backup
• Unlimited media server backups
• Unlimited agents for specific applications like VMware, Windows, Linux, and so on
• Simplified disaster recovery
• Protection against accidental deletion, damage, or overwriting
• Storing backups to disk, network share, tape (any type), or cloud — or all four at once
• Virtual machine snapshots that are viewable directly from the host's agent
• A deduplication engine so backed-up data is as clean as possible
• Backup retention periods that can be defined per job and per media server
• An excellent graphical user interface
• The status of every backed-up resource available at a glance
• Sending an email to the admin when anything goes wrong
• Running several jobs simultaneously (depending on server horsepower)

Advice for Museums and Other Organizations Considering Veritas Backup Exec

• Backup Exec is powerful software geared toward backing up an entire network. It requires some study to do the installation and learn the software.
• You don't get phone support with the charity licensing, so you need to be comfortable Googling for answers and working in the Veritas community support forum.
• Frank recommends dedicating a strong server for running the software. He likes eight cores and 32 GB of RAM; hot-swappable, hot-growable RAID-5; fast network connectivity; and a very large uninterruptible power supply (UPS).
• Avoid the temptation to install other services or applications on what seems to be a machine that is often idle.

In a Nutshell

Frank's experience is that "Veritas Backup Exec is the best, most reliable, most flexible, and versatile backup software you can get. Commit the needed resources to operate it, and you will be rewarded with peace of mind and business continuity. Your donors will be pleased that you are protecting their investment so carefully."

Image: Norman Rockwell Museum / All rights reserved / Used with permission

spanhidden

Eighty-one percent of Americans have social media accounts, and that number is expected to grow each year. Nearly all brands have a social presence, and libraries are no different. Libraries are using social platforms now more than ever before.

The New York Public Library has 2.2 million followers on Twitter, more followers than the celebrity Kathy Griffin. Social media is playing a significant role in helping libraries stay relevant in our ever-growing digital society.

TechSoup recently teamed up with WebJunction to find out the details on how libraries are using social media. We wanted to know how often libraries are using platforms and what some of their biggest challenges are. We surveyed 311 libraries throughout the country and found out some interesting things.

In our survey, we found that 55 percent of respondents serve fewer than 25,000 patrons, so nearly half of the respondents were smaller libraries, probably mostly in rural areas. We found that libraries are using social, and they are eager to grow their channels.

More than half (55.7 percent) of libraries spend less than 5 hours per week on social media, and 28 percent spend only 6 to 10 hours a week.

Libraries use Facebook more than any other social platform. Twitter is the next most popular platform, and then Instagram.

Forty-four percent of libraries post daily on Facebook, and 25 percent also post daily on Twitter.

Libraries are using social media to share events and pictures, educate people about services, highlight their collections, and support other libraries.

Growing followers and finding staff support are some of libraries' biggest social media challenges.

Learn How to Grow Your Library's Social Media Channels with Our WebJunction Webinars

Registration is now open for the Social Media and Libraries Webinar Series, hosted by WebJunction and TechSoup for Libraries in collaboration. We'll help you build a social media strategy, including how to select platforms that work with different types of library content to create brand awareness, increase traffic, and meet community goals. This series will highlight social media best practices to keep patrons and library staff engaged, develop measurable goals, and cultivate new readers and learners in your community.

On October 24, join us to learn how libraries can effectively use social media tools, even with limited staff and time. Learn how to identify the appropriate social media platforms to market library services and events, and how to integrate best social media practices in your library's marketing plan. We'll help you build a foundation for your social media strategy and provide practical ideas and tactics for immediate use in your library.

Register for October 24

On November 30, join us to learn all about social media analytics. Now that you are using social media to engage with your community, how do you know if it's working? If you don't know where to start when planning your social media metrics, join us to learn the best methods to measure your library's social media outcomes. During this event, you will learn how to establish measurable goals, identify key performance indicators (KPIs), and evaluate your social media results

Register for November 30

On December 19, join us to learn how to take the next steps toward amplifying your library's social media program. During this third webinar in our social media series, we'll discuss best practices in growing your library's social media program and managing user engagement. You'll learn tips on assessing the members of your library's audience based on their preferred platforms, and ideas for converting your in-person library community into an online community.

Register for December 19

How Is Your Library Using Social Media?

Our survey is still going on! Take our survey and tell us how your library is using social media.

spanhidden

As champions of National Cyber Security Awareness Month (NCSAM), we're kicking off our first week with a focus on email. Read on for facts and tips on email security from the National Cyber Security Alliance.

Across the world, 269 billion emails are sent every day. It's estimated that the average business user will receive 96 emails per day by 2019 (source: Radicati).

Given our reliance on the medium, it's no surprise that email is one of cybercriminals' favorite methods of attack. According to the National Cyber Security Alliance, 85 percent of U.S. organizations have experienced a phishing attack and 30 percent of people have opened a phishing email.

There are simple steps you can take to ensure that you don't become a victim of a cyberattack. Somewhat like a poker tell, suspicious emails contain hints that the sender isn't who they claim to be.

Watch this video to learn how to spot email scams.

The Facts About Email Scams

• Suspicious emails engage in "spoofing," a type of scam in which attackers impersonate a trustworthy entity to make it more likely that the recipient will open and act on the email.
• Spoofed emails typically employ one of two tactics:
  • Phishing, the attempt to obtain sensitive information such as usernames, passwords, and credit card details (and, indirectly, money) for malicious reasons.
  • Spreading malware by getting the user to open malicious email attachments or click on malicious links.

Practical Tips on Spotting Suspicious Emails

• Look carefully at the email and ask yourself the following questions:

• • Do you know or recognize the "from" address or contact's name?
  • Does the message contain incorrect grammar or misspelled words?
  • Does the message ask you to take action on something you didn't request, such as "click on this link to pick the new phone you requested"?

