The following updates will be sent out to all Signature servers beginning on 1-27-2010.

http://www.alpineweb.com/support/hosting/updates/2010/01272010_server_update.html

The following updates were completed on all servers on 06 Jan 2010:

http://www.alpineweb.com/support/hosting/updates/2010/01062010_server_update.html

Remember Y2K? Well, this isn’t anything like Y2K, but it could result in SpamAssassin incorrectly tagging legitimate mail as spam.

In short, the SpamAssassin FH_DATE_PAST_20XX rule adds 3.4 points to mail dated 01-01-2010 and later.

This was reported as a bug at the SpamAssassin site:

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6269

Promptly at the start of the new year, all mails started getting an extra 3.4
points based on FH_DATE_PAST_20XX:

The quick fix for VPS accounts is to edit the FH_DATE_PAST_20XX rule in the following file:

FreeBSD /usr/local/share/spamassassin/50_scores.cf
Linux /usr/share/spamassassin/50_scores.cf

and change the following line:

score FH_DATE_PAST_20XX 2.075 3.384 3.554 3.188 # n=2

to:

score FH_DATE_PAST_20XX 0 # n=2

Verio is currently working overtime on the problem and expect a dist to go out in the next 12-24 hours.

AlpineWeb Design customers should send e-mail to support@alpineweb.com and watch this blog for further updates on the FH_DATE_PAST_20XX SpamAssassin bug.

The following updates will be completed on all servers (28 December – 30 December 2009):

Linux MPS/VPS; FreeBSD MPS/VPS v1, v2,v3:

*.securesites.net

The securesites.net shared SSL digital certificate will be renewed. All servers will receive the updated certificate information. Apache and Dovecot will be restarted as part of the update. No action needed.

More Updates:

http://www.alpineweb.com/support/hosting/updates/2009/index.html

Note: This notification could include technical inaccuracies or typographical errors. Changes can be made to the information herein; these changes will be distributed in new notifications. AlpineWeb might make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time.

The following updates will be sent out to all Signature servers beginning on 12/16/2009.

http://www.alpineweb.com/support/hosting/updates/2009/12142009_server_update.html

Important updates in this Notification:

• CPX for Linux and v3
• Enhanced Webmail for Linux and v3
• Apache for Linux and v3
• Dovecot for Linux and v3
• User Quotas for Linux
• ClamAV for Linux and v3
• Sendmail for Linux
• Access for Linux and v3
• MySQL 5.0.x for v3
• PCRE for v3
• cURL for v3
• new kernel for Signature (FreeBSD 6.3 servers only)

The following dist will be completed 11/16/2009 through 11/18/09 in all datacenters:

http://support.alpineweb.com/hosting/updates/2009/11162009_server_update.html

Browsers vulnerable to a counterfeit PayPal SSL certificate include Internet Explorer, Google Chrome and Apple Safari.  Mozilla Firefox is not susceptible to the fraudulent SSL certificate as it does not use the Microsoft library files used by all three of those browsers.  If you are using any of the web browsers mentioned above we recommend downloading the more secure Mozilla Firefox.

Dan Goodwin posted this at the Register.com earlier this month:

… on Monday published a counterfeit secure sockets layer certificate that exploits a gaping hole in a Microsoft library used by all three of those browsers. Although the certificate is fraudulent, it appears to all three to be a completely legitimate credential vouching for the online payment service. The bug was disclosed more than nine weeks ago, but Microsoft has yet to fix it.

See the complete article here: http://www.theregister.co.uk/2009/10/05/fraudulent_paypay_certificate_published/

Important updates in this Notification:

• Kernel for Linux
• User Quotas for Linux
• TCP Sockets for Linux
• Firewall for v3

The following dist will be completed 10/12/2009 through 10/23/09 in all datacenters:

http://support.alpineweb.com/hosting/updates/2009/10162009_server_update.html

Many of our clients have contacted us in regard to an email they have received. Messages similar to the suspicious email listed below may be related to phishing scams, schemes to commit identity theft, or other attempts to compromise users’ machines or personal information. If you receive this email, or one that is similar, DO NOT respond—delete it immediately! Do not click any links in the email, and do not “unsubscribe” or acknowledge the email in any way.

The email looks like this:

Subject: A new settings file for the user@yourdomain.com has just been released

Dear user of the yourdomain.com mailing service!

We are informing you that because of the security upgrade of the mailing service your mailbox (user@yourdomain.com) settings were changed. In order to apply the new set of settings click on the following link:

Link Located Here

Best regards, yourdomain.com Technical Support.

If you have additional questions please feel free to contact us:  https://secure.alpineweb.com/helpdesk/

The recent news about the phishing attack on Hotmail e-mail accounts and an article posted at Wired.com highlights the problems associated with throwaway e-mail accounts and weak passwords.

“Cyber-crooks evidently used “phishing” tactics to dupe users of Microsoft’s free Web-based email service into revealing account and access information”

For more info see:

http://www.google.com/hostednews/afp/article/ALeqM5hUNTRmUHwH4caMtUe7yPwZuJ-5sQ

An article posted at Wired.com highlights the findings of a researcher regarding commonly used passwords by Hotmail users:

“Forty-two percent of the passwords used lowercase letters from “a to z”; only six percent mixed alpha-numeric and other characters.”

For the full article see:

http://www.wired.com/threatlevel/2009/10/10000-passwords/

The Hotmail.com incident illustrates some of the dangers of free throwaway e-mail accounts and why “Free” is not always free.

A guide to choosing strong passwords can be found here:

http://support.alpineweb.com/knowledgebase/security/passwords.html