• If the answer to the first is no, or the answer to the second or third above is yes:
  

• • Don't click on links. Instead, hover your cursor over links to determine if the address is unknown, suspicious, or misleading: for example, www.microsoft.com.maliciousdomain.it. Don't open any attachments the email contains.
  • If you suspect a work email is a phishing attack, immediately report it to your IT administrator so they can alert your fellow coworkers of the attempted attack. If it's a personal email, most email service providers provide a mechanism to report that. Check out this example from Gmail.

Additional Cybersecurity Resources

• Want to learn more about cybersecurity and how you can keep your data safe? Read our latest blog post about the Equifax breach.
• Need a little inspiration? Find out how TechSoup and Symantec are making a difference in the lives of at-risk teens.
• Get more security tips from the National Cyber Security Alliance. National Cyber Security Alliance Month — observed every October — was created as a collaborative effort between government and industry to ensure all Americans have the resources they need to stay safer and more secure online. Find out how you can get involved.

Image: National Cyber Security Alliance

spanhidden

Egypt is well on the way to establishing a diversified economy, claims Hala El Saeed, minister of planning and economic development 

Ubuntu Security Notice 4335-1 - Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, bypass same-origin restrictions, conduct cross-site scripting attacks, or execute arbitrary code. Various other issues were also addressed.

Ubuntu Security Notice 4336-1 - It was discovered that GNU binutils contained a large number of security issues. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could cause GNU binutils to crash, resulting in a denial of service, or possibly execute arbitrary code.

Ubuntu Security Notice 4337-1 - It was discovered that OpenJDK incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service while processing a specially crafted regular expression. It was discovered that OpenJDK incorrectly handled class descriptors and catching exceptions during object stream deserialization. An attacker could possibly use this issue to cause a denial of service while processing a specially crafted serialized input. Various other issues were also addressed.

Ubuntu Security Notice 4338-1 - Agostino Sarubbo discovered that re2c incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code.

Ubuntu Security Notice 4339-1 - Brandon Perry discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS. Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS. Various other issues were also addressed.

Ubuntu Security Notice 4332-2 - USN-4332-1 fixed vulnerabilities in File Roller. This update provides the corresponding update for Ubuntu 20.04 LTS. It was discovered that File Roller incorrectly handled symlinks. An attacker could possibly use this issue to expose sensitive information.

Ubuntu Security Notice 4340-1 - It was discovered that CUPS incorrectly handled certain language values. A local attacker could possibly use this issue to cause CUPS to crash, leading to a denial of service, or possibly obtain sensitive information. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. Stephan Zeisberg discovered that CUPS incorrectly handled certain malformed ppd files. A local attacker could possibly use this issue to execute arbitrary code. Various other issues were also addressed.

Ubuntu Security Notice 4338-2 - USN-4338-1 fixed vulnerabilities in re2c. This update provides the corresponding update for Ubuntu 20.04 LTS. Agostino Sarubbo discovered that re2c incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code.

Ubuntu Security Notice 4341-1 - Andrei Popa discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. It was discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could possibly use this issue to cause Samba to consume resources, resulting in a denial of service. Various other issues were also addressed.

Ubuntu Security Notice 4342-1 - Al Viro discovered that the Linux kernel for s390x systems did not properly perform page table upgrades for kernel sections that use secondary address mode. A local attacker could use this to cause a denial of service or execute arbitrary code. It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service. Various other issues were also addressed.

Ubuntu Security Notice 4343-1 - Al Viro discovered that the Linux kernel for s390x systems did not properly perform page table upgrades for kernel sections that use secondary address mode. A local attacker could use this to cause a denial of service or execute arbitrary code.

Ubuntu Security Notice 4344-1 - It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service. It was discovered that the Intel WiMAX 2400 driver in the Linux kernel did not properly deallocate memory in certain situations. A local attacker could use this to cause a denial of service. Various other issues were also addressed.

Ubuntu Security Notice 4345-1 - Al Viro discovered that the Linux kernel for s390x systems did not properly perform page table upgrades for kernel sections that use secondary address mode. A local attacker could use this to cause a denial of service or execute arbitrary code. It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service. Various other issues were also addressed.

Ubuntu Security Notice 4346-1 - It was discovered that the QLogic Fibre Channel driver in the Linux kernel did not properly check for error, leading to a NULL pointer dereference. A local attacker could possibly use this to cause a denial of service. It was discovered that the Intel Wi-Fi driver in the Linux kernel did not properly check for errors in some situations. A local attacker could possibly use this to cause a denial of service. Various other issues were also addressed.

Ubuntu Security Notice 4341-3 - USN-4341-1 fixed vulnerabilities in Samba. The updated packages for Ubuntu 16.04 LTS introduced a regression when using LDAP. This update fixes the problem. It was discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could possibly use this issue to cause Samba to consume resources, resulting in a denial of service. Various other issues were also addressed.

Ubuntu Security Notice 4348-1 - It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this to issue execute arbitrary scripts or HTML. It was discovered that Mailman incorrectly handled certain inputs. An attacker could possibly use this issue to display arbitrary text on a web page. It was discovered that Mailman incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. Various other issues were also addressed.

Ubuntu Security Notice 4341-2 - USN-4341-1 fixed a vulnerability in Samba. This update provides the corresponding update for Ubuntu 14.04 ESM. It was discovered that Samba incorrectly handled certain LDAP queries. A remote attacker could possibly use this issue to cause Samba to consume resources, resulting in a denial of service. Various other issues were also addressed.

Ubuntu Security Notice 4333-2 - USN-4333-1 fixed vulnerabilities in Python. This update provides the corresponding update for Ubuntu 20.04 LTS. It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. Various other issues were also addressed.